Why Claude's Writing Carries a Fingerprint · Issue #192

Opening

Reader, on August 10, Anthropic quietly posted a document to its help center. It said that Claude models released after August 2, 2026 embed a machine-readable mark into the text they generate. The mark itself is invisible, survives copy-paste, and holds up under a fair amount of editing without disappearing.

If this were about images, it would make immediate sense. It’s well known that Google DeepMind’s SynthID inserts invisible watermarks into generated images, a technique many readers have probably already heard about in some form. But how do you hide something invisible inside a sentence? Do you slip special characters between the letters?

No, that’s not how it works. Let me give you the answer up front, since it’s really the key to everything that follows. There’s simply no physical empty space in text to hide anything in. So instead of attaching a mark to the writing, this technology very slightly bends the way the model chooses its words. The watermark isn’t stuck onto the text — it is the text. Today, let’s unpack how this structure works, and why this same underlying principle explains both its power and its limits.

Images Have Room to Hide Things. Text Doesn’t.

Let me start with why image watermarking feels so intuitive, before getting into the much harder case of text.

A digital image is an array of numbers across millions of pixels. And the human eye simply cannot detect tiny differences among these numbers, no matter how closely it looks. Whether a given pixel’s red value is 137 or 138, we can’t tell the difference. The same goes for audio. There are frequency bands the human ear barely picks up, and quiet sounds get buried right after loud ones.

That dullness of perception is exactly the margin — empty space where information can ride along unnoticed, invisible to anyone who isn’t specifically looking for it. SynthID-style image watermarks plant a signal right in that margin. Put the original and the watermarked version side by side, and a person can’t spot the difference, but a dedicated detector can read the faint pattern hidden underneath. You can even stamp it onto an image after the fact, once it’s already been made.

Text has no such margin.

A sentence isn’t an array of pixels — it’s a sequence of tokens¹. And every single token carries meaning, so there’s rarely a way to nudge one without the reader noticing something changed. Nudge one character in “The weather is nice today” and you either get a typo or change the meaning outright. A harmless micro-adjustment like turning 137 into 138 is, in principle, impossible here. There is a trick of inserting invisible Unicode characters, but that’s less a watermark than just a hidden character. Copy the text into a different editor and it mostly disappears, and it’s trivially easy to find and delete anyway.

So text watermarking had to take a completely different approach — not planting a signal into a finished piece of writing, but intervening directly in the process of writing itself, at the very moment each word gets chosen.

So they changed how words get picked

This is the heart of today’s issue.

A language model doesn’t write text all at once; instead, it works token by token, building the sentence piece by piece as it goes. At every step, it computes a probability distribution over the entire vocabulary (usually more than 100,000 entries) and draws one from it. And here’s the crucial fact: at most positions, there isn’t a single correct answer.

Take a sentence like “The cause of this problem isn’t technology but ___.” Whether you fill in “system,” “structure,” “design,” or “practice,” the sentence holds up fine. Swap “so” for “therefore,” or “at this point” for “on this note,” and the reader won’t notice a difference. This slack where any choice works just as well exists at nearly every token. In information theory, this kind of freedom is called entropy², and it turns out to be exactly what makes watermarking possible in the first place.

Text watermarking uses this slack as a communication channel. Instead of the margins of a pixel, it uses the margins of choice.

Google DeepMind’s SynthID-Text paper, published in Nature in October 2024, shows this structure most clearly. Here’s how it works.

Previous token + secret key → hash → random seed → scoring functions g1 · g2 · g3
8 candidates	system	structure	design	practice	method	framework	mold	principle

Round with g1	structure		design		method		principle

Round with g2	design				principle

Round with g3	design
The orange cell is the token that actually gets output. The paper's default setting uses 30 layers; here it's reduced to 3 for illustration.

First, the secret key and the last few tokens are fed together through a hash function to generate a random seed unique to that particular position in the text. That seed is used to generate several scoring functions, each of which sprinkles a 0 or 1 across every token in the vocabulary. Then several candidate tokens are drawn from the model’s original probability distribution and put through a tournament. They’re paired up, the one with the higher score from a scoring function advances, the next layer pits survivors against each other with a different scoring function, and whoever survives to the end becomes the actual output. The paper’s default setting is 30 layers.

fingerprint

Here’s the key point, and it’s worth sitting with for a moment. Because the candidates were drawn from the model’s real probability distribution in the first place, the quality of the output stays almost exactly the same. But to someone who knows the key, something strange is happening: the output tokens are consistently clustered on the high-scoring side of the scorecard that key generates.

This is precisely what makes detection so simple compared to other approaches. You need neither the model nor the original text. You rerun the scoring functions with the same key over the observed text, take the average score, and calculate “the probability that human-written text would land at this level by chance.” It’s a statistical test. Human-written text lands right around chance level; watermarked text stands out statistically.

The cost is negligible, too, which matters enormously for anything meant to run at real scale. The same paper measured the latency increase from tournament sampling at 0.57%. That’s the reason this method could actually be deployed in a live service. Google did, in fact, build it into Gemini.

Whether Anthropic uses exactly this method is still unknown — the company hasn’t disclosed its implementation details. But the four things it has said — “it’s woven into the text itself,” “it survives copy-paste,” “it withstands some editing,” “there’s no quality impact” — line up precisely with the signature traits of this family of techniques. The prototype for this family is the green-list/red-list method proposed by Kirchenbauer’s research team in 2023, and tournament sampling is its refined successor.

The limitations all come from the same principle

Once you understand this structure, the entire list of limitations in Anthropic’s documentation collapses into a single explanation. These aren’t disclaimers the company tacked on out of caution — they’re consequences that follow necessarily from the underlying principle, whether the company wanted them or not.

Why it survives copy-paste: the mark isn’t a file property, it’s the word choices themselves. Move the text, and the mark moves right along with it. There’s no metadata layer to strip away in the first place.

Why it tolerates partial editing: the signal is spread thin across hundreds of choices. Rewrite a few sentences and the statistic drops — it doesn’t hit zero.

Why it fails on short text: same reason. This is a statistical test, and statistical tests need a sample large enough to be meaningful. In SynthID-Text’s own measurements, at a length of 50 tokens and a 1% false-positive rate, detection success falls to around 0.3. A piece of writing that’s only ten sentences or so is genuinely hard to call.

Why it collapses under paraphrasing³ and translation is especially interesting. When a person or another model rewrites the sentences, the token choices get redrawn through a process that has nothing to do with the original key. The signal isn’t erased — it’s overwritten.

There’s one more limitation that isn’t spelled out in the documentation. I think it’s the most important one. The amount of information a watermark can carry is bound to the entropy of generation. When there’s only one option available, there’s nothing to plant. If all the candidates are identical, there’s no reason to hold a tournament at all.

That’s why the mark barely attaches to text where the answer is nearly fixed — short code snippets, formatted table output, quotations, computed results. It’s paradoxical: the technology works weakest exactly where the fight over AI authorship burns hottest.

Korea Already Had a Disclosure Mandate Starting in January

Let me turn the lens homeward for a moment. If you read this announcement purely as a European regulatory story, you’re missing at least half of it.

Korea’s Basic Act on the Development of Artificial Intelligence and Establishment of Trust (“AI Basic Act”) and its enforcement decree took effect on January 22, 2026. Article 31 requires generative AI providers to disclose that their outputs were AI-generated. There are two branches here. For ordinary outputs, providers can choose between a human-perceptible label or a machine-readable method like watermarking or metadata; for deepfakes, only a clearly human-visible label is permitted. Text outputs are covered too.

Two problems emerged. First, the obligation falls not on individual users but on AI providers. Second, even if a provider wanted to choose the machine-readable route, there was essentially no usable standard technology available. So the government built in a grace period of at least one year, and the maximum fine of ₩30,000,000 has effectively been pushed back to 2027 or later.

Anthropic’s move lands right in that gap. A watermark applied at the model level means that for Korean businesses building products on top of Claude, a machine-readable label now comes bundled in by default. The “no standard exists” excuse just got noticeably weaker.

But here’s where things get uncomfortable. What Korean law requires is disclosure of “the fact that AI created this,” and this watermark doesn’t quite say that. As the company itself acknowledged, the mark appears even when Claude isn’t the original author. Text that’s been proofread, translated, summarized, or reformatted all comes out labeled “processed by Claude.” Compare this to Europe’s guidelines, which exempt simple assistive functions like grammar correction from disclosure requirements — here, the technology is labeling more broadly than the law demands.

In other words, this mark isn’t proof of authorship — it’s a trace of contact between AI and user. The moment we treat these two things as the same, the misunderstandings begin.

Oz’s Lens

What held my attention longer than the technology itself was a different question, and one I kept returning to: who holds the detection key.

This watermark can’t be read without a key. But if you make the key public, anyone can reverse-engineer it to strip the watermark — once you know which tokens score high, you just swap those tokens out. Keep it private, though, and the authority to judge “did AI write this” concentrates in the hands of a single model company.

The EU Code of Practice requires that third parties be able to detect watermarks, but the two requirements clash in principle. The realistic fix would be a detection service the company itself runs — which means anyone seeking a verdict has to send the text in question to that company’s servers. A recruiter would need to upload a candidate’s cover letter; a school would need to upload a student’s assignment, just to get a reading. A mechanism built for transparency ends up creating a brand-new center of data concentration.

There’s a pattern I kept running into while building GTM strategy. When companies evaluate AI tools, they start with a performance comparison chart — but what actually breaks a deal is almost always something that chart doesn’t cover. This case has the same shape. If you’re building a document-processing product on the Claude API, you need to account for the line item where a customer feeds in their own manuscript and gets back an output carrying a detectable signal. That’s a matter for your terms of service and disclosure language, and it’s worth getting ahead of.

Still, I’d take a hard-nosed view of how effective this actually is. Anyone who wants to strip the mark just needs one rewrite pass, or simply switches to a model that doesn’t watermark at all. In the end, the mark only sticks to those who play by the rules. So I don’t see this measure as a device for catching bad actors — I see it as infrastructure that quietly adds a layer of provenance onto ordinary, everyday content.

Closing

Let me sum it up.

First, images have margins that people can’t perceive, so signals can be hidden there — but text has no such margin. That’s why text watermarking doesn’t attach a mark to the writing; instead, it twists the way words get chosen, one token at a time.

Second, every characteristic follows from this principle. It survives copy-paste, doesn’t attach to short passages or texts with a single correct answer, and disappears when rewritten.

Third, the real problem that remains isn’t technical — it’s where the authority to detect sits. Make the key public, and the mark gets stripped out; keep it hidden, and the power to judge concentrates in one place. For now, Claude has said it will leave this record in the clipboard and metadata.

What you can try right away is surprisingly simple. Write down, in one line, the text that currently flows out of your organization through AI. Press releases, product detail pages, customer-response copy, draft contracts. Sort those into “things that wouldn’t be a problem even with an ‘AI-processed’ mark attached” and everything else, and you’ll get a rough outline of the policy you’ll eventually need to sort out.

Are you currently drafting or polishing documents with AI and sending them out externally? If an “AI-processed” mark were attached to that output, which document would cause you the most trouble? Tell me in the comments. Once enough cases come in, I’ll sketch out a risk map of marking by document type in the next issue.

💬 Tell me in the comments which document would be the most troublesome if a mark were attached. I’ll factor it into the next issue. 📨 If you have colleagues in content, legal, or engineering, please pass this piece along to them.

References & Further Reading

Primary sources

Anthropic, “How Claude marks AI-generated content,” Claude Help Center, August 10, 2026. View document ··· This is where today’s piece starts. It’s short, so I’d recommend reading the original. The “Limitations” section in particular shows what the company isn’t promising.
Sumanth Dathathri et al., “Scalable watermarking for identifying large language model outputs,” Nature, Vol. 634, October 24, 2024, pp. 818–823. View paper ··· This is the basis for today’s explanation of the mechanism. Just Figure 2’s tournament diagram alone is enough to grasp the principle. Note that several secondary sources cite this paper as Vol. 631, p. 755 — that’s actually the bibliographic info for a different paper.
John Kirchenbauer et al., “A Watermark for Large Language Models,” ICML, 2023. View paper ··· This is the prototype of this whole line of work. Its green-list/red-list scheme is the simplest form, which actually makes it easier to grasp the concept.
“Framework Act on the Development of Artificial Intelligence and the Establishment of Trust, etc.,” Article 31 and its Enforcement Decree, effective January 22, 2026. View statute ··· This is the legal basis for Korea’s domestic disclosure requirement. The key point is how the disclosure methods diverge between deepfakes and general AI outputs.
European Commission, “Transparency obligations under Article 50 of the AI Act,” 2026. View official FAQ ··· You can confirm, from a primary source, when Article 50 takes effect (August 2, 2026) and where the code of practice stands.

Background

Coalition for Content Provenance and Authenticity, C2PA Specification. View spec ··· This is the standard for file-side markers. Just skimming how the signature structure is built shows you why “just strip it off” works.
Nikola Jovanović, Robin Staab, Martin Vechev, “Watermark Stealing in Large Language Models,” ICML, 2024. View paper ··· This covers attacks that reverse-engineer a watermark to remove or forge it. If you want to dig into today’s “detection key” problem at a technical level, start here.

📝 Glossary

The author, Kwangseob Ahn, is a professor of business administration at Sejong University and lead consultant at OBF (Oswarld Boutique Consulting Firm). He teaches statistics and data analysis, including business data management and business analytics, while leading GTM and AI strategy consulting in the field, designing the seam between technology and business. He has published academic research on a memory architecture for AI dialogue systems (HEMA) and runs Daily Arxiv, a daily curation of global AI papers. He holds a master's from Korea University's Graduate School of Technology Management and a KMBA. He is the author of Homo Brainless: The People Who Outsource Their Thinking.

Footnotes

Token: The smallest unit a language model uses to handle text. It can be a whole word or just a fragment of one. Rather than writing a sentence all at once, the model generates text by stringing these tokens together one by one. ↩
Entropy: A measure of how many options could plausibly come next at a given position. If there are many candidate words for what comes next, entropy is high; if the next word is essentially fixed, entropy is low. A watermark can only hide in spots where entropy is high. ↩
Paraphrase: Rewriting something in different words while keeping the meaning intact. This covers both a human manually rewriting text and running it through another AI. ↩