You need to sign your content. Anthropic already marks everything Claude generates and you still don't

Originally published at carlosortet.com. Republished here with canonical. It matters more than ever, and it is more urgent than ever, to be able to prove that a model has read and used our content. There is an opportunity window to mark your content and this is before a model uses it. On 10 July I published an article here about the idea of hiding an impossible date inside a text so you could prove, later, that an AI had trained on it. Thirty two days later, on 11 August 2026, Anthropic confirmed that all the text Claude generates comes out marked with a similar kind of watermark. I read it as a win for the whole idea of watermarking LLMs but instead of us marking what the AI swallows, it is the AI marking first what it creates itself. Not ideal but it is still a step ahead. It means the people who understand these models best have just shown the technique works. What is missing is applying it on the other side. Which is not easy and it is not solved yet. What you need to know - Anthropic marks Claude text across all its products and worldwide, not just in the European Union. Models launched from 2 August 2026 ship with marking built in. - The mark proves that Claude may have processed that text. It does not prove Claude wrote it, or that whoever published it used AI. Anthropic says so itself. - The most repeated objection, that marking degrades the output, has had an answer since 2023: there are schemes with no such conflict. The real limit is set by entropy (a parameter I have written about before, and it keeps coming back). - What the industry solved in 2026 is marking what comes out of a model. What it has not solved is proving what went in. That is where we come in. - Both halves have weak points. Work presented at EACL 2026 already forges another model's mark (a disaster). Another paper from 2025 strips watermarks with a 99% success rate and no access to the model (checkmate). - A small correction to my July article: I wrote that a mark appearing only once is undetectable. An ICML 2025 paper shows otherwise, if you act before publishing. What Anthropic has actually done Sticking to the facts is the only way to understand the situation and the futures it opens. Anthropic signed the Code of Practice on Transparency of AI-Generated Content, the instrument that develops article 50(2) of the European AI Regulation. The Commission found it adequate on 8 July 2026 and the AI Board on 9 July. The obligations apply from 2 August. From there, Anthropic takes three key decisions. The first: models launched from 2 August 2026 mark every text they generate, and earlier ones will follow with no announced date. The second: the mark sits at model level and applies worldwide, not only in Europe. The third: the watermark applies to absolutely every surface. The Claude apps, the API, Claude Code, Cowork, Tag, and also when the model runs inside AWS Bedrock, Google Cloud or Microsoft Foundry. There is no door that lets you get clean content out, and no way to switch it off has been documented. On the mechanism used as the mark, Anthropic has been shy. It says the mark "is part of the text", that it travels with it when copied and pasted, and that it "may persist through some editing". For the files it generates in .svg, .png and .jpg it attaches signed metadata using the open C2PA standard (which we already explained in the 10 July article). It has announced technical documentation and detection tools, but as of 12 August 2026 it has not published them. TechCrunch asked how much editing it takes to remove the mark and got no answer (in the previous blog post we explained this phenomenon and its limits). What we do know is what kind of mark it uses, because it is the only one that fits "part of the text" and survives copy and paste: the token choice is steered at generation time, with a secret key. Within that territory, though, there are two very different families, and the difference between them is exactly what watermarking experts have argued about most since this system was announced. The first is the green list I explained in the July article (Kirchenbauer et al., ICML 2023): the key splits the vocabulary at each step and a nudge is added to the logits of the green tokens. It works, and it has a cost: it touches the system's probability distribution, so it raises the perplexity of the text. We do not love that, though it will not be visible to most users. The second family of watermarks does the same without touching the distribution. These are the schemes called distortion free: Scott Aaronson's at OpenAI, based on the Gumbel-Softmax rule, and Christ, Gunn and Zamir's, who prove that without the key nobody can tell marked text from ordinary text. It is also how DeepMind's SynthID-Text works. Which of the two Anthropic uses, they have not clarified. But they claim the mark does not change the quality or readability of the response, and that property is only proven in the second family. So either they are in the distortion free family, or their claim is empirical and carries no rigour. My inclination is that they use a distortion free system. This news inside the wider AI picture: Google signed the same code on 24 July 2026 and pulled Apple, NVIDIA, ElevenLabs, Kakao and OpenAI into adopting SynthID. OpenAI has applied marking and C2PA to its images since 19 May 2026 and to its audio, but not to its text. That makes Anthropic the first to mark text at this scale. The others will follow. When are we going to mark our own content? Is that technology of watermarking persistent at the source not just as important for the industry and for society, if not more? That is exactly why at 498 Advance we have spent almost a year working on this, and now with more conviction than ever. The market keeps promising solutions with no scientific basis that, predictably, do not work. I am excited that the line of work has been validated, that what we built will be useful and that we can carry on. What we were seeing in the market left us puzzled, and the promises from other teams did not square with the scientific evidence we know. What follows is anecdotal, but it is worth telling. Within days, tools appeared promising to strip Claude's watermark. The analysis of those tools concludes that they do delete things, but not the mark: what they clean up are invisible characters, zero width spaces and the like. In the July article I spent a whole section explaining why invisible ink is a bad hiding place, specifically with this line: an invisible character gets deleted by the system without thinking, with no need to understand the context; a date that cannot exist would only be deleted by someone who understands what they are reading. The market disagreed and built products on that error in under a week. Companies and users paid for the licences. Nobody bothered to research it or to ask the scientists whether that solution had any foundation. I tell it because the anecdote explains why this subject is so slippery even for technical people: everyone's intuition points down the wrong path. All the knowledge built over decades of scientific research has enormous value, and we can and should use it to move forward. The quality argument, answered in 2023 Of everything said since 11 August, the objection that comes up most is that marking has to make the output worse. You cannot optimise for the best answer and for carrying a mark at the same time, the argument goes, and least of all when what you generate is code. Anthropic's claim that quality is unaffected has taken a beating. The question already has an answer, and it is three years old. In August 2023 Scott Aaronson gave a talk at the Simons Institute about the scheme he was working on at OpenAI, and closed with this: people seemed to have an intuition that there would inevitably be a trade off between watermarking and output quality, and in fact there is none. In his scheme the token choice is made so that it looks exactly like ordinary sampling to anybody without the key. The text does not get worse because, statistically, and for the human eye, it is the same text. So the community intuition is right for the green list family and wrong for the other one. And that has a practical consequence I find quite interesting: if Anthropic were degrading quality, somebody would measure it and the debate would be over, nothing would be more fun than that. That nobody has published such a measurement suggests, again, that they are in the second. There is a real limit, though, and it is entropy. Aaronson quantified it: the number of tokens you need to see the mark grows as the inverse square of the average entropy per token. If the model had little room to choose (low entropy), there is little mark to plant. Ask it for the first hundred prime numbers and the entropy is zero, so there is no way to mark anything, though it hardly matters who gets credit for that list. Because a text with no entropy means there has been no generalisation, it is probably uncontestable data, with no original thought or narrative (that is my intuition, I have not studied it properly). A few hundred tokens is usually enough, and with a few thousand the confidence is very high. So the complaint that the mark makes code worse has no basis: it simply marks it weakly, because in the stretches where there is only one reasonable way to write something the model had nowhere to hide the signal. It is the same reason the mark is unreliable on short passages. In any other scenario the mark will work very well and does not degrade quality at all. The easy half is solved. But, like everything, it has weak points. Marking a model's output is the easy problem. The provider controls the moment of generation, controls the key and controls the detector. That is why it got solved first, and why the regulation was able to mandate it from the moment it applied. That it is solved does not mean it is robust, though, and this is where the 2025 and 20