Why an AI watermark can convict your content but never clear it

Anthropic now embeds an invisible, machine-readable watermark in text generated by Claude, and a chunk of the SEO feed read that as the end of AI-assisted content. The cleanest way to see why it is not is that Google has been doing the same thing to Gemini's text since May 2024 and has shipped no text-provenance ranking signal in the 27 months since.⁴ What the mark can prove is far narrower than the reaction assumes, and it is lopsided in a way that inverts how most teams currently use AI detectors.

A watermark hit is strong evidence that content is machine-made. A watermark miss is nearly worthless as evidence that it is human.

What did Anthropic actually announce?

Anthropic committed to marking Claude’s output two different ways, one for text and one for files. The file half is much further along. Its support documentation describes an “imperceptible watermark directly into the text itself” that travels with the text when it is copied and pasted, plus signed C2PA metadata on generated .png, .jpg, and .svg files. C2PA is the Coalition for Content Provenance and Authenticity, whose standard writes a cryptographically signed record of where a file came from into the file itself.¹ Coverage is worldwide rather than EU-only, spanning the Claude apps, the API, Claude Code, Claude Cowork, Claude Tag, and Claude accessed through AWS, Google Cloud, and Microsoft Foundry.¹

Driving all of this is Article 50(2) of the EU AI Act, which requires providers of generative systems to mark synthetic output in a machine-readable format and which became enforceable on August 2, 2026.¹⁵ Anthropic signed the Commission’s Code of Practice on Transparency of AI-Generated Content, the instrument built to operationalize that obligation.¹

Scale is the part the coverage missed. Roughly 190 organizations signed the Code of Practice by the end of July 2026. Section 1, the provider marking duty, drew 82 of them, and section 2, the deployer labeling duty, drew 152. Those two counts overlap rather than sum, because an organization that both builds and deploys generative systems signs both.² Reading this as one lab moving unilaterally gets the story backwards. An entire industry filed the same paperwork on the same deadline, and one company’s help-center update happened to get picked up.

How does a watermark hide in text that reads completely normally?

The watermark lives in the sampling layer rather than in phrasing, which is why no amount of reading will reveal it. Google DeepMind’s SynthID-Text is the only production text watermark described in a peer-reviewed venue, so it serves as the reference point for what Anthropic is likely doing. Anthropic has not disclosed its own scheme.

A language model picks one token at a time from a probability distribution over candidates. SynthID-Text leaves that distribution alone. It changes only which candidate wins, through what the authors call a tournament among the sampled candidates. Each candidate gets a score from a random seed, and that seed comes from hashing the last four words together with a secret watermarking key.³ The paper states plainly that the method “does not affect LLM training and modifies only the sampling procedure.”³ Anyone holding the key can recompute those scores and measure a statistical skew across the passage. A reader holding no key sees ordinary prose, because at the level of any single word nothing unusual happened.

Think of a shuffled deck. It looks random to everyone in the room, and it stays random-looking right up until someone reveals they know the shuffle order, at which point every card was always predictable to them. That comparison breaks in one important way, though. A deck order is exact and a watermark is statistical, so the detector is running a probability test over hundreds of tokens rather than checking a fixed sequence, and short passages simply do not carry enough cards to call.

Quality survives the process, and the evidence is unusually strong for a claim of that kind. DeepMind ran roughly 20 million watermarked and unwatermarked Gemini responses side by side, comparing user feedback. The thumbs-up rate differed by 0.01%, the thumbs-down rate by 0.02%.³ A live production A/B test at that scale is rare in published work, and it settles the question of whether watermarking degrades the model.

Is Google going to start penalizing watermarked content?

Nothing on the record supports Google penalizing watermarked content, and the strongest evidence is 27 months of it holding the key to Gemini’s text watermark while shipping no ranking signal that reads the mark. Google announced SynthID text watermarking for the Gemini app on May 14, 2024.⁴ For a text-provenance ranking signal, that is a long runway to have shipped nothing on.

Google’s published guidance has not moved either. Its answer to “Will AI content rank highly on Search?” still reads, verbatim, “Using AI doesn’t give content any special gains. It’s just content. If it is useful, helpful, original, and satisfies aspects of E-E-A-T, it might do well in Search. If it doesn’t, it might not.”⁹ The same page says appropriate use of AI is not against its guidelines, and names the actual target as content produced primarily to manipulate rankings.⁹

Watch where the provenance investment goes instead, because the pattern holds across every company. At I/O on May 19, 2026, Google extended SynthID verification into Search and Chrome and added C2PA Content Credentials checking, and every modality it named was image, video, or audio.⁵ Text appears nowhere in that announcement. The same lopsidedness shows in the SynthID Detector portal, which launched in May 2025 and still runs on a waitlist for journalists, media professionals, and researchers.⁶

OpenAI makes it starker. It joined the C2PA steering committee, had its own output certified against that standard, and now embeds SynthID watermarking in images and, since July 31, 2026, in audio.⁷ Text is absent from that work entirely. OpenAI built a text watermarker reported at 99.9% reliability by the Wall Street Journal and has sat on it for two years. The reporting names a concrete commercial reason, which is that an internal survey found 30% of users said they would use ChatGPT less if watermarking shipped.⁸

That leaves the largest single source of AI text on the web carrying no text watermark at all, by deliberate choice. Any detection regime built on text watermarking has a hole in it the exact shape of ChatGPT.

Why does a clean detector result mean almost nothing?

A keyed watermark detector tests text against a secret key, where a heuristic AI detector guesses from style. That difference flips the error profile you get, so the keyed one comes out extremely precise and badly incomplete at the same time. Knowing which of those two failure modes you are exposed to decides whether the tool is any use to you.

Precision comes first. Because the detector runs a statistical test against a secret key rather than guessing from style, its false positive rate is a tunable parameter that can be set arbitrarily low. Flagging human text as watermarked would require that text to accidentally match a keyed pattern, which is rare and quantifiable. So when a watermark detector says yes, it is usually right.

Recall is where it falls apart, and the damage compounds multiplicatively. Call it provenance recall, the share of genuinely AI-generated content a check will actually catch, which is coverage times survival times detector sensitivity.

Term	What it measures	Why it runs below 1
Coverage	Share of the AI text that came from a provider marking at all	ChatGPT does not watermark text; open-weight models run unmarked on anyone’s hardware
Survival	Share of marked text whose mark outlasts normal handling	Editing, paraphrasing, translation, and truncation all degrade it
Sensitivity	Detector true positive rate on an intact mark	The only term anyone quotes, and the only one close to 1

Multiply three fractions and the result gets small fast. Take an agency auditing a client blog under generous assumptions, where 35% of the AI text came from a marking provider, half the marks survive the editing pass, and the detector is 95% sensitive on what remains. Provenance recall lands near 17%. The detector finds roughly one in six, and a clean bill of health sits comfortably alongside the other five still on the page.

Those first two numbers are my assumptions rather than measurements, which is exactly why I built an AI watermark detection rate calculator instead of publishing a single figure. Change coverage and survival to match your own stack and watch the answer move.

How much editing does it take to break the mark?

Because the mark is statistical rather than exact, it degrades under editing instead of breaking cleanly. The published numbers on how little editing that takes are specific. Sadasivan and colleagues stress-tested watermark detection under a recursive paraphrase attack on 300-token passages, reporting detection falling from 99.3% to 9.7% as measured by true positive rate at a 1% false positive rate.¹¹ One paraphrase pass, not recursive, took the same detector from 99.8% to 80.7%.¹¹ The same work found detection weakens as passages get shorter, while the paraphrasing degraded text quality only slightly.¹¹

One scoping note matters for accuracy. That attack targeted a different watermarking family, the green-list schemes, which secretly divide the vocabulary into favoured and unfavoured words and then push the model toward the favoured half. SynthID-Text does not work that way, so the exact percentages do not transfer to Google’s or Anthropic’s schemes. What transfers is the direction, which DeepMind concedes in its own limitations section: generative watermarks “are weakened by edits to the text, such as through LLM paraphrasing.”³ The paper also reports weaker detection when the model’s output carries less entropy, meaning short, factual, highly constrained text holds a fainter signal than discursive prose.³

Attacks run the other direction too. Jovanovic, Staab, and Vechev showed that querying a watermarked model’s API can approximately reverse-engineer the watermark, and that for under $50 an attacker reached over 80% average success at both scrubbing marks out and forging them into human-written text.¹² DeepMind lists that same vulnerability class among its own open problems and concludes that generative watermarks “do not offer a complete solution to artificial-intelligence text detection.”³

Call the whole pattern provenance decay. The mark degrades through ordinary handling rather than deliberate evasion, and that is what makes its absence uninformative. Your editor rewriting an intro is attacking nothing. Provenance decay happens anyway.

Is your image pipeline destroying the credential?

Text watermarking got the attention this month. Your image pipeline is the half of this story with a checkable answer today, and it is very likely destroying the credential right now. Text watermarking took the attention, while the file half is already load-bearing, already visible to readers, and already breakable by your own build. So I measured it.

C2PA credentials do not float alongside an image. They live in a specific labelled box inside the file, and the box has a different name in each format. A JPEG keeps it in a segment called APP11, a PNG keeps it in a chunk called caBX, and the box itself follows a layout called JUMBF. Drop that container and the credential is gone, with no amount of correct stamping upstream able to recover it. OpenAI says as much in its own provenance post, warning that metadata “can be stripped, lost through uploads and downloads, or broken by transformations like file format changes, resizing, or screenshots.”⁷

So I built a JPEG and a PNG carrying correctly-structured provenance containers, ran them through the transforms a normal publishing pipeline applies, and checked whether the container survived. The engine was sharp 0.35.2, the resize library underneath Astro’s image component, Next.js image optimization, and a large share of Node CMS pipelines. Test date August 11, 2026.

Format	Transform	Provenance container
JPEG	Source file, before any processing	Present
PNG	Source file, before any processing	Present
JPEG	Resize to 1200px wide, default settings	Destroyed
PNG	Resize to 1200px wide, default settings	Destroyed
JPEG	Resize to 1200px wide, with .withMetadata()	Destroyed
PNG	Resize to 1200px wide, with .withMetadata()	Destroyed
JPEG to WebP	Convert, default settings	Destroyed
JPEG to WebP	Convert, with .withMetadata()	Destroyed
JPEG to AVIF	Convert, with .withMetadata()	Destroyed
JPEG	Re-save, no resize at all	Destroyed

Eight of eight transforms destroyed the provenance container, including a plain re-save that changed no pixels. The two .withMetadata() resize rows are the result that surprised me, because that flag is the documented way to preserve image metadata and it is what a careful developer reaches for. It does not preserve the provenance container.

That claim needed a control, since “the flag does nothing” would be a far less interesting finding, so I ran identical transforms on a file carrying ordinary EXIF instead. EXIF was stripped by default and correctly preserved by .withMetadata(), exactly as documented. The flag works. It simply does not cover the container the EU AI Act cares about, and one variable changed between the two runs, which isolates the cause to the container type.

There is a fix, and its default setting is the important part. Cloudflare became the first major CDN to preserve Content Credentials through transformation in February 2025, and its own post describes the prior state plainly, noting that credentials “would frequently be stripped if the image was transformed by their CDN.”¹³ The setting is opt-in, enabled per zone in the dashboard, and the documentation is blunt about the alternative. “When this setting is disabled, any existing Content Credentials will always be discarded.”¹⁴

LinkedIn reads C2PA manifests and shows a Content Credentials marker on images carrying one, so this is a visible, reader-facing outcome rather than a hypothetical. Destroy the manifest in your build and that label never appears, which means you have quietly stripped a disclosure the regulation was written to preserve.

What were the third-party AI detectors ever worth?

Detector scores were unreliable long before watermarking existed, and the most credible admission of that came from OpenAI. It launched an AI Text Classifier in January 2023, retired it that July for a “low rate of accuracy,” and published the numbers itself. The classifier caught 26% of AI-written text and misflagged human writing as AI 9% of the time.¹⁰

Watermarking rescues none of those tools, because they are not watermark detectors. They cannot read Google’s key or Anthropic’s, so they are still doing stylometry, still guessing from surface features like the reflexive phrasing tics that give machine prose away, and the provenance layer passes straight over them. Hours spent optimizing a draft against a third-party AI-detector score go toward a metric no search engine has claimed to use, produced by a method its own inventor withdrew.

Google does have a position on disclosure, and it is worth reading before treating the topic as radioactive. Its guidance says AI disclosures “are useful for content where someone might think ‘How was this created?’” and advises adding them where reasonably expected.⁹ Specific, honest disclosure is endorsed.

What should you actually do this week?

Only one item on this list has a definite answer today, and it is the one you can run yourself in about five minutes. Everything after it is about not over-trusting a clean scan.

1. Check whether your image pipeline preserves Content Credentials. This is the only item with a definite result today. Run a signed image through your build and inspect the output for the JUMBF container. On Cloudflare Images, the preservation setting is opt-in and stays off until you turn it on.¹⁴
2. Stop optimizing against third-party AI-detector scores. The tool that invented the category was withdrawn at 26% accuracy,¹⁰ no engine has claimed to use such a score, and none of these tools can read a real watermark key regardless.
3. Never treat a clean scan as clearance. Provenance recall is the product of three fractions, so a miss is the expected outcome even for content that is entirely machine-written.
4. Keep your Article 50 work on the deployer duties. The machine mark is your vendor’s job. The human-facing disclosure for deepfakes and public-interest text is yours, and nothing in this week’s news changes it.¹⁵
5. Revisit when a detector actually ships. Anthropic has promised detection documentation,¹ and Google runs a waitlisted portal plus a Cloud detection API.⁵ The day a public text detector exists with real coverage is the day this analysis needs redoing.

The provenance layer is genuinely being built, and it is being built properly. It is simply being built on the media side first, where the marks are visible, the readers are the audience, and the failure mode is your own CDN. Text watermarking will matter eventually. For now it is a signature on a compliance document that 82 companies filed the same week, and the most useful thing you can do about it is go check what your resize step is doing to your images.