Originally published at carlosortet.com. Republished here with canonical.
It matters more than ever, and it is more urgent than ever, to be able to prove that a model has read and used our content. There is an opportunity window to mark your content and this is before a model uses it.
On 10 July I published an article here about the idea of hiding an impossible date inside a text so you could prove, later, that an AI had trained on it. Thirty two days later, on 11 August 2026, Anthropic confirmed that all the text Claude generates comes out marked with a similar kind of watermark.
I read it as a win for the whole idea of watermarking LLMs but instead of us marking what the AI swallows, it is the AI marking first what it creates itself. Not ideal but it is still a step ahead. It means the people who understand these models best have just shown the technique works. What is missing is applying it on the other side. Which is not easy and it is not solved yet.
What you need to know
- Anthropic marks Claude text across all its products and worldwide, not just in the European Union. Models launched from 2 August 2026 ship with marking built in.
- The mark proves that Claude may have processed that text. It does not prove Claude wrote it, or that whoever published it used AI. Anthropic says so itself.
- The most repeated objection, that marking degrades the output, has had an answer since 2023: there are schemes with no such conflict. The real limit is set by entropy (a parameter I have written about before, and it keeps coming back).
- What the industry solved in 2026 is marking what comes out of a model. What it has not solved is proving what went in. That is where we come in.
- Both halves have weak points. Work presented at EACL 2026 already forges another model's mark (a disaster). Another paper from 2025 strips watermarks with a 99% success rate and no access to the model (checkmate).
- A small correction to my July article: I wrote that a mark appearing only once is undetectable. An ICML 2025 paper shows otherwise, if you act before publishing.
What Anthropic has actually done
Sticking to the facts is the only way to understand the situation and the futures it opens.
Anthropic signed the Code of Practice on Transparency of AI-Generated Content, the instrument that develops article 50(2) of the European AI Regulation. The Commission found it adequate on 8 July 2026 and the AI Board on 9 July. The obligations apply from 2 August.
From there, Anthropic takes three key decisions.
The first: models launched from 2 August 2026 mark every text they generate, and earlier ones will follow with no announced date.
The second: the mark sits at model level and applies worldwide, not only in Europe.
The third: the watermark applies to absolutely every surface. The Claude apps, the API, Claude Code, Cowork, Tag, and also when the model runs inside AWS Bedrock, Google Cloud or Microsoft Foundry. There is no door that lets you get clean content out, and no way to switch it off has been documented.
On the mechanism used as the mark, Anthropic has been shy. It says the mark "is part of the text", that it travels with it when copied and pasted, and that it "may persist through some editing". For the files it generates in .svg, .png and .jpg it attaches signed metadata using the open C2PA standard (which we already explained in the 10 July article).
It has announced technical documentation and detection tools, but as of 12 August 2026 it has not published them. TechCrunch asked how much editing it takes to remove the mark and got no answer (in the previous blog post we explained this phenomenon and its limits).
What we do know is what kind of mark it uses, because it is the only one that fits "part of the text" and survives copy and paste: the token choice is steered at generation time, with a secret key. Within that territory, though, there are two very different families, and the difference between them is exactly what watermarking experts have argued about most since this system was announced.
The first is the green list I explained in the July article (Kirchenbauer et al., ICML 2023): the key splits the vocabulary at each step and a nudge is added to the logits of the green tokens. It works, and it has a cost: it touches the system's probability distribution, so it raises the perplexity of the text. We do not love that, though it will not be visible to most users.
The second family of watermarks does the same without touching the distribution. These are the schemes called distortion free: Scott Aaronson's at OpenAI, based on the Gumbel-Softmax rule, and Christ, Gunn and Zamir's, who prove that without the key nobody can tell marked text from ordinary text. It is also how DeepMind's SynthID-Text works.
Which of the two Anthropic uses, they have not clarified. But they claim the mark does not change the quality or readability of the response, and that property is only proven in the second family. So either they are in the distortion free family, or their claim is empirical and carries no rigour. My inclination is that they use a distortion free system.
This news inside the wider AI picture: Google signed the same code on 24 July 2026 and pulled Apple, NVIDIA, ElevenLabs, Kakao and OpenAI into adopting SynthID.
OpenAI has applied marking and C2PA to its images since 19 May 2026 and to its audio, but not to its text. That makes Anthropic the first to mark text at this scale. The others will follow.
When are we going to mark our own content? Is that technology of watermarking persistent at the source not just as important for the industry and for society, if not more? That is exactly why at 498 Advance we have spent almost a year working on this, and now with more conviction than ever.
The market keeps promising solutions with no scientific basis that, predictably, do not work.
I am excited that the line of work has been validated, that what we built will be useful and that we can carry on. What we were seeing in the market left us puzzled, and the promises from other teams did not square with the scientific evidence we know. What follows is anecdotal, but it is worth telling.
Within days, tools appeared promising to strip Claude's watermark. The analysis of those tools concludes that they do delete things, but not the mark: what they clean up are invisible characters, zero width spaces and the like.
In the July article I spent a whole section explaining why invisible ink is a bad hiding place, specifically with this line: an invisible character gets deleted by the system without thinking, with no need to understand the context; a date that cannot exist would only be deleted by someone who understands what they are reading. The market disagreed and built products on that error in under a week. Companies and users paid for the licences. Nobody bothered to research it or to ask the scientists whether that solution had any foundation.
I tell it because the anecdote explains why this subject is so slippery even for technical people: everyone's intuition points down the wrong path. All the knowledge built over decades of scientific research has enormous value, and we can and should use it to move forward.
The quality argument, answered in 2023
Of everything said since 11 August, the objection that comes up most is that marking has to make the output worse. You cannot optimise for the best answer and for carrying a mark at the same time, the argument goes, and least of all when what you generate is code. Anthropic's claim that quality is unaffected has taken a beating.
The question already has an answer, and it is three years old. In August 2023 Scott Aaronson gave a talk at the Simons Institute about the scheme he was working on at OpenAI, and closed with this: people seemed to have an intuition that there would inevitably be a trade off between watermarking and output quality, and in fact there is none. In his scheme the token choice is made so that it looks exactly like ordinary sampling to anybody without the key. The text does not get worse because, statistically, and for the human eye, it is the same text.
So the community intuition is right for the green list family and wrong for the other one. And that has a practical consequence I find quite interesting: if Anthropic were degrading quality, somebody would measure it and the debate would be over, nothing would be more fun than that. That nobody has published such a measurement suggests, again, that they are in the second.
There is a real limit, though, and it is entropy.
Aaronson quantified it: the number of tokens you need to see the mark grows as the inverse square of the average entropy per token.
If the model had little room to choose (low entropy), there is little mark to plant. Ask it for the first hundred prime numbers and the entropy is zero, so there is no way to mark anything, though it hardly matters who gets credit for that list. Because a text with no entropy means there has been no generalisation, it is probably uncontestable data, with no original thought or narrative (that is my intuition, I have not studied it properly). A few hundred tokens is usually enough, and with a few thousand the confidence is very high.
So the complaint that the mark makes code worse has no basis: it simply marks it weakly, because in the stretches where there is only one reasonable way to write something the model had nowhere to hide the signal. It is the same reason the mark is unreliable on short passages. In any other scenario the mark will work very well and does not degrade quality at all.
The easy half is solved. But, like everything, it has weak points.
Marking a model's output is the easy problem. The provider controls the moment of generation, controls the key and controls the detector. That is why it got solved first, and why the regulation was able to mandate it from the moment it applied.
That it is solved does not mean it is robust, though, and this is where the 2025 and 2026 literature makes a few people uncomfortable.
The most elegant attack is called BIRA and it evades the mark with a success rate above 99% across several watermarking schemes, keeping the meaning of the text intact.
It needs no access to the model and no queries: it inverts the bias, applying a negative nudge to the tokens identified by surprisal, and detection collapses exponentially. The code is published and, in a first informal test on our side, with no protocol or formal metrics, it worked consistently.
The second one goes for the throat of the idea of proof, and rests on a rather entertaining trick. It is called DITTO, it was presented as an oral at EACL 2026, and it does the opposite of erasing: it forges. By distilling from a marked model, an attacker steals the victim's signal and then emits text carrying somebody else's mark. In other words, disinformation can be manufactured that looks like it came out of Claude.
The irony is clear. The mechanism DITTO exploits to forge is radioactivity, exactly the same phenomenon I was defending in July as the route to prove that somebody had trained on your content. The property that turns a watermark into evidence is the one that turns it into a forgery kit. It is the same thing seen from two sides. What interests us is how to apply that principle to mark original texts, before they go into an LLM, so the mark is durable even after being tokenised or reused by a second model.
The third mechanism speaks to exactly that durability, and this one hits me personally. In July I wrote that the A→B→C distillation chain was an open frontier and that, as far as I knew, no study had measured it. I was wrong: an ACL 2025 paper measured it, and the result does not favour my hypothesis: watermarks do not survive distillation when the attacker wants to avoid them.
Targeted paraphrasing before distilling, or neutralisation at inference time, and the inherited mark disappears while knowledge transfer is preserved. It seems we have no escape route here, or at least not with this technique: if one model exploits another that used your content (marked for traceability and protection), this technique does not guarantee you can identify it. At least not if the attacker wants to avoid it.
So what still stands is what the theoretical work I cited a few months ago already said: no strong watermark is unremovable.
The hard part is the interesting one: proving what went in
The models have got ahead of us in applying a mark to content. They generate it from our content and then sign it. It is an unbalanced situation, because we still have no system that identifies and protects the original content and its source.
In 2026 the industry and the regulator built a system so that a model can prove what it has written. Nothing equivalent exists for a creator to prove what has been read, or that it was used for training or for generating answers. Anthropic can prove Claude generated a text. A publisher cannot prove Claude read or processed its catalogue.
It is the same asymmetry inside the Regulation itself: article 50 mandates marking the output and has a code of practice, a deadline and signatories. Transparency about training data exists on paper, but there is no independent verification tool. The regulator asks for a declaration and has nothing to check it with.
This was clear from the start. In the question session of that 2023 talk, somebody in the audience put it to Aaronson in these terms: what about the producing end, the creator who needs to prove they wrote it themselves? The answer was that at most you are ruling out an alternative hypothesis. Which is to say, not even the designer of the scheme had anything to offer on this side of the board. And the provider's watermark is no use for this problem: it certifies that Claude touched a text, not that Claude read yours.
STAMP changes the situation
In the July article I devoted a section to what I called the memorisation wall. My argument: marking is easy, but detection requires the model to have learned the mark, and models only learn what they see many times.
I quoted the numbers from the copyright trap literature: a hundred tokens repeated a thousand times are detected with reasonable reliability, twenty five tokens are detected close to chance, and ninety appearances as a threshold in a giant model. And I concluded that a unique phrase, hidden once, would be caught by nobody.
That conclusion is correct for literal traps, of the January 32 kind. But it cannot be generalised, and for the general problem it is false.
A paper presented at ICML 2025, STAMP, detects content that appears a single time in the training data and represents less than 0.001% of total tokens.
You generate several watermarked rephrasings of your text, publish one and keep the rest private, then compare what likelihood the model assigns to the public version against the private ones. If the model has seen it, it prefers the one you published. The authors validate it on paper abstracts and blog articles, which is exactly our use case.
The impossible date (just an idea but there are many other options in the same direction) is still the only marking layer a human being can see: a judge, a journalist or a client understands in three seconds why day 32 cannot be there by accident. STAMP needs an expert witness and a statistical test. They are complementary layers. But if what you want is detection strength, the impossible date technique (the date was only an example of a carrier, but it illustrates the idea) is the legible layer and STAMP is the layer that actually detects.
So there is a route to a solution here.
Which means what conditions this whole line of work is that you have to act before publishing.
STAMP is no use for claiming over something you published five years ago unmarked. And that is precisely the problem of almost the entire publishing sector: it found out it was raw material when the LLMs had already swallowed and digested its whole catalogue. That said, a publishing house puts out thousands of new texts every year, institutions and citizens generate original ideas that ought to be signable, so the problem remains central and still needs a solution.
A mark should not be confused with a detector.
This is going to happen.
Anthropic has been careful with the nuance, and I will use their words:
A detected mark provides a signal that content was processed by Claude, but is not fully conclusive. Detecting a Claude mark tells you that the content may have been processed by Claude. It does not, on its own, confirm the full provenance of the content. Lack of a detected mark doesn't mean the content wasn't AI-generated or processed.
Somebody may have used Claude to translate, proofread or summarise human material. And the absence of a mark proves nothing either: it could come from an earlier model, another provider, or a heavily edited text.
A good part of the general worry comes precisely from here. If the mark does not confirm authorship and its absence rules nothing out, plenty of people have concluded that, well, what is it for?
The most widespread unease is the scarlet letter: using Claude to revise your own text and having it come out marked as though the machine had written it. The same happens with other applications. Picture a student who writes their essay and then runs it through a corrector like Grammarly. Picture that app applying the marking, and the teacher who grades the work spotting the mark of an AI system. The text will be flagged as AI generated when it was not.
It is a reasonable worry, and exactly the one the paragraph above is trying to defuse. The trouble is that the nuance sits in one paragraph in a help centre buried among hundreds of pages of text, while accusations of AI use are made daily in an office and affect people's lives. This is happening among educational institutions as we speak.
The problem is going to be institutional. There will be universities and companies treating the mark as if it were an AI detector, and it will be a disaster. A reference study on seven commercial detectors found a false positive rate of 61.3% on essays by Chinese students against 5.1% on essays by United States natives, because perplexity based methods systematically penalise simpler vocabulary.
To be clear, a cryptographic watermark and a perplexity detector are technically different, and the first is far more reliable. But the way institutions use an automated signal against a person does not depend on the quality of the signal. And that is why it is inevitable that somebody ends up accused of illicit AI use simply for having run Claude over their own text to fix the spelling.
This is not new either. In the 2023 talk, Aaronson listed the questions holding up deployment of the scheme at OpenAI, and one of them was exactly this: if there are people who should be able to use a language model without having to declare it, such as someone writing in a language that is not their own and using it to improve their English, is it fair that everything they do comes out marked?
His answer was that he did not know how to build a marking tool that works only for the cases you disapprove of and not for the ones you sympathise with.
Three years on, the tool has already shipped and that question is still unanswered. It is also still unclear who will get access to the detector. Anthropic has announced its own and has not yet said who will be allowed to use it.
For a change, this one is about money.
The business impact of all this is enormous, and it is the engine behind the interest in marking. Happily, any progress in this area also helps us move forward in our search for protection of authorship and safeguarding of the truthfulness of information. Three figures that show the economic stakes:
First. Anthropic agreed to pay 1.5 billion dollars to authors and publishers, around 3,000 dollars per work across some 500,000 works, after a court held that downloading books from pirate sites was infringement even though the training itself was fair use. The distinction is the key to everything: what was judged was not training, it was provenance (a very interesting precedent for us).
Second: there were more than 35 active training data lawsuits in the main Western jurisdictions in the second quarter of 2026, and discovery in those cases turns precisely on the provenance of each book, image or article in the dataset.
The third looks ahead: from 15 September 2026, Cloudflare blocks mixed use crawlers by default on pages carrying advertising, and pushes a pay per use model so AI companies compensate publishers (Cloudflare is winning my sympathy by the day).
All three point the same way. The value is no longer in holding the content, it is in documenting the use it was put to. I have not yet managed to make any media company see this; they remain set on hoarding and protecting access to content. What good is installing alarms once the safe has already been emptied? And that capability sits with the AI lab, not with whoever wrote the text.
Why at 498 Advance we are working to find the best source marking system.
Traceability is key to a huge number of solutions. Knowing that a text generated by ChatGPT comes from particular sources lets us guess how the system works inside, and it also helps us judge how reliable that answer is. It also lets us assess the return on the effort of informing LLMs better.
If I invest in producing high value information about medicine or animal care and I can confirm the AI is using it, then it makes sense to keep investing. On top of the obvious reasons of protecting both proprietary information and trade secrets which, more and more, will live in local or private AI models and will be open to being squeezed by training or search crawlers from larger models.
What Anthropic has done, stripped of noise, is equip itself with a defensive capability: it can demonstrate what came out of its model, with what coverage and under what conditions. That is legitimate and sensible. What I find intolerable is that the same capability is out of reach for a publisher, who is the other party to the contract and the one who supplied the raw material.
A publishing house, a news outlet, a photo archive or an individual author are in the opposite position: they were feedstock for training, many without knowing it and almost all finding out after the fact, and they have no tool to exercise the defence Anthropic does exercise. That asymmetry is not a law of nature. It is a missing product. 498 Advance wants to build that solution and, at the same time, to have a system for calculating the ROI of GEO work.
498A, the R&D lab at Zoopa, is working on the two layers that are still unsolved. The first goal is to understand the system and its formal limits thoroughly, and to build a solid way of working from there. That system can be embodied in different products later. Without a solid scientific base we would fall into the same error as the products that rushed to promise mark removal and have now been shown to be useless.
The first layer to solve is marking for publishers: marking content at the moment of publication, with a legible mark and a statistical mark at the same time, and keeping a timestamped registry. What matters about the timestamp is that it does not depend on detection being perfect: it proves when you planted the mark, and that chain of custody is what makes any later claim credible.
A few weeks ago I discussed this solution with the head of the largest publishing house in the world, and mentioned it in passing to executives at one of the most important news groups in Latin America. In both cases I failed to convey the strategic importance of the matter and came away with a "we are already looking into it". It is worrying that there is no joint initiative among the large publishing groups, because it would have enormous social and cultural value.
The second is a traceability layer tied to the AI Regulation: the regulator demands transparency about training data but has nothing to verify it with, and nobody should trust a lab that audits itself. That need for a neutral third party has a long runway, and I do not see anyone occupying it.
With GEORadar we measure how models see and cite you. For that task, and for putting the key information in front of the AI crawlers, knowing the origin of the data reliably is fundamental.
What we will not promise is the same as in July, and now with better reason: we are not going to chase a mark through a chain of distillations, because ACL 2025 has shown that a determined attacker will remove it without difficulty.
The question that will not let me enjoy my holidays
In 2026 the industry already knows how to sign what it says. There is still no simple way to certify what has been read and is being used.
While that asymmetry stands, whoever wrote the text is defenceless, and the system does not reward the creation of reliable, high quality content. The burden of proving authorship falls on the side with the fewest resources.
Both the impossible date and STAMP require having acted before publishing. Every article that goes out unmarked is a claim that can no longer be made later.
So I am left with a different question: how many years of archive are we willing to write off before we start marking the content we publish next?
Glossary
- C2PA: open content provenance standard. It attaches cryptographically signed metadata to a file stating who generated it and how. It is removed by simply reformatting or taking a screenshot.
- Spoofing (mark forgery): generating text carrying another provider's watermark, so authorship is attributed to somebody who did not write it.
- Token surprisal: a measure of how unexpected a token is in its context. Watermarks hide preferentially in surprising tokens, which is why attacks look for them there.
- Likelihood: the probability a model assigns to a specific text. Comparing the likelihood of two versions of the same text lets you infer which one it has seen before.
- Article 50 of the AI Regulation: the transparency layer of the European rule. Among other things it mandates machine readable marking of AI generated content. It applies from 2 August 2026.
- 498 Advance: R&D lab created by the agency Zoopa, focused on AI and visibility in generative search.
Frequently asked questions
Is everything I write with Claude marked?
If you use a model launched from 2 August 2026, yes, and the surface makes no difference: app, API, Claude Code, Cowork, Tag, or the model running inside AWS, Google Cloud or Microsoft Foundry. No way to switch it off has been documented.
Does the mark prove a text was written by an AI?
No. It proves Claude may have processed it. That is compatible with you writing the text and using Claude to translate, summarise or proofread it. Anthropic clarifies this itself.
Does marking make responses worse, especially code?
It depends on the scheme. In the green list family there is a cost, because the probability distribution is altered. In the distortion free family there is none, and it is proven: without the key, marked text is indistinguishable from ordinary text. With code something different happens: the code keeps its quality and simply carries a weak mark, because where there is only one reasonable way to write something there is no entropy left to hide the signal in.
Can it be removed?
With heavy paraphrase, yes. The tools sold in the first days did not remove it: they cleaned up invisible characters, which is a different thing. And the literature has attacks with over 99% evasion without access to the model.
Does this help me prove an AI trained on my content?
No, and that is the point of the article. Anthropic's mark runs the other way: it certifies what leaves the model, not what went in. For the second you need to mark your content before publishing it.
What can I do if I published my archive unmarked?
Little, by the watermarking route. Both the impossible date and STAMP require acting before publication. For what is already published there are other routes: a timestamped registry of what was published and when, crawler control, and the contractual and judicial route, where data provenance is the axis of the cases.
What if somebody forges Claude's mark on a text of mine?
It is a scenario documented in the literature since EACL 2026, not a hypothesis. That is why the nuance about the mark indicating processing rather than authorship matters more than it appears to.
Sources
- Anthropic. Help centre article on content marking, updated 11 August 2026. Reported in TechCrunch, Forbes, Fortune and Euronews
- European Commission. Code of Practice on Transparency of AI-Generated Content, article 50(2). Found adequate on 8 and 9 July 2026. digital-strategy.ec.europa.eu · analysis at Bird & Bird
- Aaronson, Scott. "Watermarking of Large Language Models". Simons Institute, Berkeley, 17 August 2023. simons.berkeley.edu
- Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein. "A Watermark for Large Language Models" (the green list). ICML 2023. proceedings.mlr.press
- Christ, Gunn and Zamir. "Undetectable Watermarks for Language Models" (distortion free family). 2023. eprint.iacr.org/2023/763
- Rastogi, Maini and Pruthi. "STAMP: Proving Dataset Membership via Watermarked Rephrasings". ICML 2025. arXiv:2504.13416
- "Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation?". ACL 2025 (Main). arXiv:2502.11598
- "DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillation". EACL 2026 (oral). arXiv:2510.10987
- "LLM Watermark Evasion via Bias Inversion" (BIRA). 2025. arXiv:2509.23019
- Sander, Fernandez, Durmus, Douze and Furon. "Watermarking Makes Language Models Radioactive". NeurIPS 2024. arXiv:2402.14904
- Zhang, Edelman, Francati, Venturi, Ateniese and Barak. "Watermarks in the Sand". ICML 2024. arXiv:2311.04378
- Google. Signing of the transparency code and expansion of SynthID, 24 July 2026. gcn.com
- OpenAI. "Advancing content provenance for a safer, more transparent AI ecosystem". openai.com
- Analysis of the market for Claude watermark removal tools. Medium, August 2026
- Cloudflare. Default blocking of mixed use crawlers from 15 September 2026. TechCrunch
- Data on false positives in commercial detectors against essays by non native students. Reported at Editage
- Ortet, Carlos. "January 32: how to know if an AI trained on your content, and prove it". 10 July 2026. carlosortet.com
