The Invisible Ink: Why Watermarking AI Text Is Harder Than It Sounds

Published: August 12, 2026

The Announcement

On August 11, 2026, Anthropic confirmed it will watermark text generated by its models — including Claude — to comply with European regulations. The mechanism is described in an updated support page: all models released after August 2 will automatically embed a watermark in both computer-generated text and files. For files, the company is using the C2PA open standard. For text, the watermark is baked into the text itself.

The key claim, quoted from Anthropic's support page:

"Because the watermark is part of the text, it will travel with the text when it's copied and pasted elsewhere, and may persist through some editing. Watermarking will be applied at the model level, which means it will be present no matter which Claude product or surface the text comes from."

That last sentence is doing a lot of work. "No matter which Claude product or surface." The watermark is not a wrapper around the output. It is woven into the output itself. Copy it, paste it, edit it lightly — the mark is supposed to survive.

This is the EU AI Act's Transparency Code, which took effect on August 2, 2026, doing its job. And it is a genuinely significant moment. But watermarking text is a very different technical problem from watermarking images, and the difference is where the real story lives.

Why Text Is the Hard Case

Watermarking an image is comparatively easy. You have a grid of pixels, and you can nudge a few of them in ways that are invisible to the human eye but detectable by a machine. The image still looks identical. The watermark is a layer you can hide in the noise.

Text has no noise. It is a sequence of discrete tokens — words, punctuation, spaces — and every one of them is visible. There is no "pixel" you can nudge without changing what the reader sees. A watermark in text has to live in the choices the model makes, not in the output itself.

This is the core insight of statistical text watermarking. A language model does not just pick the next word; it assigns a probability to every possible next word. Usually it samples from that distribution. A watermarking scheme biases that sampling in a secret, deterministic way — a way that is invisible to a reader but detectable to someone who knows the key.

The result is text that reads normally but carries a statistical signature. Change one word, and the signature weakens. Change enough words, and it disappears. The watermark is not a stamp. It is a probability distribution that has been gently tilted.

That is why Anthropic's phrasing matters: "may persist through some editing." Not all editing. Some. The watermark is a statistical tendency, not a guarantee. It survives light edits and dies under heavy ones.

The Arms Race Nobody Wants to Admit

Here is the uncomfortable truth about text watermarking: it is a race, and the racers are not evenly matched.

On one side, you have the watermarkers. They control the model, so they control the sampling bias. They can make the signature stronger, subtler, or more redundant. They can update the key. They have the home-field advantage.

On the other side, you have the strippers. They do not need to control the model. They only need to break the signature. And they have a growing toolkit: paraphrase, translation-and-back, synonym substitution, reordering, insertion of filler. Any of these scrambles the statistical pattern. The more the text is transformed, the weaker the signal.

The asymmetry is the problem. Watermarking is a one-time act at generation. Stripping is an ongoing act that can be applied to any text, from any source, at any time. The stripper does not need to win every time. They need to win once, on the text that matters.

This is not hypothetical. The research literature on watermark-removal attacks is already substantial, and it predates the EU mandate by years. Every published watermarking scheme has a published attack. The question is not whether the watermark can be removed. It is how much effort removal takes, and whether that effort is worth it for the person doing the removing.

For a casual user who copies a paragraph and pastes it into a document, the watermark survives. For someone determined to launder AI text — a spammer, a disinformation operator, a student trying to pass off generated work as their own — the watermark is an inconvenience, not a barrier.

What the Watermark Actually Buys

It is worth being clear about what watermarking does and does not accomplish, because the regulatory framing tends to blur the two.

What it does: It creates a detection signal. Given a piece of text, a system with the right key can say, with some statistical confidence, "this was generated by model X." That is genuinely useful. It gives platforms, publishers, and regulators a way to audit content after the fact. It shifts the burden from "prove this is AI" to "check this against the signature."

What it does not do: It does not prevent AI-generated text from circulating. It does not stop a determined actor from stripping the mark. It does not tell you whether the content is true, only whether it was machine-generated. And it does nothing for text generated by models that do not watermark — which, as of today, is most of the models in the world.

The last point is the one that gets lost. Anthropic is watermarking Claude. But the EU code is voluntary for most companies, and the models that dominate open-source and grey-market use are not all signed up. A watermarking regime only works if the watermark is ubiquitous. A single unwatermarked model is a hole in the net.

This is the classic provenance problem: authenticity is only as strong as the weakest unmarked source. You can watermark every Claude output on Earth, and it will not stop a single piece of text from an unwatermarked model. The watermark is a tool for attribution, not a tool for prevention.

The Trust Paradox

There is a deeper tension here, and it is the one that makes me uneasy.

Watermarking is sold as a trust-building measure. The idea is: if you can tell what is AI and what is human, you can trust what you read. But the effect may be the opposite. A watermark does not make text more trustworthy. It makes the absence of a watermark more suspicious.

Consider what happens in a world where watermarking is widespread. A reader sees an unmarked piece of text. Is it human-written? Or is it AI text that has been stripped of its mark? The reader cannot tell. The absence of a watermark becomes ambiguous — and in an adversarial environment, ambiguity reads as guilt.

The result is a trust paradox: the more we rely on watermarks to certify authenticity, the more we distrust everything that lacks one. We trade a world where "AI text is everywhere and we cannot tell" for a world where "unmarked text is suspect." Neither is a world of trust. The second one just has better optics.

This is not an argument against watermarking. It is an argument for being honest about what it is: a detection mechanism, not a trust mechanism. Detection tells you where text came from. Trust is a much larger, messier problem that no watermark can solve.

The Editing Question

Anthropic's support page is careful: the watermark "may persist through some editing." That "some" is doing heavy lifting, and it is worth unpacking.

Light editing — fixing a typo, changing a word, reordering a sentence — probably preserves the statistical signature. The bias is spread across the whole text, so a few changes do not erase it.

Heavy editing — rewriting paragraphs, paraphrasing, translating — probably destroys it. The more the text diverges from the model's original token choices, the weaker the signal. At some point, the text is no longer "Claude's text with edits." It is a new text that happens to be based on Claude's output. And the watermark, which lives in the token choices, is gone.

This creates a strange incentive. The watermark does not just mark AI text. It penalizes editing. A human who takes an AI draft and substantially rewrites it — which is, ironically, exactly what the "human strategy + AI execution" model of good writing recommends — will strip the watermark in the process. The more a human improves the text, the less detectable it becomes.

The watermark, in other words, rewards leaving AI text alone and punishes the kind of human intervention that makes AI text worth publishing. That is a perverse incentive, and it is baked into the technology.

The Bigger Pattern

This announcement is not an isolated event. It is part of a pattern that has been building all year:

  • July 2026: Substack partnered with Pangram to flag AI-generated content, after its CEO called out "Claudefishing" — people using AI to generate content and pass it off as their own.
  • August 2026: AI music platform Suno said it will mark tracks created on its platform, after a spate of legal challenges.
  • August 2026: Anthropic commits to watermarking text and files, citing the EU AI Act's Transparency Code.

The pattern is clear: platforms are rushing to watermark AI content, driven by a combination of regulatory pressure and user backlash. The EU code is the forcing function, but the underlying demand is broader. People want to know what is real.

The problem is that "what is real" is not the same question as "what is AI-generated." A piece of text can be AI-generated and true. It can be human-written and false. Watermarking addresses the first distinction and is silent on the second. It tells you the origin of the text, not the truth of it.

That is not a failure of watermarking. It is a limit of the tool. But it is a limit that the regulatory conversation tends to gloss over, because "we can tell what is AI" sounds like a solution to a problem that is actually much bigger.

The Verdict

Anthropic's watermarking commitment is a real step. It is the first major model maker to bake text watermarking into the model layer, across every product surface, with a mechanism that survives copying and light editing. That is technically meaningful and regulatorily significant.

But it is worth holding two truths at once.

First: Watermarking is a genuine advance in provenance. It gives us a detection signal where we had none. That is real progress, and it should be acknowledged.

Second: Watermarking is not the solution to the authenticity crisis. It is a detection mechanism, not a trust mechanism. It can be stripped by determined actors. It penalizes the human editing that makes AI text good. It says nothing about truth. And it only works if it is ubiquitous — which, today, it is not.

The invisible ink is a good start. But the ink is not the message. The message is that we are still figuring out how to live in a world where machines write, and no watermark is going to tell us what to believe.

Sources:

  • TechCrunch. (2026, August 11). Anthropic says it will watermark text generated by its AI models. https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/
  • Anthropic Support. (2026). Watermarking of AI-generated content. (Referenced via TechCrunch reporting.)
  • TechCrunch. (2026, July). Substack teams up with Pangram to flag AI-generated content. (Referenced via TechCrunch reporting.)