AI Watermarking is coming for AI-generated content

quote:

---

Roughly three-quarters of newly published web pages now carry some machine-written text, according to a 2025 Ahrefs analysis of around 900,000 pages. This figure doesn’t account for offline documents. It also only covers text. Generative AI now produces music, illustrations, software, photographs and increasingly convincing video. The problem is that much of it is becoming difficult to distinguish from human-created work, raising transparency and security concerns.

The European Union's answer to these concerns is regulation. Under Article 50(2) of the EU AI Act, providers of generative AI systems are required to make all generated content detectable as artificially generated or manipulated.

Anthropic, the company behind Claude, has signed the bloc's Code of Practice on Transparency of AI-Generated Content, one of around 190 signatories, and now plans to watermark Claude's output across its ecosystem. According to the company, text will carry an invisible statistical watermark, while supported visual formats (such as PNG, JPG, or SVG) will receive signed metadata noting that Claude was involved.

---

quote:

---

So, how does the marking work? For text, Anthropic uses a version of Google DeepMind's SynthID-Text method. It does not rely on hidden characters or metadata attached to a document. Instead, the watermark is created through the words Claude chooses while generating text. When generating text, large language models pick each next word from a set of plausible candidates. In many situations, several words could continue a sentence equally well, so the choice is normally settled at random.

With SynthID-style watermarking, a secret key and the preceding text influence that choice. Across enough words, those tiny choices build up into a statistical pattern. So while the text still reads naturally, it now carries a signature that a detector with the appropriate key can examine to determine whether its word-selection pattern resembles Claude's watermarked generation. Pretty nifty. Anthropic says the technique adds no characters, needs no extra tokens, doesn't change output quality, and carries nothing that identifies a user, an organization, or a chat.

For supported files, Anthropic uses a more conventional technique. When Claude generates formats such as a PNG, JPG, or SVG, it attaches a cryptographically signed note in the file's metadata under the open C2PA standard. Nothing in the image itself changes. The credential records that Claude made or processed the file and holds no personal information. A compatible reader can inspect that credential and determine that Claude processed the file. Because the information is cryptographically signed, it can also help reveal whether the credential or file has subsequently been tampered with.

While Anthropic has figured out how to mark its text output, it's still figuring out how to detect those markings. Anthropic says a watermark-detection API is coming but has not finalized how it will work. For files, any C2PA-aware tool can read the file credentials, with the company promising its own checker.

---

quote:

---

Xusheng Li, a software developer at reverse-engineering security firm Vector 35, discovered that before Paint generates an image, the user’s prompt is sent to Microsoft for a safety check intended to weed out prohibited content.

Microsoft then sends back a unique watermark ID, which Paint quietly embeds into the image’s pixels.

---

quote:

---

Li also discovered that Paint apparently refuses to return an AI-generated image if its invisible watermark can’t be successfully added. While Microsoft Photos contains similar watermarking technology, it appears to be able to continue if it fails.

---

quote:

---

As Business Insider notes, the term “AI watermark remover” has started trending on Google, jumping 60% in search interest week over week, and an open-source GitHub project called Watermarks Remover has amassed more than 15,000 “stars” and thousands of forks with the promise to scrub any output of indicators that it came from AI. Sabrina Ramonov, an AI educator, created her own web-based tool for washing text of residual model markers.

Why the panic, exactly? Well, according to the creator of the Watermarks Remover tool, it’s a matter of privacy and attribution. “I am all for content attribution,” Guillaume Meyer, the creator of the popular GitHub project, told Business Insider. “I am against the watermarking technique, and that’s a very significant distinction.”

---