Anthropic is watermarking Claude's text — and 1,922 court cases show what that can't fix

On August 14, 2026, Anthropic explained how text watermarking would work in future Claude models. Its FAQ connects the rollout to the EU AI Act's transparency requirements, which began applying on August 2. Models released before that date are being updated over a transition period; the announcement does not mean every Claude response already carries a watermark.

The useful idea is a signal inside a model's word choices. Under the right conditions, that signal can help identify a model's involvement without changing how the text looks to a reader.

The distinction matters when generated text contains fabricated evidence. A public database snapshot discussed below recorded 1,922 court cases involving AI-hallucinated content. These are not watermark-detection tests, and they do not establish whether any particular detector would have identified the text. They show a different problem: a provenance signal cannot establish that a cited case, study, or fact exists. Understanding that gap makes a watermark result much more useful, and much harder to misuse.

TL;DR:

• Nothing is added to the text. A secret key changes the randomness behind word selection, not the visible format. Anthropic plans a global rollout, with older models added over time.
• A hit is weak evidence and a miss is almost none. Anthropic says the mark cannot distinguish "Claude wrote this" from "Claude heavily edited this," is weak on short samples, code and factual passages, and is erased by a rewrite. Researchers showed in 2024 that under $50 buys the ability to both strip these marks and fake them onto text a human wrote.
• Provenance is not verification. A detection result can indicate likely model involvement, not validate a case, citation, or book named in the text.

Image: Jon Rawlinson, Wikimedia Commons, CC BY 2.0. A page full of authenticity marks. Each proves a border was crossed. None says a word about whether the traveller told the truth.

What Anthropic actually changed, and what it didn't

Start with the mechanism, because nearly every misunderstanding downstream comes from getting this wrong.

When a language model writes, it produces one word at a time, and at most positions there is no single correct choice. "The meeting was productive" and "The meeting was useful" are both fine. The model holds a list of acceptable next words and picks using a random draw — which is why the same prompt gives you slightly different answers twice.

A text watermark replaces that random draw with a pseudo-random one driven by a secret key. The model still only ever chooses among words it already judged equally good, so quality is untouched. But across a few hundred words, the pattern of which acceptable word won each time stops looking like coincidence, and anyone holding the key can measure it.

There are no hidden characters or removable text metadata. The signal comes from word choices, and Anthropic says it adds no tokens and has negligible speed impact. Its launch policy is global rather than region-specific, but model coverage still depends on the rollout; the policy alone cannot establish that a particular response is watermarked.

None of this is new science. Scott Aaronson proposed it in 2022, Kirchenbauer and colleagues published a working scheme at ICML in 2023, and Google DeepMind published SynthID-Text in Nature in October 2024 — Anthropic's implementation is a version of that. Google has run it in Gemini since 2024, reporting roughly 20 million live responses with no detectable quality difference, and claims more than 10 billion pieces of content watermarked since.

Update, October 12, 2026: Anthropic's September 1 FAQ update describes a detection API in private preview for eligible organizations, with broader access planned. This replaces the original August snapshot's upcoming-API status. The watermark estimates Claude's involvement; it does not check whether the text is true.

The mark survives a copy-paste. It does not survive a rewrite.

The signal lives in which words were chosen, so anything preserving the word choices preserves it and anything replacing them destroys it. Anthropic states the ceiling bluntly: "a complete rewrite where every word is replaced will" remove it. Two cases break that pattern in ways that catch people out.

Short and factual text carry almost nothing. The watermark needs choices to hide in. A sentence or two does not offer enough decisions to form a pattern, and heavily factual content may offer no real choice at all — Anthropic's example is that after "Newton's Principia," the next word is going to be "Mathematica," and no key gets a vote. The same logic weakens code, where syntax dictates most tokens, and proofreading, where the model changes too few words to leave a signal.

Translation carries a full watermark. This runs against instinct. Ask Claude to translate a document into Japanese and the Japanese text is newly generated by Claude, word by word, with the usual freedom to choose — so it comes out fully marked, even though the ideas came from an unmarked human original. That is the opposite of what the DeepMind researchers describe in Nature, where translating watermarked text into another language greatly reduces detection confidence. Both are true, because they are different scenarios: translating marked text elsewhere washes the mark out, while having the model do the translating stamps a fresh one on.

Survival behaviour as stated by Anthropic in its August 14, 2026 FAQ and by the SynthID-Text authors in Nature, October 2024.

A hit is weak evidence. A miss is almost none.

If a detector returns a result, what can you reasonably conclude?

If it is positive: that some of this text passed through that vendor's model. That is the whole of it. Anthropic states plainly that the mark cannot distinguish "Claude wrote this" from "Claude heavily edited this," it says nothing about whether a single claim is true, and it cannot recognise text from some other AI, because it only ever knows its own key.

If it is negative, they have learned close to nothing. A clean read is exactly what you also get from a paraphrase, a short excerpt, a code block, a competitor's model, or an open-weight model running on someone's laptop with no marking at all.

Every cell here is a limit the vendors published themselves. Sources: Anthropic's watermark FAQ (August 14, 2026, updated September 1); Dathathri et al., Nature (October 2024); Jovanović, Staab and Vechev, ICML 2024.

The attack nobody budgets for runs in reverse

Scrubbing is the risk everyone imagines: someone launders AI text to hide its origin. There is a second attack pointing the other way, and it is the one that should worry you.

Spoofing means making text a human wrote carry someone else's watermark. Nobody is hiding anything; they are planting something. The target is a person who then gets accused of using AI, or a vendor blamed for output it never produced.

At ICML in 2024, Jovanović, Staab and Vechev demonstrated both attacks against state-of-the-art schemes with more than 80% success, for under $50 of compute. The DeepMind authors concede the same ground in their own Nature paper: watermarks "do not offer a complete solution," they require the model provider's cooperation to exist at all, they are unenforceable on open-weight models anyone can run unmodified, and they are "vulnerable to stealing, spoofing and scrubbing attacks." That last clause is the whole argument, published by the team that built the technology.

Early AI detectors accused the wrong students

Detection tools already exist, and they are a different technology with a documented history of harm. A watermark is planted at generation time by the model's owner, using a key. A classifier guesses after the fact, from features of the writing itself: how predictable the word choices are, how varied the vocabulary is. The first knows something. The second pattern-matches on style. That is the difference between measuring and profiling.

OpenAI launched an AI Text Classifier on January 31, 2023 and killed it on July 20 the same year "due to its low rate of accuracy." Its own numbers: 26% of AI text caught, 9% of human text falsely flagged.

Then Liang and colleagues published in Patterns in July 2023 the finding that should have ended the category. Across seven detectors run on TOEFL essays by non-native English speakers, the average false-positive rate was 61.3%; one detector flagged 97.8% of them. Prompting the same essays to use richer vocabulary dropped that to 11.6%. The detectors were never measuring authorship — they were measuring fluency, and penalising anyone whose English was simpler.

Vanderbilt University disabled Turnitin's AI detector on August 16, 2023. Its explanation used a hypothetical calculation: applying a claimed 1% false-positive rate to about 75,000 submitted papers could incorrectly flag roughly 750 papers. That was a risk estimate, not a count of students actually accused. Vanderbilt's announcement.

Watermark detection tests a defined generation pattern rather than inferring authorship from writing style. The result is still probabilistic, and short or heavily edited passages can be inconclusive. A result about model involvement should not become an accusation about a particular person; spoofing research also shows why detection alone cannot establish authorship.

Regulation arrived before the tools did

All of this is landing in one fortnight because lawmakers moved first.

The EU AI Act splits the duty in two. Article 50(2) binds providers: whoever builds a generative system must mark its output machine-readably, text included. Article 50(4) binds you: a deployer publishing AI-generated text "informing the public on matters of public interest" must disclose it.

That second one carries an exemption which is, for most readers, the practical heart of the regime. It does not apply where the content has undergone human review or editorial control and a person holds editorial responsibility for it. Read that twice. Europe's answer to AI-generated text is not a detector. It is a named human who reviewed the thing and is accountable for it.

Labeling obligations landed on a schedule; usable detection did not. Sources: the EU AI Act and its application dates, the EU transparency code of practice (July 2026), China's labeling measures and GB 45438-2025, Korea's AI Basic Act, and Anthropic's announcement.

The Commission describes its transparency code as a voluntary compliance framework, not a replacement for the law; around 190 organizations had signed by the end of July 2026. Its FAQ gives systems placed on the market before August 2 a transition period until December 2, 2026. The distinction matters: a signatory's implementation schedule and a legal obligation are not interchangeable. Commission overview, Commission FAQ.

Other jurisdictions use different rules. China's labeling measures took effect September 1, 2025, with visible and embedded labels under standard GB 45438-2025. Korea's AI Basic Act took effect January 22, 2026. A reader evaluating compliance needs the applicable jurisdiction and content type, not a single supposedly global labeling rule.

One absence belongs here too. The Wall Street Journal reported in 2024 that OpenAI had built a text watermarking method described internally as around 99.9% accurate. Treat that as a report, not a fact: it has never been independently verified and OpenAI has never shipped text marking. Its own June 11, 2026 post on EU compliance documents image provenance only, and concedes the general limit in its own words — "metadata can be removed, watermarks can degrade."

A watermark cannot validate a hallucinated citation

Damien Charlotin maintains a public database of court decisions worldwide in which a judge had to address AI-generated content containing hallucinations. Fetched on August 16, 2026, it stood at 1,922 decisions: roughly 200 in mid-2025, 719 by January 2026, 1,227 by April, 1,598 on June 9, and 1,922 today — 324 added in the last ten weeks alone.

These cases document hallucinations, not tested watermark results. A provenance mark cannot validate their factual claims. Source: Damien Charlotin's AI Hallucination Cases database, fetched August 16, 2026.

The archetype is Mata v. Avianca, decided in the Southern District of New York on June 22, 2023: a brief citing six judicial decisions that did not exist, and a $5,000 sanction.

The example that should carry the most weight belongs to Anthropic. In May 2025, in Concord Music v. Anthropic, the company's own lawyers filed an expert declaration citing a study that Claude had hallucinated. A manual check missed it; counsel apologised to the court. The company now shipping a text watermark was itself burned by uncritical citation — of its own model's output, in its own litigation, with its own lawyers reviewing. Even a positive watermark result could not have established whether the cited study existed.

It generalises past law. Deloitte Australia agreed in October 2025 to partially refund a A$440,000 government report containing non-existent references and a fabricated quote from a judgment. On May 18, 2025, the Chicago Sun-Times and the Philadelphia Inquirer ran a syndicated summer reading list in which only five of the fifteen books were real. Liang and colleagues, analysing 950,965 papers in arXiv:2404.01268, found LLM-modified content reaching 17.5% of computer science abstracts against 6.3% or less in mathematics and the Nature portfolio.

The volume question deserves an honest number rather than an alarming one. A Graphite analysis of Common Crawl published in October 2025 found roughly 51.7% of sampled new articles were AI-written in May 2025 — and Axios, reporting it, added the caveat that matters: the share plateaued near parity rather than climbing. This is not a flood. It is a new normal.

Here's the point. Nothing on that list is a watermarking failure. In every case the provenance was never in doubt — everyone knew a model was involved, or would have accepted it instantly. What failed was that no human opened the citation and checked whether the case, the study or the book existed.

The bottom line: provenance is not verification

Call it the postmark fallacy. A postmark proves which office handled the letter. It has never had an opinion about whether the letter is true. We have just spent a great deal of engineering effort building a very good postmark, and a certain amount of public conversation is about to mistake it for a fact-checker.

Hold three things at once. A positive detection is evidence about likely model involvement, not authorship or truth. A negative result cannot prove that a person wrote the text. Coverage depends on the provider, its key and the models using its watermark; it is not universal. Anthropic's updated private-preview API also has eligibility requirements rather than unrestricted public access.

What survives scrutiny is not a mark on the output. It is a record you can re-derive from its source: a recording that still exists, a timestamped transcript you can jump back into, a line attributed to the person who said it, a claim traced to a primary document you can open. We have argued this before about live translation, where the reviewable note matters more than the fluent output, and about police interview transcription, where the record has to hold up when someone contests it. The watermark era sharpens that argument rather than changing it: once marking is universal, "AI was involved" stops discriminating between anything.

Watermarks answer where text came from. Nobody has built the thing that answers whether it is true, because that thing is not a detector. It is a source you can go back to.

---

Where Telli.sh fits: we build the source you can go back to. Telli.sh records the meeting, produces a timestamped transcript with speakers attributed, and keeps the summary anchored to the audio it came from — so any line in your notes traces back to the second someone said it, months later. That is not a claim about detecting AI. It is the other half of the problem: when a summary asserts something, you can check it against the recording instead of trusting the sentence.

Start a live AI note

Sources

• Anthropic, "How Claude's text watermark works" (August 2026)
• Dathathri et al., "Scalable watermarking for identifying large language model outputs," Nature (October 2024)
• Kirchenbauer et al., "A Watermark for Large Language Models," ICML 2023
• Jovanović, Staab & Vechev, "Watermark Stealing in Large Language Models," ICML 2024
• Liang et al., "GPT detectors are biased against non-native English writers," Patterns (July 2023)
• Liang et al., "Mapping the Increasing Use of LLMs in Scientific Papers," arXiv:2404.01268
• Damien Charlotin, AI Hallucination Cases database
• European Commission, AI Act Article 50: transparency obligations
• Wikimedia Commons image page