Anthropic's Watermark Can't Tell "Written By AI" From "Proofread By AI"

Here's What "Watermarking Text" Actually Means Watermarking an

image is straightforward to picture: you can encode a hidden pattern into pixel data that survives resizing or cropping and points back to its source. Text doesn't have pixels. What Anthropic is actually doing is subtler and far more fragile - it's nudging the statistical choices a language model makes at each step of generating a sentence (which word, among several equally valid options, to pick next) in a consistent, detectable pattern.

That pattern is the "watermark." It's invisible to a human reader because the words still read naturally; it's detectable, in principle, only if you have the tool built to recognise the specific statistical signature Claude's outputs carry.

The mechanism explains exactly why this rollout has triggered alarm beyond the usual privacy-policy shrug. A watermark based on statistical word choice doesn't know why a given sentence exists - it can't distinguish between a paragraph Claude wrote from scratch and a paragraph a human wrote entirely themselves, then asked Claude only to tighten or proofread.

If Claude's edit touches enough of the sentence's word choices to leave its statistical fingerprint, the watermark persists regardless of how much of the original thinking, structure and content was human. Anthropic's own admission that the watermark "may persist through some editing" is the tell here: persistence through editing is a feature for catching someone trying to disguise wholesale AI generation and a bug for catching someone who used Claude the way a spell-checker gets used.

This is where the comparison to the earlier generation of AI text detectors matters most. Those tools were experimental and error-prone, yet still caused real damage - cancelled book deals, false plagiarism accusations - precisely because false positives don't announce themselves as false.

A watermark is procedurally different from a detector (Anthropic controls what gets embedded; third parties would need Anthropic's cooperation or a leaked detection method, to check for it), but the practical risk to an innocent writer is the same shape: a flag with no explanation attached, appearing in text the writer genuinely authored.

Where this becomes a governance question rather than just a product complaint is the EU AI Act's Article 50(2), the actual legal trigger for this rollout. The Act's goal - machine-readable marking of AI-generated synthetic content - assumes a reasonably clean line between "AI-generated" and "human-generated" content exists to be marked.

Text doesn't respect that line the way images and video largely do, because editing assistance sits on a spectrum with no obvious cutoff and no jurisdiction, including the EU itself, has yet defined how much AI involvement should trigger disclosure.

Until that threshold gets defined in policy rather than left to a statistical side-effect of how the watermark happens to behave, users are left guessing whether proofreading their own work is enough to get it silently marked as somebody else's.