Claude's New Watermarks Don't Matter as Much as You Think
Anthropic just dropped invisible watermarks into Claude. Everyone is panicking over it.
But does it even matter?
What actually happens
Claude now marks everything it creates on two layers:
1. Text: an invisible mark hidden inside the words. You can't see it. Machines can. Copy it, paste it anywhere — the mark comes along.
2. Files: every file Claude creates carries a signed digital signature that shows where it came from.
It's built into the model itself. So every proposal, post, and email you polished with AI can now be traced.
Does it matter?
Everyone already knows everyone works with AI. That stopped being a secret somewhere in 2023. The entire world has seen the flood of AI slop, the LinkedIn posts written by ChatGPT, the emails that sound like a robot trying to sound human. Detection has never been the problem — the problem is caring.
So a machine can prove AI touched your text. Fine.
It still can't tell who had the idea. Who made the calls. The thinking has no watermark.
"The watermark can't trace the person who told Claude what to write."
That's the part nobody's talking about. If you can prompt it well enough to get something useful out, the watermark just means the model did its job correctly.
How does it even work?
Here's the part I actually wanted to understand: how do you hide a mark inside words without changing how they read?
Anthropic's official answer is vague — they say it's woven into the text at a pattern level, invisible to humans, detectable by a classifier. That's not very satisfying.
The most likely mechanism is statistical: watermarking schemes like the one Google published for SynthID work by subtly biasing word choice toward a specific pattern that a model can detect later. Not changing what you say — changing how it chooses between roughly equivalent words. The text reads normally to a human. A detector tuned to those statistical patterns lights up.
For files, it's more straightforward — cryptographically signed metadata, like an HMAC or digital certificate attached to the file header. It travels with the file, verifiable by anyone with the public key.
The file part makes sense. The text part is genuinely clever, and slightly unsettling.
The question nobody's asking
Here's what I'd actually want to know: does this work in reverse?
Paul Graham already joked about it, but there's a real business in building a tool that rewrites AI-watermarked text to remove the pattern while preserving the meaning. That's not even hard to imagine — you prompt another model to "rewrite this with different word choices" and the watermark classifier starts throwing uncertain results.
If watermarking creates a cat-and-mouse game, the cat-and-mouse game starts immediately. The question is whether Anthropic can stay ahead of it.
The EU AI Act may have required this, but the practical effect is probably less "AI content is now detectable" and more "there will now be an arms race."
Filed under: AI Automation, Founder Notes