Where an AI Watermark Can Hide in Plain Text

On August 11, 2026, Anthropic said it would start marking everything Claude writes. Two parts. Files like PNGs and SVGs get signed provenance metadata under the C2PA standard. Plain text gets what they call "an imperceptible watermark woven directly into the text itself," one that survives copy and paste.

Here's the catch: they didn't say how. No algorithm, no detector, no list of what the mark actually controls. So this isn't a teardown. It's a read on what they said, what it could be, and how people will get around it.

The file half is simple and easy to beat. It's a signature on a container, so a screenshot or a format conversion drops it. The text half is the interesting one, and it's where Daniel pushed back.

the part that shouldn't be possible ​

His objection:

Text is text, so when you copy text, what are the possible avenues for having watermarks? If you use basic ASCII in its most primitive form with uniform spacing, which is industry standard, there is literally no possible way to have a watermark. Daniel

He's right, and the reason matters. Pure 7-bit ASCII with single spaces has nowhere to hide a bit. Two people who type the same sentence produce byte-identical files. I ran Claude's own output through a codepoint scanner: zero invisible characters, uniform spacing. Whatever it's doing, it isn't in the bytes.

So if a text watermark exists and survives copy and paste, it can't be in the characters. It has to be in which characters got chosen.

so what could it be ​

Once you accept that, you can map every place a fingerprint could hide, from the surface down to the meaning. That's the diagram up top. Four layers, and the deeper one survives more editing.

The top two are encoding and formatting: invisible characters, homoglyphs, spacing tricks. Real techniques, all fragile. They die the moment text is normalized to plain ASCII, which is Daniel's point exactly. No serious watermark lives up there.

The layer that fits what Anthropic described is the third: a statistical bias in word choice. Every token is a small pick among near-equivalent options, and a secret key can tilt those picks in a pattern a reader can't see but a key-holder can measure. The public versions are green-list biasing and tournament sampling, the scheme Google already ships in Gemini. It survives copy and paste because it is the words, and it fades under editing because each change removes evidence.

That's a guess, and worth saying plainly. Anthropic hasn't confirmed the layer, the algorithm, or the strength. It could reach into the fourth layer, where the signal rides meaning and partly survives paraphrase. It could be something they haven't described at all. Until the detector ships, nobody outside Anthropic can check any of this.

how you'd get around it ​

The same layers show the exits. Two moves, from opposite ends.

Canonical regeneration kills the top. You rebuild the text through a separate pass that emits pure ASCII and validates nothing else survived. Daniel's framing:

Complete sanitized regeneration of the text using a separate method that produces the canonicalized ASCII-only pure text format with validation. Daniel

That erases anything in the encoding or formatting, because the output has no room left to carry it. It does nothing to the words.

To reach the words, you rewrite:

If content itself is a risk, then there can also be a rewriting of the prose itself. Daniel

Every swapped word drops a little signal, and a real paraphrase drops enough to fall below detection. Together the two cover the whole ladder.

One catch. Rewrite Claude's text with a different AI and you don't erase the mark, you swap it for that model's. The only clean rewrite is a human who re-thinks the text, which was never the thing in question.

what it would actually prove ​

Anthropic is careful about one thing, and it's the honest part. A detected mark means text was processed by Claude, not written by it. Claude proofreading your draft can pick up the same mark. And a clean result proves nothing, since short passages, edits, and older models all come back empty.

So at best this is a "a machine touched this" signal. Not who wrote it, not how much. And how strong even that signal is, we won't know until they publish the detector.