Anthropic、Claude のテキストに不可視透かしを埋め込む手法と除去法を公開

Anthropic won't say how its text watermark works, so here's where it hides and how to strip it

August 11, 2026

168 reading now

On August 11, 2026, Anthropic said it would start marking everything Claude produces. For images and other files, it attaches signed provenance metadata using the C2PA standard. For plain text, it adds what the company calls an imperceptible watermark, one that stays in the writing even after you copy and paste it somewhere else.

The announcement never says how the text version works. Anthropic published no algorithm and no detector, and it didn't describe what the watermark keys on. Everything I work out below is a reconstruction from the little the company has said and from how schemes like this usually behave.

The file version is straightforward. A C2PA manifest is a signature bolted onto the file, and it comes off as soon as someone screenshots the image or converts it to another format. The text version is the one Daniel didn't think could exist.

daniel's objection ​

Text is text, so when you copy text, what are the possible avenues for having watermarks? If you use basic ASCII in its most primitive form with uniform spacing, which is industry standard, there is literally no possible way to have a watermark. Daniel

He's right about plain ASCII. A file that holds nothing but 7-bit characters and single spaces has no spare room to encode anything, and two people who type the same sentence end up with identical files, byte for byte. I checked Claude's own output with a script that reads every character's code point, and found nothing hidden in it: the code points were all ordinary printable ASCII, with no zero-width characters and no unusual spacing.

The objection assumes a watermark has to be stored in the bytes, but it can just as easily be stored in the model's choice of which word to write next.

The text can be perfectly ordinary at the byte level and still carry a signal, because the signal is in the words the model chose.

where it can hide ​

Every sentence a model writes is a chain of choices. At each step several words would work, and the model commits to one. Those commitments are where a watermark can be planted, and they sort by how deep in the text they sit. The four layers in the diagram run from the raw bytes at the surface down to the meaning underneath. Marks in the deeper layers are harder to remove.

The top two layers are the ones Daniel had in mind. You can bury bits in the encoding, using zero-width characters or letters from other alphabets that look identical to ours, or in the formatting, like where the lines happen to wrap. All of it disappears as soon as the text is forced back to plain ASCII, which is why real watermarking schemes don't use these layers.

The layer that fits Anthropic's description is the third one, word choice. You give the model a secret key, and at each step it leans slightly toward the words that key favors. To an ordinary reader the text looks normal, but anyone with the key can measure that lean statistically and show it's present. Because the signal is carried by the words themselves, it survives copying and pasting, and because editing replaces words, it weakens as the text is changed. Kirchenbauer's green-list method and the tournament sampling Google uses in Gemini are two published ways to do this.

All of this is inference. Anthropic hasn't said which layer it used, what the algorithm is, or how strong the mark is, so the real scheme could sit deeper still, down in the fourth layer where the signal lives in meaning and can survive a light paraphrase. It could also be something nobody has described publicly. Without a detector to run, no one outside the company can tell.

how to strip it ​

The same map shows how to remove the mark, using two methods that work on opposite ends of the stack.

The first rebuilds the text through a clean, deterministic pass that emits pure ASCII and then verifies nothing else survived. Daniel described it like this:

Complete sanitized regeneration of the text using a separate method that produces the canonicalized ASCII-only pure text format with validation. Daniel

Once the output is plain ASCII with normalized spacing, anything hidden in the encoding or the formatting is gone, because the format no longer has room to hold it. The words, though, are unchanged.

Reaching the words takes a rewrite:

If content itself is a risk, then there can also be a rewriting of the prose itself. Daniel

Each word you swap removes a little of the statistical signal, and a thorough paraphrase removes enough that a detector can't find what's left. Running both passes covers the whole stack.

The rewriting method has a catch when another AI does it: the result swaps Claude's watermark for that model's, rather than clearing it. A rewrite that leaves nothing behind has to come from a person actually rethinking the text, and that case was invisible to this kind of detection from the start.

what it proves ​

Anthropic is careful about one point that's easy to overstate. A detected mark means the text was processed by Claude at some stage; it does not mean Claude wrote it. If you paste your own paragraph in and ask Claude to fix the grammar, the output can come back marked. And when there's no mark, that settles nothing either, because short passages, edited text, and output from older models all come back clean.

So the strongest claim the watermark supports is that a machine touched the words at some point. It can't say who wrote them or how much of the work was the machine's, and even that claim depends on a detector no one outside Anthropic has seen.

For roughly 29.8079 years I've written here, ad-free—3,084 essays and tutorials and counting. If it's useful to you, a monthly or one-time donation keeps it going. 🫶🏼