{"slug": "where-an-ai-watermark-can-hide-in-plain-text", "title": "Where an AI Watermark Can Hide in Plain Text", "summary": "On August 11, 2026, Anthropic announced it will watermark all text and files generated by its Claude AI, with plain-text watermarks designed to survive copy and paste, but the company has not disclosed the algorithm or detection method. Security researcher Daniel argues that pure ASCII text with uniform spacing has no room for a watermark, suggesting the mark must be embedded in word choice rather than characters, a technique that could be defeated by rewriting or canonical regeneration.", "body_md": "On August 11, 2026, Anthropic said it would start marking everything Claude writes. Two parts. Files like PNGs and SVGs get signed provenance metadata under the [C2PA standard](https://c2pa.org/). Plain text gets what they call \"an imperceptible watermark woven directly into the text itself,\" one that survives copy and paste.\n\nHere's the catch: they didn't say how. No algorithm, no detector, no list of what the mark actually controls. So this isn't a teardown. It's a read on what they said, what it could be, and how people will get around it.\n\nThe file half is simple and easy to beat. It's a signature on a container, so a screenshot or a format conversion drops it. The text half is the interesting one, and it's where Daniel pushed back.\n\nHis objection:\n\nText is text, so when you copy text, what are the possible avenues for having watermarks? If you use basic ASCII in its most primitive form with uniform spacing, which is industry standard, there is literally no possible way to have a watermark. Daniel\n\nHe's right, and the reason matters. Pure 7-bit ASCII with single spaces has nowhere to hide a bit. Two people who type the same sentence produce byte-identical files. I ran Claude's own output through a codepoint scanner: zero invisible characters, uniform spacing. Whatever it's doing, it isn't in the bytes.\n\nSo if a text watermark exists and survives copy and paste, it can't be in the characters. It has to be in which characters got chosen.\n\nOnce you accept that, you can map every place a fingerprint could hide, from the surface down to the meaning. That's the diagram up top. Four layers, and the deeper one survives more editing.\n\nThe top two are encoding and formatting: invisible characters, homoglyphs, spacing tricks. Real techniques, all fragile. They die the moment text is normalized to plain ASCII, which is Daniel's point exactly. No serious watermark lives up there.\n\nThe layer that fits what Anthropic described is the third: a statistical bias in word choice. Every token is a small pick among near-equivalent options, and a secret key can tilt those picks in a pattern a reader can't see but a key-holder can measure. The public versions are green-list biasing and tournament sampling, the scheme Google already ships in Gemini. It survives copy and paste because it *is* the words, and it fades under editing because each change removes evidence.\n\nThat's a guess, and worth saying plainly. Anthropic hasn't confirmed the layer, the algorithm, or the strength. It could reach into the fourth layer, where the signal rides meaning and partly survives paraphrase. It could be something they haven't described at all. Until the detector ships, nobody outside Anthropic can check any of this.\n\nThe same layers show the exits. Two moves, from opposite ends.\n\nCanonical regeneration kills the top. You rebuild the text through a separate pass that emits pure ASCII and validates nothing else survived. Daniel's framing:\n\nComplete sanitized regeneration of the text using a separate method that produces the canonicalized ASCII-only pure text format with validation. Daniel\n\nThat erases anything in the encoding or formatting, because the output has no room left to carry it. It does nothing to the words.\n\nTo reach the words, you rewrite:\n\nIf content itself is a risk, then there can also be a rewriting of the prose itself. Daniel\n\nEvery swapped word drops a little signal, and a real paraphrase drops enough to fall below detection. Together the two cover the whole ladder.\n\nOne catch. Rewrite Claude's text with a different AI and you don't erase the mark, you swap it for that model's. The only clean rewrite is a human who re-thinks the text, which was never the thing in question.\n\nAnthropic is careful about one thing, and it's the honest part. A detected mark means text was *processed* by Claude, not written by it. Claude proofreading your draft can pick up the same mark. And a clean result proves nothing, since short passages, edits, and older models all come back empty.\n\nSo at best this is a \"a machine touched this\" signal. Not who wrote it, not how much. And how strong even that signal is, we won't know until they publish the detector.\n\nPrimary source: Anthropic's [How Claude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content). As of publication there's no public detector and no released algorithm for the text watermark.\n\nThe word-choice schemes named here are public research, not Anthropic's disclosed method: Kirchenbauer et al., [\"A Watermark for Large Language Models\"](https://arxiv.org/abs/2301.10226) (2023), and Google DeepMind's SynthID-Text in [Nature](https://www.nature.com/articles/s41586-024-08025-4) (2024). Which layer Claude uses is inference from the behavior Anthropic described, not confirmed.\n\nQuestions or corrections? Reach Daniel at [daniel@unsupervised-learning.com](mailto:daniel@unsupervised-learning.com) or [@danielmiessler](https://x.com/danielmiessler) on X.\n\n🤖 **AIL 4:** Daniel had the idea and shaped it in conversation (the ASCII objection, the two bypasses); I (Kai Magnus, his AI assistant) did the research, built the taxonomy and the diagram, and wrote it up. His quotes are from that conversation. [Learn more about AIL](https://danielmiessler.com/blog/ai-influence-level-ail).", "url": "https://wpnews.pro/news/where-an-ai-watermark-can-hide-in-plain-text", "canonical_source": "https://danielmiessler.com/blog/where-watermarks-hide-in-text?utm_source=rss&utm_medium=feed&utm_campaign=website", "published_at": "2026-08-11 16:30:00+00:00", "updated_at": "2026-08-11 18:12:05.524482+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-policy", "ai-safety"], "entities": ["Anthropic", "Claude", "Daniel", "Google", "Gemini", "C2PA"], "alternates": {"html": "https://wpnews.pro/news/where-an-ai-watermark-can-hide-in-plain-text", "markdown": "https://wpnews.pro/news/where-an-ai-watermark-can-hide-in-plain-text.md", "text": "https://wpnews.pro/news/where-an-ai-watermark-can-hide-in-plain-text.txt", "jsonld": "https://wpnews.pro/news/where-an-ai-watermark-can-hide-in-plain-text.jsonld"}}