Where an AI Watermark Can Hide in Plain Text

On August 11, 2026, Anthropic announced it will watermark all text and files generated by its Claude AI, with plain-text watermarks designed to survive copy and paste, but the company has not disclosed the algorithm or detection method. Security researcher Daniel argues that pure ASCII text with uniform spacing has no room for a watermark, suggesting the mark must be embedded in word choice rather than characters, a technique that could be defeated by rewriting or canonical regeneration.

On August 11, 2026, Anthropic said it would start marking everything Claude writes. Two parts. Files like PNGs and SVGs get signed provenance metadata under the C2PA standard https://c2pa.org/ . Plain text gets what they call "an imperceptible watermark woven directly into the text itself," one that survives copy and paste. Here's the catch: they didn't say how. No algorithm, no detector, no list of what the mark actually controls. So this isn't a teardown. It's a read on what they said, what it could be, and how people will get around it. The file half is simple and easy to beat. It's a signature on a container, so a screenshot or a format conversion drops it. The text half is the interesting one, and it's where Daniel pushed back. His objection: Text is text, so when you copy text, what are the possible avenues for having watermarks? If you use basic ASCII in its most primitive form with uniform spacing, which is industry standard, there is literally no possible way to have a watermark. Daniel He's right, and the reason matters. Pure 7-bit ASCII with single spaces has nowhere to hide a bit. Two people who type the same sentence produce byte-identical files. I ran Claude's own output through a codepoint scanner: zero invisible characters, uniform spacing. Whatever it's doing, it isn't in the bytes. So if a text watermark exists and survives copy and paste, it can't be in the characters. It has to be in which characters got chosen. Once you accept that, you can map every place a fingerprint could hide, from the surface down to the meaning. That's the diagram up top. Four layers, and the deeper one survives more editing. The top two are encoding and formatting: invisible characters, homoglyphs, spacing tricks. Real techniques, all fragile. They die the moment text is normalized to plain ASCII, which is Daniel's point exactly. No serious watermark lives up there. The layer that fits what Anthropic described is the third: a statistical bias in word choice. Every token is a small pick among near-equivalent options, and a secret key can tilt those picks in a pattern a reader can't see but a key-holder can measure. The public versions are green-list biasing and tournament sampling, the scheme Google already ships in Gemini. It survives copy and paste because it is the words, and it fades under editing because each change removes evidence. That's a guess, and worth saying plainly. Anthropic hasn't confirmed the layer, the algorithm, or the strength. It could reach into the fourth layer, where the signal rides meaning and partly survives paraphrase. It could be something they haven't described at all. Until the detector ships, nobody outside Anthropic can check any of this. The same layers show the exits. Two moves, from opposite ends. Canonical regeneration kills the top. You rebuild the text through a separate pass that emits pure ASCII and validates nothing else survived. Daniel's framing: Complete sanitized regeneration of the text using a separate method that produces the canonicalized ASCII-only pure text format with validation. Daniel That erases anything in the encoding or formatting, because the output has no room left to carry it. It does nothing to the words. To reach the words, you rewrite: If content itself is a risk, then there can also be a rewriting of the prose itself. Daniel Every swapped word drops a little signal, and a real paraphrase drops enough to fall below detection. Together the two cover the whole ladder. One catch. Rewrite Claude's text with a different AI and you don't erase the mark, you swap it for that model's. The only clean rewrite is a human who re-thinks the text, which was never the thing in question. Anthropic is careful about one thing, and it's the honest part. A detected mark means text was processed by Claude, not written by it. Claude proofreading your draft can pick up the same mark. And a clean result proves nothing, since short passages, edits, and older models all come back empty. So at best this is a "a machine touched this" signal. Not who wrote it, not how much. And how strong even that signal is, we won't know until they publish the detector. Primary source: Anthropic's How Claude marks AI-generated content https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content . As of publication there's no public detector and no released algorithm for the text watermark. The word-choice schemes named here are public research, not Anthropic's disclosed method: Kirchenbauer et al., "A Watermark for Large Language Models" https://arxiv.org/abs/2301.10226 2023 , and Google DeepMind's SynthID-Text in Nature https://www.nature.com/articles/s41586-024-08025-4 2024 . Which layer Claude uses is inference from the behavior Anthropic described, not confirmed. Questions or corrections? Reach Daniel at daniel@unsupervised-learning.com mailto:daniel@unsupervised-learning.com or @danielmiessler https://x.com/danielmiessler on X. 🤖 AIL 4: Daniel had the idea and shaped it in conversation the ASCII objection, the two bypasses ; I Kai Magnus, his AI assistant did the research, built the taxonomy and the diagram, and wrote it up. His quotes are from that conversation. Learn more about AIL https://danielmiessler.com/blog/ai-influence-level-ail .