Earlier this week, Anthropic announced that it would be adding watermarks to all of its AI outputs, including text, images, code and other files.
The reason for the announcement, according to the company, is to comply with the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content. The new law requires that providers of generative AI systems implement watermarks on their outputs.
However, the company is going beyond the specific requirements of the law. It is implementing the watermarks globally, across all of its products and without any ability for users to opt out. The company is also working to add such watermarks to its older models.
The move, predictably, has been met with a wave of criticism. Some worried that the watermarks would impact the quality of the AI outputs, others were concerned that the watermarks would expose their previously-hidden AI usage and some expressed concerns about human-created works being edited by AI having the watermarks added.
Due to the lack of detection tools, it is unclear whether any output is currently being watermarked. However, that hasn’t stopped several developers from creating tools that claim to be able to remove the marks from AI-generated content.
But while this is a potentially major moment for detecting AI-generated content, there are several important caveats and limitations to consider.
Ultimately, as well-intended as this law may be, it isn’t going to be the silver bullet that many are hoping for. That’s true even with Anthropic’s broad implementation of watermarks.
What Anthropic is Doing
The big takeaway is that Anthropic is implementing watermarks on all of its outputs. Though the primary focus is on future models, the company is also working to add the marks to its existing models. The watermarks will be added to all of the company’s products, including Claude, Claude Code, Claude Cowork and more.
Currently, there are no tools for detecting such watermarks outside of already-existing standards. Details on such systems are expected to be released later.
The watermarks come in two separate forms. The first and most direct is on files, in particular images. For those, Claude will watermark the files with metadata as per the Coalition for Content Provenance and Authenticity (C2PA) standard. The C2PA standard is an open standard first launched in February 2021. The current steering committee for the C2PA standard includes OpenAI, Google, Meta, Amazon and many other large tech companies.
The Content Authenticity Initiative (CAI) has a page dedicated to verifying C2PA metadata. It works on image, audio and video files of various types.
So, when it comes to outputted files, Anthropic is adopting what is essentially the industry standard for adding watermarks.
What is much more interesting is what Anthropic is doing with text. According to the company, when the model generates text, “It weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.”
In short, the watermark is in the text itself. They claim that the watermark can survive being copied and pasted, being lightly edited and generally shared. However, it will not work on heavily edited content or content that is too short.
Anthropic does not explain how the watermark is added. That said, there are multiple theories about how it works. However, the most likely explanation is that the watermark will be hidden in the model’s choice of words and the other “decisions” that the model makes as it generates the text.
It’s an interesting idea, but it’s not a new one. Watermarks for AI-generated content have been around for years. However, they haven’t really moved the needle when it comes to detecting AI-generated content. There are several good reasons for that.
The Limitations of Watermarks
The idea of watermarking AI-generated content is not new. Google, for example, has had SynthID since 2023. It’s a family of watermarking tools that mark images, audio, video and plain text, similar to what Anthropic is doing. You can already check for SynthID watermarks on files (not text) using Gemini.
Similarly, Meta has its own system, Stable Signature, for watermarking images. However, this highlights the first major limitation of watermarks, despite the C2PA’s best efforts, there is no single standard for how to do it or how to verify it. This makes checking for watermarks tedious and time-consuming.
To make matters worse, not all AI companies are using watermarks, including many popular Chinese AI companies. Many of the companies that do watermark content, don’t watermark all of it. OpenAI, for example, introduced image and audio watermarks this year, but does not add watermarks to text.
There’s also the issue of open-weight models. Such models do not typically add watermarks to their outputs. They can be run locally on a user’s device, usually for free, and there is no requirement that its outputs be watermarked.
But then there is the biggest issue of all. Searching for and finding (or not finding) a watermark is functionally meaningless.
Finding a watermark only indicates that the content passed through the model at some point. Depending on how the watermarks are implemented, it could be that the content was wholly AI-generated, that it was rewritten/paraphrased using an AI system or that it was simply edited by such a tool. Without additional information, there is no way to know.
But things get even worse when no watermark is found. That doesn’t mean that the content was not AI-generated. It could have been heavily edited, that it was passed through another AI tool to remove the watermark or that they simply used a model that doesn’t add watermarks.
Either way, more information is needed to make a final judgment.
That said, watermarking isn’t really intended to be used as a final arbiter in a high-stakes situation. It’s meant to be a machine-accessible tool that can help flag and/or block unwanted content. But the current state of watermarking doesn’t enable that. There are simply too many standards and the process is too cumbersome.
This leaves watermarking as a solution that doesn’t solve any of the problem it’s meant to address.
Bottom Line
To be clear and repeat a point I made in January, AI companies absolutely should be watermarking their outputs. It’s an incredibly small thing that contributes to minimizing harm from AI-generated content.
However, there needs to be effort made into making those watermarks more useful. This means standardizing the process, speeding up detection and including more information about how AI was used. I recognize that is a tremendous task, but if AI companies want these marks to be meaningful, that’s what they need to do.
But that’s the precise issue, AI companies don’t want these marks to be highly useful. By implementing watermarks, they can give the impression that they are addressing some of the biggest issues with AI-generated content and are complying with the new laws.
However, by keeping the process inefficient and ineffective, the addition of the watermarks has no impact on their bottom line.
But even if all the AI companies in the world came together to support fast, effective and transparent watermarking, there would still be the issue of open-weight and open-source models. As long as there is a market for it, someone will always offer non-watermarked AI models.
So, while watermarking is a positive step, it’s just that, a step and not a particularly big one. While I am glad that Anthropic is doing it, I’m not expecting this to be a game-changer in the space of AI detection.
Want to Reuse or Republish this Content?
If you want to feature this article in your site, classroom or elsewhere, just let us know! We usually grant permission within 24 hours.