AI Watermarks Don’t Answer the Question

Spend ten minutes on Reddit or X and you'll find developers convinced their code is about to be tagged and students convinced their own papers will be flagged because they used Claude to fix the grammar. Tom's Guide ran a headline saying every word Claude writes now carries a hidden watermark (Caswell, 2026). None of this is true.

Anthropic (2026) published an article this week explaining how watermarking will work in Claude's output. Future Claude models will mark their own text. Other providers signed the same agreement and are building their own versions. All of it traces back to the EU, which now requires that AI-generated content be marked (European Commission, 2026a, 2026b).

I teach IT courses and I read a lot of student writing, so my first question was the obvious one. Does this mean I can finally tell?

The short answer is no. The longer answer is more interesting than the short one, so bear with me.

How it works

Let's start with how the model writes. It picks one word at a time, and at each step it has a list of candidates to choose from. Often several of the candidates would read just fine, such as "Mary went to the store" or "Mary went to the shop." Nothing about the sentence changes with this choice between "store" and "shop," and normally this is determined by a random number.

Watermarking swaps out the source of that randomness. Instead of an arbitrary number, the model uses a secret key combined with the words that came just before. The choice is still effectively random — you couldn't predict it, and the model isn't being pushed toward weird vocabulary. But it's now random in a specific, reproducible way. Someone holding the key can go back over the text and check whether the word choices line up with what the key would have produced.

If you've ever written any Python, you've already seen this. Call random.seed(42) and you get a sequence of numbers that passes every test for randomness you can throw at it. Run it again with the same 42 and you get the identical sequence. The numbers are no less random for that. They're just reproducible if you know the seed.

Nothing gets added to the text. There are no hidden characters or invisible Unicode, and there's no log at Anthropic recording what got picked. It's math run after the fact against a secret.

Two things follow from that. The first is that it only works in bulk. Each individual word choice tells you almost nothing. You need a few hundred of them before the pattern separates from coincidence (Dathathri et al., 2024). A student's two-paragraph Discussion Board post probably wouldn't register at all. Not a low percentage — nothing usable. This isn't TurnItIn, where the number tells you what portion of the document matched something. Detection tells you how confident it is that Claude wrote any of it.

On the other hand, a five-page paper would give it something to work with. A five-page, double-spaced paper is about 1,250 words. Quoted material, the reference list, headings, and citations aren't generated prose, so none of that carries a watermark. Call it 1,100 words, give or take.

And only a fraction of those 1,100 words will represent a real choice among several plausible options. Most of the time the sentence is already most of the way to deciding the next word for itself. In short, there's just not a lot of room here for watermarking.

The second thing that follows is that programming code is even weaker with this. The watermark needs real choices to work with, and code usually has to be exact. Once you've written 2 + 2 =, there's no decision left. Anthropic (2026) says the mark can live in comments, where the wording is arbitrary. By their own account that has a negligible effect on the code itself.

Why it doesn't help me

Even when it works, it won't really tell us much. A positive result means Claude was probably involved somewhere in the document. That's it. It can't tell you whether Claude wrote the whole thing, or just cleaned up the grammar on something the student wrote themselves. Those two cases sit at opposite ends of my academic integrity policy, and the watermark treats them identically.

A negative result means nothing at all. Not "a human wrote this." Just no signal. That could mean the student wrote it. It could mean they used ChatGPT or Gemini, which have their own keys that Anthropic's detector can't read. It could mean they used a local model on their own machine. It could mean they had Claude write it and then rewrote enough of it to wash the signal out.

So of the two possible outcomes, one is ambiguous and the other is empty.

Which brings us back to the student in my opening. Anthropic (2026) says a proofreading pass gives the watermark only the handful of corrections to attach to, often too few to register. And the Commission's own guidelines say the marking obligation doesn't apply when the system is performing an assistive function for standard editing (European Commission, 2026b). So that student is fine twice over. The worry going around is aimed at the one case this thing was built not to catch.

The part I keep thinking about

None of this makes the key unimportant. Weak evidence still gets acted on. A number on a report is easier to act on than a judgment call, and that pull doesn't go away just because the number is thin. A signal doesn't have to prove much to be worth forging, as long as people believe it.

Anthropic (2026) says a detection API is coming. They haven't worked out the details. An interesting aspect of this is that the same key both writes the watermark and reads it. That's not how a digital signature works — there, a private key signs and a public key verifies, so anyone can check a signature but only one party can produce one. With watermarking there's one secret doing both jobs. So anyone holding that key can do three things: detect Claude's text, strip the watermark cleanly, and forge it onto text Claude never touched.

Nobody's talking about that yet, but they will. A leaked key doesn't just let people evade detection, it lets someone run human writing through a tool and make it come back positive. Yikes.

Anthropic's answer seems to be: never hand out the key. Build a detection service, keep the secret in house, give people a score. That's the right call, but it also means the whole system depends on one company's key management. Their article says nothing — not one word — about custody, rotation, or what happens if it gets out. They've surely thought about it. They just haven't said, and this was the place to.

And it absolutely IS going to be asked-for. Regulators will want it. Courts will want it (legal discovery is a powerful thing). Some jurisdiction will decide that verification of AI content shouldn't route through an American company and will require a domestic copy. Every additional holder is another way it walks out the door. A single key has to be widely held to be useful and narrowly held to work, and I don't see how both of those happen.

The EU part

The requirement itself is defensible. Before this, the only tool available was detection software that guesses from phrasing — the kind that flags "delve" and dings non-native English speakers for writing in a register that doesn't sound casual enough. A watermark is at least grounded in something real. Weak evidence, but honest weak evidence.

The implementation is where it gets silly. A hundred and ninety signatories (European Commission, 2026a), each marking their own output with their own key, each presumably running their own detector. There's no combined check for whether any AI was involved. If you want to know, you ask every vendor separately and hope they all answer. Anthropic is also applying it globally, because they don't have a good way to scope it to Europe yet, which means a rule written in Brussels is landing on papers in Broward County.

One more piece worth noting, since I raised local models earlier. The EU didn't overlook them. The AI Act does contain an open-source exemption, in Article 2(12). Article 50 is explicitly carved out of it (Linux Foundation Europe, 2025). Free and open-source systems are covered.

Covered, but not reached. The obligation lands on whoever places the system on the market. Someone who downloads weights and runs them on their own machine isn't a provider of anything. The Code of Practice tries to handle this by asking model developers to build the marking in before release and to prevent its removal through terms of use, which is not a serious obstacle to a person who already has the files. Once the weights are out, there's nobody left to obligate.

So the rule covers the case where the watermark matters most. It just can't do anything about it.

I'd have written it differently. So would anyone who's worked in IT security. Nobody asked.

There's a second half to this, about how badly the press coverage has gone. I'll post about that soon.

---

References

Anthropic. (2026, August 14). How Claude's text watermark works. https://www.anthropic.com/news/claude-text-watermark

Caswell, A. (2026, August 13). Claude is now watermarking every response — here's what that means if you use AI for writing. Tom's Guide. https://www.tomsguide.com/ai/claude/claude-is-watermarking-every-response-heres-what-that-means-if-you-use-ai-for-writing

Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J., Bachani, V., Kaskasoli, A., Stanforth, R., Matejovicova, T., Hayes, J., Vyas, N., Merey, M. A., Brown-Cohen, J., Bunel, R., Balle, B., Kohli, P., & Cemgil, T. (2024). Scalable watermarking for identifying large language model outputs. Nature, 634, 818–823. https://www.nature.com/articles/s41586-024-08025-4

European Commission. (2026a, July). Strong backing for the Code of Practice on Transparency of AI-Generated Content. https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content

European Commission. (2026b). Transparency obligations under Article 50 of the AI Act. https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act

Linux Foundation Europe. (2025, July 15). What open source developers need to know about the EU AI Act. https://linuxfoundation.eu/newsroom/ai-act-explainer