The Futility of AI Watermarking in Text and Code

The Regulatory Push for Transparency

The European Union's AI Act mandates that providers of generative AI systems must ensure outputs are marked in a machine-readable format to distinguish AI-generated content from human work. Anthropic has committed to complying with these requirements for all Claude models by August 2026. The implementation involves two primary methods: embedded watermarks within text and digitally signed provenance metadata (using the C2PA standard) for files like images and SVGs. The goal is to provide a signal of origin, though the company explicitly acknowledges that these markers are not conclusive proof of authorship.

The Technical Limits of Steganography

Watermarking media is relatively straightforward because images and video contain high-entropy data where subtle, imperceptible changes to pixel values can encode information. However, text is already highly compressed; every character carries semantic weight. Embedding a watermark in text requires a form of steganography where the model must balance generating high-quality responses with the constraint of encoding a hidden signal. This consumes model reasoning capacity and risks degrading output quality. Unlike images, where one can hide data in noise, text offers very little 'slack' for hidden patterns without becoming noticeable to a human reader.

The Fragility of AI Signals

These watermarks are designed to catch low-effort users—those who copy-paste directly from an LLM. However, the signals are trivial to destroy. For images, simple operations like resizing, re-exporting as a different file format (e.g., PNG to JPEG), or applying a minor sharpening filter destroy the underlying noise patterns used by tools like Google’s SynthID. For text, the watermark is even more vulnerable. Any significant paraphrasing, translation, or even basic grammatical editing effectively strips the embedded signal. Because the watermark must persist through 'some editing' to be useful, it faces a constant trade-off between being robust enough to survive and being subtle enough to remain invisible.

The Reality of Detection

Ultimately, these watermarking efforts are a cat-and-mouse game that favors the editor. If a user puts any effort into modifying the output, the watermark becomes unreliable. Anthropic’s own documentation admits that a lack of a detected mark does not prove content is human-made, and the presence of a mark does not prove the AI was the primary author (as it could have been used for minor proofreading). The industry is moving toward these standards to satisfy legal obligations, but they are unlikely to solve the broader societal problem of distinguishing AI-generated 'slop' from human-authored content.