You've probably heard Anthropic started watermarking Claude's text output on August 2, 2026, weaving an invisible mark into generated text and attaching signed provenance metadata to supported files. The move follows Anthropic signing the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, which pushes providers toward making AI output machine detectable. Google got there first. Its SynthID system has been marking Imagen, Veo, Gemini, and audio output since 2023, and Google reported more than 10 billion pieces of content watermarked by May 2026. Anthropic's move gives a useful reason to look at how Google's SynthID method works and compare it to what Anthropic is doing.
Older systems tagged AI content with a label in the file's metadata. That never held up. Anyone could strip a label with a screenshot or by copying text into a new document. SynthID takes a different approach. It builds the mark into the content itself while the AI creates it.
For images, SynthID (used by Google Gemini) makes tiny changes to colors across the whole picture, changes too small for a person to notice. Those changes are spread out rather than placed in one corner, so cropping or compressing the image does not erase them.
For text, SynthID works differently, because there are no pixels to adjust. Every time the AI chooses the next word in a sentence, it usually has several reasonable options. SynthID tips that choice slightly, using a token sampling method that favors certain words over others in a pattern only its own detector can recognize. Read the sentence and it looks completely normal. The pattern lives in the pattern of word choices, not in any single word.
 |
| SynthID embeds the mark during generation. Detection returns a confidence score, not a yes or no. |
Anthropic's Claude approach runs on a separate track entirely. When a supported Claude model writes a response, it weaves its own imperceptible watermark directly into the text as it generates. Anthropic says the mark does not change the meaning, quality, or readability of the response, and because it lives in the text itself rather than in a metadata tag, it travels along when the text is copied and pasted and may survive some editing. For files such as SVG, PNG, and JPG, Claude attaches signed C2PA provenance metadata instead, a different mechanism built for a different job. C2PA metadata is cryptographically signed and publicly verifiable, so anyone with the right tool can check it. A text watermark is statistical rather than signed, so checking it requires Anthropic's own detector, which the company has said it will publish along with technical documentation. Neither mark proves who wrote the underlying ideas. A watermark can appear on text that a person wrote and then ran through Claude for editing or translation, and its absence does not prove a human wrote something either.
 |
| SynthID and Claude's watermark work on the same principle. Neither system reads the other's mark. |
A detector, trained alongside the system that creates the marks, scans content and reports how confident it is that SynthID is present, rather than a flat yes or no. That detector only works on content made by a model that has SynthID built in. It cannot identify AI content from a system that never used it, and heavy editing or rewriting can weaken the mark enough to make it hard to detect.
Access to that detector differs by content type and by company. Google open sourced the SynthID text detector through Hugging Face and GitHub, so any developer can run it against their own text. Image and video detection stays inside Google's own products, through tools like the Gemini app and Search. Anthropic has not published a Claude detector yet. The company has said it plans to release one along with technical documentation, but until that happens, checking a piece of text for Claude's watermark means trusting Anthropic's own tools rather than an independent one. SynthID's open text detector and Claude's still unpublished one sit at opposite ends of that spectrum, even though both watermarks work on the same basic principle.
My Stake In This - I've written here for almost 22 years and published five books along the way. Watermarking protects what a model outputs. It does nothing for what went into training it. I am confident that a good amount of my own writing sits somewhere in the data these companies trained on, unlabeled and uncredited, collected long before anyone built a watermark to mark the difference between a machine's words and mine.
Ten billion watermarked items sounds like a lot. It still only covers one company's models. Anthropic uses its own watermark for Claude rather than SynthID, and Apple's Image Playground has its own approach too. The EU AI Act is pushing every major provider toward some version of this, but each one is building a separate system with a separate detector.
No comments:
Post a Comment