The Signature You Didn't Sign

Executive Summary

On August 11, 2026, Anthropic published a support page describing how Claude will mark AI-generated content going forward. Text and code produced by new Claude models will carry an invisible watermark -- an imperceptible statistical signal embedded in the words themselves, designed to survive copy and paste. Generated files will carry signed provenance metadata under the C2PA standard, the same framework already used to label AI-generated images and video across the industry. Models shipping after August 2 have the machinery built in. Older models will be retrofitted. Anthropic plans to release its own detection tools, and the marking applies worldwide -- not just in the European Union whose AI Act transparency rules prompted it.

Anthropic is careful about one detail that most of the coverage glossed over: the mark indicates content was 'processed by Claude,' not necessarily authored by it. Paste your own essay into Claude and ask it to fix two comma splices, and the text that comes back may carry the same invisible signature as text Claude wrote from nothing.

This paper is not an argument against provenance. Provenance is a legitimate and increasingly necessary response to a web filling with synthetic content. It is an argument about a narrower question that the watermarking debate keeps skipping: who holds the pen, and who holds the detector. When a third party embeds an invisible signal in your work product and retains the only reliable tool for reading it, your relationship to your own words has changed -- whether or not you ever notice the mark.

1. What Anthropic Announced

1.1 Two Marks for Two Kinds of Output

The support page, titled 'How Claude marks AI-generated content,' describes two separate mechanisms.

For text and code, new Claude models embed an imperceptible signal directly into the generated tokens. You cannot see it. A reader cannot see it. It does not live in metadata, headers, or formatting -- it lives in the statistical texture of the word choices themselves, which is why it survives being copied out of the Claude interface and pasted into your email client, your document, or your codebase.

For files, Claude attaches signed provenance metadata under the C2PA standard -- the Coalition for Content Provenance and Authenticity framework backed by Adobe, Microsoft, Google, and camera manufacturers. C2PA is already the industry default for marking AI-generated images and video. Extending it to generated documents and other file outputs brings Claude's file handling under the same umbrella.

1.2 The Timeline

The forcing function is the EU AI Act. Article 50 requires providers of generative AI systems to ensure their outputs are marked in a machine-readable format and detectable as artificially generated. The transparency obligations for general-purpose AI took effect on August 2, 2026.

Models released after August 2 carry the watermarking machinery natively. Models released before that date -- the models most users are running today -- will be retrofitted. Anthropic has also said it will release detection tools, so that third parties can check whether a piece of content carries a Claude mark.

1.3 Worldwide by Default

Anthropic is not geofencing compliance. The marks apply to every user, everywhere. This is the Brussels effect in its purest form: it is cheaper and simpler to apply one regulatory regime globally than to maintain a marked Europe and an unmarked everywhere-else. OpenAI, Google, and Meta signed the same code of practice and face the same obligations. The notable holdout is xAI, which signed only the safety and security chapter and declined the transparency commitments.

The practical consequence: a freelancer in Ohio, a law firm in Singapore, and a student in Nairobi will all produce watermarked text because of a rule negotiated in Brussels. Whatever you think of the rule, you did not get a vote, and you do not get a toggle.

2. How an Invisible Text Watermark Works

2.1 A Thumb on the Sampler

Anthropic has not published its technical scheme. But the deployed state of the art in text watermarking is well understood, and it almost certainly looks like this.

When a language model generates text, it does not pick each next word deterministically -- it samples from a probability distribution. A watermark puts a gentle thumb on that scale. At each step, a pseudorandom function -- keyed to the preceding context -- partitions the vocabulary into favored and unfavored tokens, and the sampler nudges probability toward the favored set. Any individual word choice looks completely normal. But across a few hundred words, the skew toward favored tokens becomes statistically unmistakable to a detector that knows the key -- and invisible to everyone who does not.

Google DeepMind has run exactly this kind of scheme, SynthID-Text, inside Gemini since 2024, and open-sourced it. Tens of millions of people have read watermarked text without ever noticing. That is the point: the mark costs almost nothing in quality, survives copy-paste perfectly, and cannot be seen -- only detected.

2.2 What the Mark Survives -- and What It Does Not

Statistical watermarks are robust to the things ordinary users do and fragile to the things determined actors do.

Read that table carefully, because it defines what the system can and cannot claim. The mark is excellent at catching exactly one scenario: substantial, lightly-edited model output moved from one place to another. It is poor at catching adversaries, who will paraphrase, translate, or launder text through an unwatermarked model. Detection-tool absence therefore proves nothing. And as we will see, presence proves less than most people will assume.

2.3 The Watermarker OpenAI Built and Shelved

None of this is new technology. In 2024, reporting revealed that OpenAI had a text watermarking system ready for roughly a year -- internally assessed as highly accurate on long outputs -- and chose not to ship it. Surveyed users said they would use ChatGPT less if its output were detectable. There were also internal concerns about false accusations, particularly against non-native English speakers who lean on AI for polish and would be disproportionately flagged.

That episode is the honest preview of the era Anthropic is now entering, this time with regulation removing the choice. The commercial incentive not to mark, the user incentive not to be marked, and the social cost of misreading the mark did not go away. They were overruled.

3. 'Processed by Claude' Is Not 'Written by Claude'

3.1 The Conflation at the Heart of the Mark

Here is the sentence in Anthropic's announcement that deserves the most attention: the mark indicates content was processed by Claude -- not necessarily fully authored by it.

A model-level watermark is applied where text is generated, and generation is how a language model does everything -- including 'editing.' When Claude proofreads your essay, it does not patch two characters in place; it regenerates the text with your errors corrected. The output is model output. If the sampler carries a watermark, your essay now carries it too. Your ideas, your structure, your voice, your six drafts -- and an invisible signature that says a machine was here.

3.2 The Regulation Knows the Difference. The Watermark Does Not.

The irony is that the EU AI Act itself draws exactly this distinction. Article 50's marking obligation contains a carve-out for AI that performs 'an assistive function for standard editing' or that does not substantially alter the meaning of the input. The regulators understood that spell-checking a human's document is not the same act as generating a document.

But a watermark embedded at the model level -- in the sampler, below every product surface -- has no way to honor that distinction. The sampler does not know whether the tokens it is emitting represent Claude's argument or a faithful reconstruction of yours. It marks everything it touches. The subtlety the law managed to encode, the mechanism erases.

3.3 Who Gets Misread

Now put the detector in the wild. Anthropic releasing detection tools means employers, editors, professors, and courts can check text for a Claude signature. The tool will return 'Claude mark detected.' It will not return 'but the ideas were the student's, the model only fixed the grammar.'

The people most exposed are the people using AI most legitimately: the non-native speaker who drafts in their own words and asks for polish. The junior analyst whose firm mandates an AI review pass. The novelist who runs dialogue through a consistency check. Every one of them produces marked text indistinguishable -- to the detector -- from text the model wrote wholesale. The watermark reduces a spectrum of collaboration to a binary, and every reader of the detector's output will round the binary up.

4. The Detection Asymmetry

4.1 They Can Check. You Cannot.

The watermark key is a secret. It has to be -- publish it and adversaries strip the mark trivially. Which means reliable detection is a service the provider grants, on the provider's terms.

Consider what you, the user, can now no longer independently know. You cannot verify whether a given paragraph of your own document carries a mark. You cannot verify what the retrofit added to the model you have been using since spring. You cannot verify who is granted detection access -- your employer? Your government? A plagiarism-detection vendor with an API contract? Every answer lives on the other side of a wall you cannot see through.

We wrote in 'We Can't Check' about the gap between a provider saying auditing is impossible and a provider preferring not to look. Watermarking creates the mirror image: a provider for whom checking is trivially possible, and a user for whom it is impossible. The transparency the EU purchased flows in one direction -- toward institutions, away from individuals.

4.2 What a Mark Actually Proves

A signal whose absence proves nothing and whose presence proves only 'processed' is a weak instrument for its stated purpose -- catching deception -- and a strong instrument for an unstated one: ambient, asymmetric knowledge about how hundreds of millions of people produce their work.

5. The Retrofit Is the Tell

Buried in the announcement is the detail with the largest architectural implication: older models will be retrofitted to include the marking.

Sit with that. A model you have been using for a year -- whose behavior you have calibrated to, whose outputs flow through your contracts and your codebase -- will start embedding a signal it did not embed yesterday. No action on your part. No version pin available. The model is a service, the service changed, and your only notification was a support page.

This is the same lesson the industry learned in June, when a regulatory dispute took a frontier model offline for nineteen days and professionals discovered their workflows had a single point of failure they did not control. We documented that episode in The Day the Model Disappeared, and the general principle in Open Source as Insurance: capability that lives on someone else's infrastructure is capability that can be modified, restricted, or revoked without your consent.

A cloud model can be retrofitted. A model running on your own hardware cannot. The weights you downloaded last month are byte-for-byte the weights you run today -- inspectable, pinnable, and incapable of acquiring new behavior by fiat. Watermarking did not create this asymmetry. It is simply the first time the asymmetry will be embedded, invisibly, in every paragraph the cloud returns to you.

6. What This Means at the Desktop

6.1 Kent's Position

Kent connects to six AI providers -- Anthropic, OpenAI, Gemini, HuggingFace, and DeepSeek in the cloud, and Ollama locally. So let us be precise about what this change means for Kent users, because honesty about our own stack is the only credential worth having.

When you run a Kent skill in cloud mode against a new Claude model, the text that comes back will carry Anthropic's watermark. The marking happens at the model level, inside Anthropic's infrastructure -- it does not matter that the request came from Kent, from Claude's own apps, or from anyone's API integration. Kent does not strip provider marks, and will not. Stripping a provenance signal a provider deliberately embedded is not a feature we will ever ship; disclosure obligations belong to the humans doing the disclosing, and evading them is not a use case.

What Kent gives you instead is the thing the watermark era quietly makes valuable: the choice happens before the request is sent.

6.2 Provider Choice Is Now Provenance Choice

We argued in Fire Your AI that professionals should rotate providers on quality, cost, and fit -- that loyalty to any single model is a liability. As of this month, there is a new column in that comparison table. Providers now differ not just in reasoning quality and price per token, but in what they embed in your output and who they let detect it. OpenAI, Google, and Meta are bound by the same EU transparency code; their implementations, detection policies, and retrofit schedules will differ. Those differences are now selection criteria, and a multi-provider tool is the only place you can act on them per task, per document, per sensitivity level.

And then there is the option that predates the whole question.

6.3 The Local Path

In Kent's private mode, inference runs on your own machine through Ollama. No request leaves your hardware -- private mode makes zero outbound network calls by design. There is no provider in the loop to embed a signal, no key ceremony, no retrofit that can arrive overnight, no detection service with a customer list you cannot see. The model is a file on your disk. Your output's provenance record is the one Kent keeps for you: a local, queryable history on your own SSD, readable by exactly one party -- you.

This is not evasion. A local model is not an unmarked cloud model; it is a different relationship to the tool entirely, one in which provenance flows to the person doing the work instead of to the infrastructure. For a lawyer whose drafts are privileged, a founder whose strategy documents are confidential, or anyone who simply declines to have an invisible third-party signature woven through their sentences, that relationship is the product.

The post-August 2 world sorts AI into two architectures: one where your words carry a signature you did not sign, and one where the only marks in your work are yours.

Conclusion

The EU wanted machine-readable honesty, and the demand is not unreasonable: a web drowning in synthetic content needs provenance infrastructure, and C2PA and statistical watermarking are serious attempts at building it. Anthropic, to its credit, implemented the rule globally and said out loud what the mark does and does not mean.

But the implementation has a shape, and the shape matters. The mark cannot tell authorship from assistance, though the law it implements can. The detector lives with the provider, not with you. And the retrofit clause is a reminder written in fine print: a cloud model is not a tool you have, it is a service you are granted, on terms that change while you sleep.

Provenance is coming to everything. The only open question is the one this paper started with -- who holds the pen, and who holds the detector. For the cloud, the answer is now settled, and it is not you. On your own hardware, with your own models and your own history, both answers are still yours. That is not nostalgia for an unmarked internet. It is the oldest professional instinct there is: know what your tools put into your work.

Kent Research, August 2026. Kent runs 13 built-in skills and unlimited custom skills against six AI providers, cloud or fully local. In private mode, inference runs on your hardware and nothing leaves your machine. mykent.app