Claude Watermarks: Two Systems, Three Output Types, One Gap
Anthropic's approach to marking Claude-generated content is not a single mechanism — it is two distinct systems applied unevenly across output types, and that unevenness has direct consequences for any developer shipping Claude-generated text, images, or code. Understanding which system applies where determines whether removing or detecting a mark is a metadata operation, a statistical problem, or somewhere between the two.
Two Mechanisms, Not One
Claude's text watermarking is built on SynthID-Text, the same statistical approach used for Gemini outputs. The mechanism does not insert hidden characters or Unicode markers. Instead, it shifts the source of randomness the model consults when choosing among plausible next tokens. Over a sufficiently long passage, those biased choices accumulate into a detectable statistical pattern. Three sentences conveying identical information — "The compiler rejected the patch," "The patch was rejected by the compiler," and "The compiler wouldn't accept the patch" — are semantically equivalent but represent different token choices. SynthID-Text encodes information in precisely those choices.
File watermarking works on an entirely different principle. For supported image formats — .png, .jpg, and .svg are the examples Anthropic explicitly documents — Claude attaches a cryptographically signed C2PA content credential to the file's metadata header. The pixel data itself is untouched. The provenance record lives alongside the image as structured metadata, not inside it. Anthropic's documentation acknowledges that format conversion, re-saving, and screenshots are operations that can strip that metadata, which means the C2PA credential is durable against casual inspection but fragile against any pipeline that creates a new derivative file.
Why Code Is the Weak Case
Anthropic does not describe a separate code watermarking system. Generated code falls under SynthID-Text, which means the statistical mechanism applies — but with far fewer opportunities to encode signal. Prose allows dozens of near-equivalent phrasings per sentence. Python syntax does not. A required keyword cannot be swapped; an API call cannot be arbitrarily replaced without breaking the program. The degrees of freedom the model can exploit narrow to variable names, comments, and docstrings — surfaces that represent a small fraction of a typical source file's token count.
This is why the security implications of AI-generated code deserve attention beyond watermarking: the verification layer is thinner precisely where the attack surface is most consequential. Python's AST provides a route to meaningful source transformation — renaming local identifiers, stripping docstrings and comments, and reconstructing source from the parse tree — that changes substantially more of the generated surface than a find-and-replace pass on variable names. The ast.unparse() reconstruction also normalizes formatting, removing another dimension along which statistical patterns could persist. The tradeoff is that AST reconstruction can alter source-level details in ways that require functional retesting before deployment.
What Actually Removes Each Mark
| Output type | What Claude embeds | What does not work | What does work | Difficulty |
|---|---|---|---|---|
| Text | SynthID-Text statistical pattern distributed across token choices | Copying to a new editor; light synonym substitution; reformatting | Substantial rewrite or full paraphrase through a non-Claude model | Moderate |
| Code | Same SynthID-Text mechanism, but sparse due to syntax constraints | Single variable rename; comment deletion alone | AST-level identifier renaming plus docstring and comment removal; functional retest required | Hard |
| Files (.png, .jpg, .svg) | Signed C2PA provenance credential in file metadata header | Opening or viewing the file; metadata inspection alone | Format conversion, re-save, or screenshot that creates a new derivative without the original manifest | Easy |
For text, a pipeline that rewrites Claude output through a model not using SynthID-Text reduces but does not guarantee elimination of the pattern; a detector measuring residual watermark density in the output is needed to confirm removal. For files, the C2PA Python library (pip install c2pa-python) can confirm whether a manifest is present before any stripping operation, avoiding blind metadata removal on files that may not carry a credential at all.
Anthropic's documentation is explicit that not all platforms or features apply every marking type. Blanket assumptions about PDF provenance, for example, are not warranted — the documented file types are .svg, .png, and .jpg.
The asymmetry across output types reflects a broader pattern: provenance infrastructure for AI-generated content is maturing unevenly, and code — the output most likely to be shipped directly into production — sits in the gap where coverage is weakest. As gated capability verification becomes a live policy concern, the absence of a robust, syntax-aware code watermarking standard is a gap that neither Anthropic's current documentation nor any published third-party tooling yet fills.