ANO—THER. ● NEWS

How AI watermarks work, and why they can be removed

● Last updated August 20, 2026

An AI watermark is a signal embedded in AI-generated content at the moment it is created, so that software can later verify where the content came from. Some watermarks are visible labels; the ones that matter for detection are invisible, hidden either in a file’s metadata or in the statistical pattern of the content itself. Since August 2, 2026, machine-readable marking of AI output is a legal requirement in both the EU and California, which is why watermarks went from research topic to shipping feature almost overnight.

Visible labels vs invisible marks

A visible watermark is what it sounds like: a logo in the corner of a generated image, or an “AI-generated” badge on a video. It informs a human viewer and does nothing else. It can be cropped out in seconds, and it tells software nothing.

An invisible watermark is aimed at machines. A reader or viewer cannot perceive it, but a detector built for that specific mark can. When Anthropic switched on text watermarking for new Claude models in August 2026, the company was explicit that the mark is not distinguishable to readers, adds no hidden characters, and consumes no extra tokens. The point is not to warn the person reading; it is to give schools, employers, platforms and courts something better than guessing from writing style.

Metadata provenance vs statistical watermarking

Invisible marking comes in two fundamentally different technologies, and conflating them causes most of the public confusion.

Provenance metadata travels alongside the content. The main standard is C2PA, from the Coalition for Content Provenance and Authenticity: a signed manifest attached to a file that records how it was made. Claude applies C2PA metadata to supported formats including PNG, JPG and SVG, and California’s transparency law requires C2PA-compatible provenance in generated images, video and audio. The signature makes the record tamper-evident, but the record is still a separate object attached to the file. Delete it, or re-save the file through a pipeline that drops it, and it is gone.

Statistical watermarking lives inside the content. For text, the technique is generally understood to bias which words the model picks during generation, in a pattern that looks normal to a reader but is recognizable to a detector. Nothing is appended and nothing hides in the characters; the mark is the wording itself. That is why it survives copy and paste, and why Anthropic hedges only on how much editing it survives: rewrite enough of the sentences and the statistical pattern washes out.

Why removal tools exist

Because the two technologies fail differently, an arms race started immediately. Days after Claude’s watermarks went live, an MIT-licensed tool called watermarks-remover passed 6,000 GitHub stars. It strips invisible Unicode characters, C2PA manifests and metadata from formats including PNG, JPEG, PDF, DOCX and Markdown, naming Claude, OpenAI and Gemini provenance marks as targets. Its own author is direct about the limit: statistical watermarks can only be removed by heavily rewording the text, and no tool can promise a vendor’s detector will fail.

Regulators anticipated this. The California AI Transparency Act does not just ban stripping provenance data; it bans building or distributing tools designed to strip it, targeting the market for removal software rather than individual acts of removal. An MIT-licensed script on GitHub, published from anywhere in the world, shows how hard that ban is to enforce in practice.

What watermarks can and cannot settle

As of August 2026, the honest summary is that watermarks shift the burden of proof without ending the argument. Where provenance systems work, an unlabeled file starts to look suspicious by default, which is the intent of the California law. But a watermark is not a universal detector: existing documents were never retroactively marked, models without watermarks keep producing unmarked text, and the strongest marks degrade under heavy editing while the weakest disappear with a free script. There is also a live dispute about what the mark attests to. Claude users pushed back within a day of the rollout, arguing that when a human supplies the instructions, decisions and refinements, branding the output as the model’s work answers “did a machine make this” while dodging “whose work is this”. The technology is settling faster than that question is.

Quick answers

Can AI watermarks be removed?

Metadata-based marks like C2PA can be stripped by freely available tools; one open-source remover passed 6,000 GitHub stars within days of Claude's watermark rollout in August 2026. Statistical watermarks live in the wording or pixels themselves, so removing them requires heavily rewriting or altering the content, which is costlier and degrades the output.

What is C2PA?

C2PA, the Coalition for Content Provenance and Authenticity, is an industry standard for attaching signed provenance metadata to files such as images and video. The metadata records how the file was made and is cryptographically signed, so tampering is detectable, but the record itself can be deleted from a copy of the file.

Does Claude watermark its output?

Yes. Since August 2, 2026, new Claude models embed a machine-readable watermark in generated text worldwide, and supported file formats carry C2PA metadata. Anthropic says nothing is added to the text, no hidden characters are used, and the mark cannot be traced to a specific person or chat.

Are AI watermarks a reliable way to detect AI-generated content?

No. A watermark proves origin when it is present, but its absence proves nothing: older content is not retroactively marked, not every model watermarks its output, and marks can be removed or degraded. Watermarks are a provenance signal, not a universal detector.