An interactive walkthrough

Can you tell if it’s AI?

Since August 2026, most major AI providers mark their output, and the biggest name of all, Claude, does it worldwide. This walks through what that actually means: why the mark is not a hidden character you can delete, how a model can be nudged toward a secret pattern of word choices, a second and different real system from Google called SynthID, where the mark breaks down, and what happens when a school or a hiring manager treats a detector's result as proof rather than a hint.

Module 01

The rule that changed everything

Myth we'll unpick: an AI watermark is a hidden character you can find-and-replace away

Something changed in the second week of August 2026: text from Claude, wherever in the world you use it, started carrying a mark that identifies it as AI-generated. It was not Anthropic's idea alone. It was a deadline.

Two dates, three months apart

2 Aug 2026Article 50 takes effectThe EU AI Act's transparency obligations for AI-generated content become enforceable, with a grace period to 2 December 2026 for content already in circulation.

11 to 12 Aug 2026Anthropic switches it on, everywhereAnthropic confirms Claude output is marked "across Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag, and wherever Claude is offered, worldwide," alongside roughly 190 other signatories to the European Commission's Code of Practice on Transparency of AI-generated Content, including Google.

Dates from the European Commission's Digital Strategy site and Anthropic's own Help Center article "How Claude marks AI-generated content," both accessed 14 August 2026; corroborated by TechCrunch, The Register and Euronews, all published 11 August 2026.

Why not just switch it on for Europe?

Running two versions of the same model, one marked and one not, roughly doubles the engineering cost and complicates every API integration a business has built. It is cheaper to build one pipeline than two, so the EU's rule became the practical floor for the entire internet. There is no region where an unmarked Claude response is the default any more.

So there is a mark now. The next question is the one almost everyone gets wrong: what kind of mark is it?

Module 02

Two things called "watermark"

A generated image and a piece of generated text are marked in two completely different ways, and mixing them up is where most of the online confusion starts.

Files and text, side by side

Files: SVG, PNG, JPG

Method C2PA signed metadata

What it is A sidecar record, naming the tool and creation details

Survives Being opened normally

Does not survive a screenshot, which creates a brand-new file with no sidecar, or upload to most social platforms, whose compression routinely strips metadata to save space.

Text

Method A statistical pattern in the word choices themselves

What it is Not a hidden layer; the words actually chosen

Survives Copy, paste, retype into Notepad

You cannot strip it without rewriting the sentence, because there is no separate layer to strip.

C2PA is the Coalition for Content Provenance and Authenticity, an open standard Anthropic uses for its generated image, audio and video files. Source: Anthropic Help Center, "How Claude marks AI-generated content," accessed 14 August 2026.

The Notepad test

If a text watermark were a hidden Unicode character or a swapped curly quote, copying the words into a plain-text editor would strip formatting and destroy it in seconds. That is exactly the test a text watermark has to survive, and it does, because the mark is not sitting on top of the words. It is which words got chosen in the first place.

So how does a model's own word choice become a trackable signature? That takes watching one get written, one word at a time.

Module 03

Green words, red words

A language model does not plan a sentence. It predicts one next word at a time, weighs several good options, and picks one. A watermark intercepts that exact moment. Anthropic keeps its own version of this mechanism undisclosed, but the published research method it is built on, and this widget's simplified illustration of it, works like this.

Watch a sentence get written

Press "Reveal next word" to begin. At each step, a secret key splits the vocabulary into a green list and a red list; the model is nudged to prefer green.

Why nobody notices while reading

Think of the party game Taboo: your card says "brain", but the five most obvious words are banned, so you end up saying "the squishy grey computer inside your bone helmet". The sentence still makes sense; it is just steered away from the writer's absolute first choice, over and over, in a pattern only someone holding the same secret key can measure.

Method described here follows the published KGW scheme: John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein, "A Watermark for Large Language Models," ICML 2023 (first posted to arXiv 24 January 2023). The demonstration above is illustrative; it does not reproduce Anthropic's actual undisclosed method.

A different real system: Google's SynthID

Green/red list (KGW-style)

Splits candidates into two lists, biases toward one

Detected via a statistical score on green-word rate

SynthID

Runs an elimination-style "tournament" among candidates

Covers text, images, audio and video from Google's models

Over 10 billion pieces of content watermarked so far, per Google.

Google DeepMind's SynthID Text mechanism: Sumanth Dathathri, Abigail See, Sumedh Ghaisas and colleagues, "Scalable watermarking for identifying large language model outputs," Nature vol. 634, pp. 818 to 823, 23 October 2024. Announcement and detector portal: Google, "Google SynthID: AI content detector," blog.google, referencing the SynthID Detector portal launched at Google I/O, 20 May 2025.

Two real, different mechanisms, both aimed at the same idea. Neither is unbreakable. Here is where they actually fail.

Module 04

Where the mark breaks

Forcing a model toward a secret word list only works where the model actually has spare choices to give up. That is not always true.

How much choice does the model actually have?

Does reformatting code erase the mark?

Very likely, yes, though this specific detail is one careful technical write-up's reasoning rather than a dedicated published study. A watermark lives in which token got chosen. An auto-formatter like Prettier or Black rewrites spacing, naming and structure wholesale, which scrambles exactly the token-level pattern a detector is looking for. The underlying fragility is well studied: several 2024 to 2025 papers exist specifically on why watermarking low-entropy generation, code included, is hard and needs specialised methods. The formatter mechanic itself is a reasonable, technically sound inference from that research rather than a directly tested finding, which is why it is flagged here rather than stated flatly.

What a positive detection actually proves

Anthropic's own documentation states it plainly: "a detected mark provides a signal that content was processed by Claude, but is not fully conclusive." It cannot tell "written entirely from scratch" apart from "pasted in and asked to fix a typo." Write a deeply personal essay yourself, then ask Claude to check your commas, and the whole thing can come back flagged.

Direct quote from Anthropic Help Center, "How Claude marks AI-generated content," accessed 14 August 2026.

A weak signal is still useful, until someone treats it as a verdict. That is exactly what has started happening.

Module 05

Treating a smoke alarm as a verdict

A smoke alarm tells you something got hot enough to smoke. It does not tell you whether that was a house fire or burnt toast. Detectors built on watermarks and writing style work the same way, and several institutions have started using them as if they were the fire itself.

What happens when detectors are trusted at scale

Peer review21 per cent of ICLR reviews, AI-generatedDetection company Pangram analysed roughly 70,000 peer reviews submitted to the ICLR machine-learning conference and found about 21 per cent were fully AI-written, with longer, more sycophantic text and formulaic bolded headers as the tell.

BenchmarkingMost detectors fail under real scrutinyEconomists Brian Jabarian and Alex Imas benchmarked the leading detectors and introduced a "policy cap": fix your maximum tolerable false-positive rate first, then see what survives. At a strict 0.5 per cent cap, most tools collapsed; only one maintained accuracy, and only with backend access an ordinary teacher does not have.

False positives at scaleEven a good detector wrongly flags real peopleComputer scientist Arvind Narayanan has pointed out that even a 1-in-10,000 false-positive rate, applied across the hundreds of pieces of writing a student submits over a degree, works out to roughly 5 to 10 per cent of an entire student body being falsely flagged for cheating at some point.

BiasThe errors are not evenly spreadMany detectors score on how predictable text is; writers using simpler, more formal sentence structures, often non-native English speakers, read as more "AI-like" regardless of who wrote it. NYU, MIT, Vanderbilt and Northwestern have all disabled Turnitin's AI-detection feature for exactly this reason.

Pangram, "Pangram Predicts 21% of ICLR Reviews are AI-Generated," 18 November 2025. Jabarian and Imas, "Artificial Writing and Automated Detection," NBER Working Paper No. 34223, 26 August 2025. Narayanan's calculation, posted publicly and widely discussed, cites 500 to 1,000 submissions per student over a four-year degree. University detector policies collected from published tracker sites, accessed 14 August 2026.

The quieter problem: it changes minds, invisibly

A 2026 Science Advances study gave people an AI writing assistant secretly biased toward one side of a real debate, on topics like the death penalty and felon voting rights. Participants' actual private opinions shifted toward the assistant's bias, every word still typed by their own hand, and warning them beforehand did nothing to stop it. Most did not believe they had been influenced at all.

Sterling Williams-Ceci, Maurice Jakesch, Advait Bhat, Kowe Kadoma, Lior Zalmanson and Mor Naaman, "Biased AI writing assistants shift users' attitudes on societal issues," Science Advances, 11 March 2026.

Why this matters

The mark on AI text is real, it is worldwide since August 2026, and it is genuinely hard to strip. None of that makes it a lie detector: it can be diluted by a low-entropy task, it says nothing about how much of a piece was AI-written, and the detectors built on top of it are already producing real false accusations at scale. Treat a positive flag as one signal to weigh, never as a verdict, and remember the mark only ever catches what you can see; it says nothing about whether a suggestion quietly nudged what you decided to write in the first place.

GoogleSynthID AI content detector NT World InkBack to presentations

Sources used. Regulation and rollout: European Commission Digital Strategy, "Transparency obligations under Article 50 AI Act" and "Strong backing for the Code of Practice on Transparency of AI-generated Content," accessed 14 August 2026; Anthropic Help Center, "How Claude marks AI-generated content," accessed 14 August 2026; TechCrunch, The Register and Euronews, all 11 August 2026. Mechanism: Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein, "A Watermark for Large Language Models," ICML 2023, arXiv 24 January 2023; Dathathri, See, Ghaisas et al., "Scalable watermarking for identifying large language model outputs," Nature 634, 23 October 2024; Google, "Google SynthID: AI content detector," blog.google. Fragility and low-entropy watermarking: arXiv 2405.14604 and arXiv 2512.14753, both on watermarking low-entropy generation. Detection and its limits: Pangram, "Pangram Predicts 21% of ICLR Reviews are AI-Generated," 18 November 2025; Jabarian and Imas, "Artificial Writing and Automated Detection," NBER Working Paper No. 34223, 26 August 2025; Arvind Narayanan's public false-positive-rate calculation, referenced via Hacker News discussion, accessed 14 August 2026; university AI-detector policy trackers, accessed 14 August 2026. Psychological influence: Williams-Ceci, Jakesch, Bhat, Kadoma, Zalmanson and Naaman, "Biased AI writing assistants shift users' attitudes on societal issues," Science Advances, 11 March 2026. Deliberately not used: a claimed "style loophole" where a restrictive style prompt suppresses the watermark, and a cited British Journal of Educational Technology study on "strategy-graded reliance," both of which appeared in early drafting material but could not be traced to any real, findable source.