How to Detect a Claude Watermark: Text Marks and C2PA Verification

You can already verify half of Claude's new provenance system — just not the half most people are asking about. Anthropic confirmed on August 11, 2026 that Claude models launched on or after August 2, 2026 embed an invisible watermark in generated text and attach signed C2PA metadata to supported files. Our companion piece on the announcement covered what gets marked and what doesn't. This post covers the question that follows immediately: how would anyone actually check?

The honest answer splits in two. C2PA file verification is a mature, already-deployed open standard — you can check a manifest today with free tools. Text watermark detection is not public yet; Anthropic's own documentation calls it "forthcoming." Conflating the two, as much of the reaction online has, leads to wrong expectations about what you can verify right now.

TL;DR — what you can check today

Two provenance mechanisms, two different verification stories

Anthropic's announcement bundles two technically unrelated systems under one policy. They need separate detection stories because they work — and fail — in opposite ways.

Text watermarks: detection doesn't exist publicly yet

Anthropic's own description is that the mark is "woven directly into the text itself" via token-level statistical bias, not metadata you can inspect with a file tool. Published watermarking literature (Anthropic hasn't confirmed its exact scheme) generally works like this:

1. At each generation step, the model has many "equivalent" next-token choices that don't change meaning or quality.
2. A secret key nudges which of those equivalent tokens gets picked, in a pattern invisible to a reader.
3. A detector holding the same key rescans a passage and measures whether token choices skew toward the key's preferred pattern more than chance would predict.
4. Given enough tokens, that skew becomes a statistically significant signal — short passages don't carry enough signal to be reliable.

The key has to stay secret for the scheme to work at all. If Anthropic published the exact bias pattern, anyone could reverse-engineer text that passes or fails detection on demand — which is exactly why no lab using this approach open-sources its detector. That's also why "just write a script to check it yourself" isn't a real option: there is nothing public to check against.

As of this writing, Anthropic has not shipped a detection API, web tool, or technical spec. The EU AI Act's Article 50(2) Code of Practice — the regulation driving this whole rollout, covered in our EU AI Act policy guide — requires signatories to support third-party detection, so something is coming. Whether it's a public API, an enterprise-gated endpoint, or a request-based process for educators and platforms is still unknown.

C2PA file metadata: you can verify this today

This is the more useful half for anyone who wants to check something right now, because C2PA isn't new or Anthropic-specific. It's an open Coalition for Content Provenance and Authenticity standard already deployed across LinkedIn, camera manufacturers, and other generative-AI tools — our breakdown of LinkedIn's C2PA rollout for AI images covers the same manifest format at platform scale.

Here's how the check actually works:

1. A C2PA-conformant file (Claude's supported types: .svg, .png, .jpg) carries a signed manifest alongside the pixel data — not hidden inside it like the text watermark.
2. The manifest records what tool produced or edited the file and a cryptographic hash of the content at signing time.
3. A verifier — a free web tool, a browser extension, or a platform's built-in check — reads the manifest, confirms the signature chains to a valid certificate, and recomputes the content hash to compare against the recorded one.
4. You get one of three results: valid (unaltered since signing, signer identity confirmed), no data (no manifest present), or invalid/tampered (the content changed after signing, or the signature doesn't check out).

You can run this check today, independent of anything Anthropic ships, using existing C2PA-conformant verifiers such as Content Credentials Verify. The catch is the opposite of the text watermark's problem: verification tooling already exists, but the manifest itself is fragile. Re-saving a PNG through most image editors, converting formats, screenshotting the result, or uploading through a platform that strips metadata on ingest all produce a "no data" result — which looks identical to content that was never marked in the first place. A "no data" verdict is not evidence of anything; it's an absence of evidence.

We built a free, client-side checker so you can try this yourself right now: Claude Watermark & C2PA Content Credentials Checker. Drop in a PNG, JPEG, or SVG and it scans the file's bytes in your browser — nothing is uploaded — for C2PA manifest markers (JUMBF boxes, the PNG caBX chunk) and surfaces any readable manifest fields it finds. It's explicit about its own limits: it detects manifest presence, not cryptographic validity, and links out to Content Credentials Verify for the authoritative trust-chain check. The same page also explains, honestly, why there's no equivalent box for pasted text yet — because no public detector for Claude's text watermark exists to check against.

What a detection result actually tells you — and what it doesn't

This is the part worth internalizing before any detector ships, because the misuse pattern is predictable. Our earlier coverage of classical ML approaches to LLM text detection already documented how the last generation of AI-detection tools got treated as verdicts by schools and employers despite being probabilistic classifiers with real false-positive rates. A cryptographic watermark is a stronger signal than an SVM classifier trained on stylistic features — but "stronger signal" and "proof" remain different categories.

Anthropic's own caveats, worth restating precisely:

A positive result does not mean Claude authored the ideas. Proofreading, translating, summarizing, or reformatting your own writing through Claude can leave a detectable mark on content whose substance is entirely human. If your organization treats a watermark hit as equivalent to a plagiarism finding, it will misfire on exactly this case.

A negative result does not mean a human wrote it. No detectable mark can mean: the content came from a pre-August-2 model still in the transition period, was heavily paraphrased or translated, is too short to carry a reliable signal, had its C2PA metadata stripped by re-saving, or came from a surface Anthropic doesn't cover. "Undetected" and "unmarked" are not the same claim.

Put together: this system is built to produce a weak positive signal and effectively no negative signal. It's designed for checking provenance at scale — flagging candidates for review — not for adjudicating a single disputed case. Anyone building a policy around watermark detection (an admissions office, a publisher, a content platform) should write "detected ≠ proven" into the policy text before the first dispute arrives, not after.

The right way to repurpose Claude output without fighting the system

If the actual goal is using Claude-assisted writing in something you'll publish, submit, or ship — a blog post, a report, code documentation — the compliant path isn't trying to defeat a provenance signal. It's the same editorial discipline that predates watermarking entirely:

1. Re-author substantively, don't just reformat. Restructure the argument, add your own sourcing and analysis, and cut or rewrite anything you're keeping verbatim. Heavy, genuine editing is also the one thing Anthropic lists as actually reducing watermark reliability — because the text has materially changed, not because you targeted the mark.
2. Disclose AI assistance where it's required. If you operate somewhere the EU AI Act's Article 50 transparency obligations reach your product or publication, Anthropic's own guidance is that you must independently assess what disclosure Article 50 requires of you — the model-level mark doesn't discharge that obligation for your organization.
3. Keep your own provenance trail. Drafts, prompts, and revision history are better evidence of authorship process than fighting a detector after the fact — and they're what most institutional AI-use policies actually ask for.
4. Treat file metadata the same way. If you're distributing an image or document that passed through Claude, leaving the C2PA manifest intact is the disclosure-friendly default; stripping it to look "unmarked" just produces the same ambiguous "no data" result a routine re-save would, with worse optics if anyone asks.

None of this requires defeating anything. It's the difference between using a tool and laundering its output.

Open questions still unanswered

• Will text-watermark detection be public or gated? Open access invites adversarial iteration (paraphrase until the mark disappears); gated access blocks independent verification of Anthropic's own claims. The Article 50(2) code requires supporting third-party detection, which doesn't resolve which model Anthropic will pick.
• What's the false-positive rate, and at what passage length does confidence become reliable? No numbers published.
• Will older, pre-August-2 models ever get retroactive coverage? Anthropic calls this "in progress" with no date.
• Will detection be free? C2PA verification already is, via multiple independent tools. Text-watermark detection's cost model is unknown.

Bottom line

C2PA file verification is not a future feature — it's a working, free, already-deployed standard you can check today, and its main weakness is fragility (any re-save clears it), not unavailability. Claude's text watermark is the opposite: theoretically more robust against copy-paste, but with zero public detection tooling as of this writing. Until Anthropic ships that piece, "detecting a Claude watermark" mostly means waiting — and when it does ship, the more important habit to build now is treating any result, positive or negative, as a probabilistic signal rather than a verdict.

Related on explainx.ai

• Claude Watermark & C2PA Content Credentials Checker — try the free, client-side verifier from this post
• Anthropic Is Watermarking Claude Text: What It Marks and What It Misses — the full policy announcement this post follows up on
• LinkedIn's C2PA Content Credentials for AI images — the same manifest standard deployed at platform scale
• LLM-generated text detection with classical ML — why probabilistic detection has always produced false positives
• EU AI Act and US policy: complete regulation guide — the Article 50(2) obligations behind this rollout
• Europe's AI landscape: sovereign compute and the EU Act
• Open-weight vs closed models: how to choose — the substitution path critics point to when they want output without a lab-level mark
• Claude Sonnet 5 pricing made permanent

Primary sources: Anthropic Help Center, "How Claude marks AI-generated content" (updated August 11, 2026) · EU AI Act Article 50(2) Code of Practice on Transparency of AI-Generated Content · C2PA specification · Content Credentials Verify (verify.contentauthenticity.org)

Accurate as of August 11, 2026. Anthropic had not published text-watermark detection tooling or technical documentation at the time of writing; statements about the token-watermarking mechanism describe the general published approach in watermarking literature, not a confirmed Anthropic implementation detail. This post does not provide instructions for removing, evading, or defeating watermark or C2PA provenance signals — for legitimate reuse of Claude-assisted content, see the repurposing guidance above. Follow @explainx_ai for updates.