blogAugust 15, 2026

Claude Watermark

# Understanding Claude's Text and File Provenance Marking

Anthropic has introduced provenance mechanisms designed to help identify content produced by Claude. The system operates through two main approaches. Generated text can contain an embedded, invisible marking, while supported files may include digitally signed C2PA metadata. According to Anthropic, models released from August 2, 2026 onward have the feature enabled by default, with compatibility for older models being introduced progressively.

Claude's provenance system is also broader than its standard web application. The marking can be applied across several Claude products and services, including Claude Platform, Claude Code, Claude Cowork, Claude Tag, and certain cloud-based integrations. Availability may also vary depending on the region and the product being used.

Text markings are designed to survive some basic transformations, such as copying and relatively small edits. File-based provenance works differently because support depends on both the application and the file format. Anthropic has identified formats including SVG, PNG, and JPG as examples of files that can support the system.

## How Does Claude's Text Marking Actually Work?

One of the biggest unknowns is the technical implementation behind Claude's text marking.

Anthropic has not publicly disclosed the complete algorithm used to generate the marking, nor has it provided an official public detector. As a result, it is currently difficult to determine exactly how the marking can be identified or how effectively it survives different transformations.

The phrase "woven into the text" does not reveal the actual mechanism. It could potentially involve character-level properties, token-selection behavior, statistical patterns, semantic characteristics, or a combination of multiple techniques.

Because the implementation is not publicly documented, claims about completely removing the text marking should be treated cautiously.

Several transformations can reduce the reliability of provenance detection. Anthropic mentions extensive rewriting, paraphrasing, translation, combining generated text with human-written material, using short excerpts, converting files between formats, resaving documents, and taking screenshots.

However, these should not be considered guaranteed techniques for defeating the system. They simply represent situations where provenance information may become less reliable.

## Different Types of Provenance Require Different Approaches

Not every type of marking exists in the same part of a document. Some information can be found directly inside characters or metadata, while other signals may be associated with the generated content itself.

For example, Unicode inspection can reveal unusual characters, while C2PA-compatible tools can inspect signed provenance manifests. A statistical text marker is considerably harder to verify because Anthropic has not yet published the complete detection method.

| Provenance Layer               | Location                                    | Possible Inspection or Cleanup                                              | Verification                                                 |
| ------------------------------ | ------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------ |
| Unicode-based artifacts        | Characters, whitespace, and text formatting | Normalize zero-width, bidirectional, tag, and unusual whitespace characters | Can be checked by scanning Unicode code points               |
| Model-generated text pattern   | Word and token selection                    | Rewrite the prose using another model or manually revise it                 | Cannot be conclusively verified without an official detector |
| C2PA and document metadata     | File metadata and document containers       | Inspect and remove supported C2PA, EXIF, XMP, and document properties       | Removed metadata can generally be verified                   |
| Content or pixel-level signals | The actual content or image data            | Not covered by basic metadata cleanup                                       | Some residual uncertainty may remain                         |

This distinction is important because removing metadata does not necessarily affect a model-level text pattern. Likewise, rewriting text does not automatically remove metadata embedded inside the original file.

## Setting Up a Provenance Cleanup Workflow

For developers using Claude-based workflows, a cleanup utility can be integrated into the project through the `.claude/skills` directory. One example is the `remove-ai-marks` skill, which can be combined with an OpenAI-compatible rewriting endpoint.

The rewrite backend should be configured through environment variables rather than placing credentials directly inside project files. This prevents API keys from accidentally being committed to source control or exposed through command history.

```bash
git clone https://github.com/guillaumemeyer/watermarks-remover.git

mkdir -p .claude/skills
cp -R watermarks-remover/skills/remove-ai-marks .claude/skills/

export WATERMARKS_REWRITE_BACKEND=openai-compatible
export WATERMARKS_REWRITE_BASE_URL=https://api.haimaker.ai/v1
export WATERMARKS_REWRITE_MODEL=provider/model-id
export WATERMARKS_REWRITE_API_KEY="$HAIMAKER_API_KEY"
```

Before processing a document, it is useful to create an initial inspection. This provides a baseline showing what was actually detected before any modification takes place.

```bash
SCRIPTS=.claude/skills/remove-ai-marks/scripts

python3 "$SCRIPTS/inspect_file.py" --json draft.md

python3 "$SCRIPTS/clean_file.py" \
  draft.md \
  -o draft.layer-a.md

python3 "$SCRIPTS/rewrite_text.py" \
  draft.layer-a.md \
  -o draft.rewritten.md \
  --strength paraphrase \
  --voice-print .claude/reference/voice-print.md

python3 "$SCRIPTS/clean_file.py" \
  draft.rewritten.md \
  -o draft.cleaned.md

python3 "$SCRIPTS/inspect_file.py" \
  --json draft.cleaned.md
```

## Be Careful When Rewriting Production Files

A production Markdown workflow should not blindly send an entire document through a generic rewriting process. Placeholder values, configuration examples, identifiers, and other important content should be protected before prose is processed.

Source code requires even more caution. Deterministic Unicode normalization may be appropriate, but rewriting source code with a language model introduces a completely different problem: the program's behavior could change even when the resulting code appears visually correct.

For this reason, code should generally be cleaned deterministically and then validated using the appropriate formatter, compiler, tests, or linter rather than being rewritten purely to alter a provenance signal.

## Consider Data Privacy Before Using a Remote Model

Another important consideration is where the document is processed.

Using a remote rewriting service means that the document's prose is sent to that provider. Organizations should therefore verify that the material is allowed to be processed by the selected service before submitting it.

Sensitive or restricted documents should remain within an approved local or self-hosted environment whenever required by the organization's security policy.

Using a different model family can reduce the possibility of another model applying its own provenance mechanism, but this should not be treated as a guarantee. More importantly, changing the model does not remove the responsibility to follow the applicable data-handling and privacy requirements.

Ultimately, Claude's provenance system should be viewed as a combination of different layers rather than a single watermark. Text patterns, Unicode characters, file metadata, and content-level signals require different methods of inspection, and the absence of one type of marker does not necessarily prove that all provenance information has been removed.

Claude Watermark

Table of Contents