The half of Claude's watermark you can actually check

Sylwia Lask's post on Claude's watermark is the best-natured thing I have read on this topic in a while, and it is right about the two things people keep getting wrong: the EU AI Act asks for machine-detectability, not a ban, and a watermark hit tells you a model was involved, not that it wrote anything.

I want to add to it rather than argue with it, because that announcement has two halves and the comment threads only ever reach one of them.

Half one is text. A keyed statistical mark, spread across token choices. It is the half everybody is discussing and, as I will get to, the half you personally cannot test.

Half two is files. Anthropic began attaching C2PA content credentials to generated images on 11 August. C2PA is an open standard with an open reference tool, so this half is checkable by anyone, today, with no key and no vendor cooperation.

I build a PDF signal engine, so the second half is my problem. On 14 August I put a signed image through every PDF generator on this laptop to find out what a downstream reader can still see. That is the measured part of this post. First, though, two things about the text half, because both keep coming up in that thread.

The mechanism has a specification you can read

The post reasons from first principles to statistical token watermarking, which is the right guess, and it is careful to label it as a guess. Since then the guess has been confirmed, in that post's own comment thread: on 14 August the author notes that Anthropic updated its documentation and Claude is indeed using SynthID. Anthropic's page puts it as a version of the SynthID-Text approach published by Google DeepMind.

That fact deserves to be out of a comment thread and in front of people, because it changes the epistemic status of the whole conversation. There is one scheme here, not two, and it has a specification: Nature 634, 818-823. You do not have to guess at the mechanism, you can read it. As the model writes, it hashes the last few tokens with a secret key and uses that seed to bias which of several equally good next words it emits. In unmarked text those tokens arrive at chance rate, so counting them gives a z-score and an actual p-value. That is the real advantage over a classifier: a calibrated false-positive rate instead of a vibe.

It also means the published attacks apply directly, which is the part most coverage still misses while calling the mechanism undisclosed. "Undisclosed proprietary magic" and "a published scheme with known attacks" support very different decisions.

It is not invisible characters, and stripping them does nothing

The post gets this right and it is worth repeating, because stripping invisible characters is the first thing everyone reaches for: the mark is not zero-width Unicode. Not U+200B, not U+FEFF, not the tag block.

I know those characters well, because our text extraction strips them before anything else reads the text, for prompt-injection reasons that have nothing to do with watermarking. Which gives me the two-sided version of the myth:

• Removing every invisible character from a paragraph does nothing to a statistical watermark. The signal is in which words were chosen, not in anything you can see or delete.
• Finding invisible characters in a document proves nothing about Claude either. They arrive from copy-paste, from CMSs, from PDF extraction. The presence of a carrier is not evidence of a payload.

What does remove the mark is documented and cheap. Re-tokenisation, which is as simple as inserting a character between every word and deleting it again, destroys the n-gram contexts every hash-based scheme seeds from. OpenAI names that attack in its own writing on why it never shipped text watermarking. Paraphrase removes it outright below roughly 800 tokens. And Jovanović, Staab and Vechev, ICML 2024 showed that for under $50 an attacker can both spoof and scrub state-of-the-art schemes, with over 80% average success. Spoofing is the direction nobody plans for: forging a mark onto human text is the attack that hurts a person.

Then there is the gate that ends the practical conversation. The scheme is symmetric. Without the secret key you cannot reconstruct the seeds, and without the seeds there is nothing to count. For a third party holding a suspicious paragraph, the answer today is not "run the test and see". The test cannot be run at all.

The fallback everyone reaches for instead, a commercial AI-text classifier, is worse than its reputation: 61.22% of human-written TOEFL essays flagged as AI by seven detectors in Liang et al., 78.3% of granted patent claims flagged by a leading open detector, and around two dozen universities that switched their detector off and none that switched it back on. I keep the receipts for that in a guide, how to detect AI-generated text, which mostly exists to explain why the honest answer to the question is "you cannot, and here is what you can ask instead".

That is the whole text half. A sound scheme, a key you do not have, and known attacks. Which is why I spend my time on the other half.

The half you can check: what happened to nine PDFs

C2PA is not an AI detector. It is a signed manifest inside the file with a hash binding the claim to the bytes, so it is a first-person statement you can verify. My question is narrower than "is this AI": it is does what a file declares about itself still validate, and does the declaration survive the trip to wherever a reviewer opens it.

Fraud review sees PDFs. Anthropic signs .svg, .png and .jpg. So the question is what happens when a signed image goes into a document, and as far as I can tell nobody had measured it. I built 30 files and 9 PDFs on one machine on 14 August, with local tools only, using c2patool 0.27.15's development certificate for signing.

A signed JPEG survives PDF embedding, byte for byte. Six of six paths: img2pdf, Chrome print-to-PDF at natural size and scaled to 47%, Ghostscript two ways, and qpdf --linearize. The DCT stream comes out of the PDF identical to the one that went in, and re-validates. I had assumed Chrome's print pipeline re-encoded and it does not: the scaling is applied by the content stream's transformation matrix instead.

PNG and SVG survive nothing. Zero of two and zero of one. A PDF has no PNG container, so the pixels are re-emitted as a Flate raster and the caBX chunk, which is a PNG chunk, has nowhere to go. Chrome draws an SVG as vector operators and produces no image object at all. Of the three formats Anthropic signs, exactly one carries its credential into a document, and it is the one document fraud actually uses.

And here is the result I did not expect. c2patool returns Error: No claim found on all nine PDFs, including the six whose embedded JPEG carries a fully valid manifest. The official reader looks for a PDF-level manifest. The credential is sitting one indirection away, inside an image stream, intact and unread.

So the honest summary of the file half is: the credential survives the trip, and the standard tool for reading credentials will tell you the document is unsigned. If you want to find it you have to walk the object graph, pull the image streams out and validate those.

Two more numbers from the same run, both of which cut against the optimistic reading:

Five of five ordinary re-saves destroy the credential. A JPEG quality change, a PNG re-save, a format conversion, a resize, and a screenshot of the image. Every marker gone, not degraded. The screenshot of the signed PNG came out the same size as the unsigned original, because a credential is not part of what a renderer renders. Absence is the overwhelming case and it means nothing at all. Anyone building a rule on "no manifest, therefore suspicious" is building a rule that fires on the entire honest internet.

Six of six tampers detected, with two distinct codes that a report must not conflate: assertion.dataHash.mismatch (the picture changed under a good claim) and claimSignature.mismatch (the claim bytes themselves changed).

What this cannot tell you

The limits belong up front, not in a footnote, so here are mine.

• Every validation above is against a development certificate. No file signed by a real Anthropic chain exists in my corpus. "Claude" describes what generated the image, never what validated the signature.
• Three survival paths are unmeasured, not zero: LibreOffice export, Word to PDF, and a WhatsApp round-trip. Not installed, or a manual phone step. If you have any of the three, that is a genuinely useful thing to run and post.
• Four of the five surfaces Anthropic lists are untested. I checked one, Claude Code, where five of five generated images carried no manifest. The caveat that makes that honest: Claude Code has no image-generation model. It writes an SVG and drives your own C2PA-unaware local tools to rasterize it, so no signing step exists in that path. That is not "Anthropic failed to ship". It is what the support page's own hedge, "some platforms or features may not support certain marking types", costs a downstream verifier.
• None of this says how often signed files arrive. Our standing baseline over real documents is 0 of 4,902 embedded images. This is early infrastructure, not a present-day signal.
• One machine, one day, one Chrome build. A print pipeline with downsampling enabled, or Acrobat's "reduce file size", would each be a row I did not run.

What I would actually do with a suspicious document

1. Do not start with the prose. The text test is key-gated and the classifiers have the false-positive rates above. Notice you are holding a file.
2. Ask the file. A PDF is an append-only container that keeps receipts about its own history: revisions appended after creation, the producing toolchain, an Info dictionary and an XMP packet that stopped agreeing, whether a signature still covers what it signed, and printed totals that do or do not add up. None of that is about the writing, and all of it is deterministic. That is the AI-generated PDF guide.
3. Check provenance where it exists, and read absence as nothing. For images the AI-generated image guide covers what a valid manifest proves, what it never proves, and why absence is uninformative.
4. Never let one signal become a verdict. Signals about bytes are defensible. "Our system detected fraud" is the sentence that ends up in a complaint.

The full write-up of the nine PDFs, with the survival matrix and the reproduction steps, is on my site: A C2PA signature survives a PDF, and c2patool can't see it. There is a free checker on tamperlens.com if you want to drop a document in and see what its own bytes say. Nothing is stored.

If you run the LibreOffice, Word or WhatsApp path, I would genuinely like the result, including if it contradicts mine. And if you disagree with the framing that the text half is unusable today, the comments are the right place for it: that is the half I would most like to be wrong about.