AI 安全與標準
Anthropic Explains Claude Text Watermarking: Detection Provides Only a Probability and Cannot Prove Authorship
Anthropic says supported new Claude models embed invisible signals during text generation, while generated files can include signed provenance metadata. The company also warns that short text, rewriting, and translation weaken detection, and that the absence of a signal does not rule out the possibility that content was generated by Claude.
Anthropic’s latest explanation divides Claude’s content marking into two technical approaches. Plain text uses model-level watermarking: when selecting tokens, the model introduces a pattern that can be detected statistically only by parties holding the corresponding key. Readers see no label, and the pattern may survive copying and pasting or minor edits. Files generated by Claude, including SVG, PNG, and JPG files, can instead carry signed provenance metadata, allowing verification tools to check whether a file has been modified. The two approaches should not be conflated: the former is a statistical signal, while the latter more closely resembles a verifiable chain of file provenance.
The FAQ substantially narrows the conclusions this technology can support. A detector returns the probability that text contains a Claude watermark; it does not prove the author’s identity, the writing process, or the authenticity of the content. Samples that are too short lack sufficient statistical evidence, while extensive deletion or editing, regeneration, translation, or rewriting may destroy the signal. Conversely, if model output includes original text supplied by the user, the detection result cannot establish that every sentence was created by the model. Schools, platforms, and businesses therefore should not treat a single watermark determination as sufficient grounds for disciplinary action or blocking.
This deployment is related to the transparency obligations under Article 50 of the EU AI Act. The European Commission says providers must, to the extent technically feasible, mark synthetic content in a machine-readable, detectable, and reliable format; the relevant obligations apply from August 2, 2026. For API teams, a more robust audit approach remains to retain the model ID, timestamp, original output, and hash, using watermarking only as a supplementary signal. Key issues to watch next include when the detection interface becomes available, false-positive rates across languages and text lengths, and reliability after content is re-encoded by social platforms or rewritten by another model.