▶ YouTube Summaries

• YT :: https://www.youtube.com/watch?v=Be-NqsW-wuk
• Original title :: Claude watermarks your code now

Theo examines Anthropic's announcement that all Claude models launched in the EU on or after August 2, 2026 will embed machine-readable watermarks in generated text (and C2PA provenance metadata in generated files), driven by the EU AI Act's Article 50 transparency obligations. His verdict: text watermarking is a cat-and-mouse game where the mouse holds every advantage — any technique is either prohibitively expensive to detect or trivially cheap to strip, a public repo for removing the marks already exists, and only the lowest-effort spammers will ever get caught. The durable path, he argues, is the opposite direction: cryptographically signing *human*-made content and educating the public.

The EU AI Act context

The EU's Code of Practice on Transparency of AI-Generated Content splits obligations between providers (marking and detection of AI-generated content) and deployers (labeling deepfakes and AI text). Adherence to the code is voluntary, but the Article 50 transparency requirements are legal obligations: providers must ensure outputs are marked in a machine-readable format and detectable as artificially generated. A carve-out exempts assistive editing — AI that corrects grammar in an existing essay or removes a blemish from a photo does not need marking; net-new LLM output does. Anthropic is complying: watermarks apply at the model level across every surface (API, Claude apps, Claude Code, AWS, Google Cloud, Foundry), older models will be retrofitted, and a detection API is promised.

Why image watermarks already fail

Theo demonstrates with a 623 KB photo why media watermarking is simultaneously easy and fragile. Images carry far more data than humans perceive, so encoding a pattern (bump one RGB channel by 1 every fourth pixel) is invisible — but compression algorithms exist precisely to flatten imperceptible variation, so converting PNG to JPEG, re-exporting, resizing, or applying a 1% sharpen destroys the pattern entirely. He shows Google's SynthID noise-pattern overlay dying to a 2% sharpening filter. The fundamental tension: watermarks hide in the gap between stored data and human perception, and compression optimizes that same gap away.

Why text is much harder

Text is already maximally compressed — you cannot change a word in a sentence without a human noticing, unlike one pixel in millions. Sean Goedecke's analysis (which Theo walks through) frames it as a steganography problem. Running text back through the model to check token-probability fit produces too many false positives — humans who "write like Claude" (often because models trained on them) would be flagged — and would be prohibitively expensive given the Act requires free public detection tools. SynthID for text instead biases token sampling: each candidate token gets a score derived from preceding tokens, sampling prefers high-scoring tokens among the top-5 likely, and detection just measures the aggregate score of a passage — cheap to verify, invisible to readers. The other known trick is Unicode homoglyphs and exotic space characters, which some users have already noticed appearing when pasting model output into VS Code.

Every removal path is cheap

Homoglyph marks die to a character-normalization pass. Sampling-bias marks die to paraphrasing by any weak unwatermarked LLM, since the mark lives in vocabulary choices. Free public detection tools let an adversary iterate until the check comes back negative. The Act's demand that watermarking be interoperable and documented is incompatible with the security-by-obscurity these schemes need. A repo already ships an agent skill plus Python script that strips multi-vendor marks — Unicode hygiene, statistical rewrite hooks, C2PA metadata removal for PNG/JPEG/SVG/PDF/DOCX/HTML/MD — so you can ask Claude to remove Claude's own watermark.

C2PA's real value is inverted

Signed provenance metadata can be removed but not faked, so its strength is certifying human origin: a camera chip signing a photo at capture is far more tractable than detecting everything that wasn't a camera. But C2PA only applies to files ("containerized text"), not plain chat output — there is no artifact to sign in a ChatGPT response. Anthropic's own limitations section concedes the marks are weak evidence in both directions: a Claude mark may just mean Claude proofread human text, and absence of a mark proves nothing (pre-watermark models, heavy edits, translations, short passages, screenshots, unsupported file types all evade it).

Takeaways

Watermarking will catch only zero-effort cases — bots copy-pasting straight from Claude — while anyone with minimal motivation strips the marks or switches to open-weight models. The policy sounds compelling to voters and politicians but cannot deliver on its actual goals (propaganda campaigns, serious misuse); at best it inconveniences high-school essay cheats. Theo expects the industry to move through this watermarking phase quickly and settle on verifying authentic human content plus public education about synthetic media.