Claude's Watermark Isn't Live. Your Provenance Debt Is.

Open your model picker and read the list. Opus 5 shipped on 24 July 2026. Sonnet 5 on 30 June. Fable 5 on 9 June. Every one of them launched before 2 August 2026. That date is the one that matters, because Anthropic scoped watermarking by model launch date, not by calendar date.

Anthropic announced watermarking on 11 August 2026, published a technical explainer on 14 August, and answered follow-up questions on 15 August. The headlines from that week are wrong in a specific way. Anthropic did not start watermarking Claude's output. It announced that it will. The explainer is future tense in its first line: "Future Claude models will generate text that contains a watermark." The detection API does not exist either: "We will soon be offering a watermark detection API. We're in the process of working out the details of its implementation."

Nothing you generated this month is marked. Nobody can check anything. Both of those facts have an expiry date that Anthropic has not published.

This reflects Anthropic's public statements as of 19 August 2026. No Claude model has launched on or after the 2 August cutoff. The section on what to watch lists the four events that would change it.

The thesis: Claude watermarking creates Provenance Debt

Here is the claim this article owns.

A vendor is about to start writing this property into artifacts you own, on a schedule you do not control. Nobody hands you an evaluation checklist for it. It goes into your supervised fine-tuning corpus, your retrieval index, your support macros, your product copy. And unlike a copyright notice, it does not stay in the document. It can survive training and reach your model weights.

Here is the part the coverage missed. What accrues today is not marked text. Anything you generate this week will never be marked, because marking happens at generation and cannot be applied backwards to bytes that already exist. What accrues today is unrecorded generation.

That matters because the two populations are about to be mixed. Rows written before the rollout are permanently unmarked. Rows written after it are marked. If your corpus carries no record of when each row was generated, nothing in your own infrastructure can separate them. The only instrument that can is a detector owned by Anthropic, which means shipping the corpus to the vendor in order to ask.

I call this Provenance Debt: the liability you take on when vendor-marked-or-markable output enters an asset you own, and you keep no record of which is which.

You cannot read the balance, because the detector belongs to the vendor. You cannot pay it down afterwards, because the only payment is a record you had to write at generation time. Ordinary technical debt gives you both.

This is not data-lineage debt under a new name. Lineage debt is about your records of your own transformations, and you can rebuild it by reading your own systems, which is the discipline in why provenance matters for AI engineers. Provenance Debt is about a property a third party writes into your data, that only they can read.

Debt is the right word rather than contamination. Contamination implies something went wrong. Nothing has gone wrong. You borrowed capability and the interest is provenance, and right now the loan is still interest-free because the marking has not started.

What Anthropic actually committed to, with dates

Anthropic names the scheme, which matters more than it sounds: "Claude's text watermark is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024." That is what licenses this article to read published SynthID-Text results as though they describe Claude, and it is why the numbers below are worth anything at all.

The site already has a hands-on breakdown of how this class of watermark works, so this article skips the mechanism. To build one and detect it from text alone, read How SynthID Works: Build a Watermark in Python, and its closing section on tournament sampling in particular, which is the sampler Claude uses.

What is new is the commitment, and it is narrower than reported.

Read the region row again, then look for a row that is not in the table at all.

Is there an opt-out from Claude watermarking?

No opt-out is documented. Not a header, not a setting, not an enterprise carve-out. That is different from saying opt-out is prohibited. It is not mentioned anywhere in Anthropic's news post, its support article, or the follow-up reporting. Treat it as undocumented rather than as policy.

How do you detect a Claude watermark today?

You cannot, and neither can anyone else. Anthropic says a detection API is coming and that it is "in the process of working out the details of its implementation". Until it ships, no customer, no university and no publisher can check a document. That gap is the subject of this article.

Why is the marking global, and why now?

The driver is the European Union Artificial Intelligence Act (EU AI Act), Article 50(2), which became applicable on 2 August 2026. It requires providers to mark synthetic output in a machine-readable format. The penalty tier for an Article 50 breach is up to 15 million euro or 3 percent of total worldwide annual turnover, whichever is higher, under Article 99(4)(g). That is why the cutoff is a legal date rather than a product date, and it is why the scope is global.

"Can Claude's watermark be stripped?" is the wrong question

The public argument since 11 August has been about whether the watermark can be removed. It can. This is settled, published, and cheap.

• ETH Zurich's Secure, Reliable, and Intelligent Systems Lab found SynthID-Text "easier to scrub than other state-of-the-art schemes even for naive adversaries", with scrubbing success over 90 percent using standard paraphrasing tools. Their earlier work showed watermark stealing, which enables both spoofing and scrubbing, for under 50 dollars in query cost.
• An ACL 2025 paper on watermark radioactivity found that targeted paraphrasing and inference-time neutralization "thoroughly eliminate" inherited watermarks, while preserving the knowledge transfer the attacker wanted in the first place.

The stripping coverage stopped at "yes, it comes off". Read those two results for who is left holding the mark instead.

The watermark is defeated by any team that knows it exists and decides to defeat it. It is not defeated by a team that never thought about it. So the population it marks is precisely the population acting in good faith: the platform team that generated 40,000 instruction pairs to bootstrap an internal model, wrote instruction and output to a JSONL file, and moved on. That shape is not invented. It is the generator in the wrong-response section below, and it is the shape of every self-instruct and Alpaca-style dataset you can download today: instruction, input, output, and no provenance field at all.

The obvious objection is that defeatable controls are not worthless. Seatbelt laws are defeatable. Door locks are defeatable. The difference is enforcement. A seatbelt law is enforced by observation, and this is enforced by a detector nobody has yet.

So judge it against the goal Anthropic actually states. Article 50(2) is a transparency obligation, and against a disclosure mandate, marking the good-faith default population is not a failure mode. It is the specification. On its own terms the watermark works.

The inversion only appears when you judge it the way the stripping debate judges it, as a control on abuse. On that axis, a control that is cheaply defeated by intent, and only leaves evidence on those without it, does not measure misuse. It measures ignorance. Nobody who plans to launder gets caught. The mark lands on teams who were not doing anything wrong and did not keep records. Which is solvable by keeping the records.

Where a text watermark carries signal, and where it cannot

Tournament sampling needs a choice. It steers the selection between tokens the model considers roughly equally acceptable. Where there is no choice, there is nothing to steer, and the watermark carries no signal.

Anthropic says this plainly: "Where an exact output is required, where there isn't a choice, and something would be factually wrong or a piece of code would break if a different term was chosen, the watermark isn't applied." The Nature paper behind SynthID-Text says the same thing in research terms. Low-entropy generation such as code or table output has "strict syntactic or formatting requirements, resulting in small watermark capacity".

Length matters as much as entropy. A 2026 analysis of SynthID-Text measured a true positive rate of roughly 0.30 at 50 tokens with the false positive rate held at 1 percent, and the literature benchmarks reliable detection at 200 tokens. The usable floor sits between those two, nearer 200 than 50. Anthropic has published no minimum length of its own, so treat any specific number you see attributed to Anthropic with suspicion.

Entropy and length together invert what most people assume:

The marking regime is strong on essays and close to absent on the artifacts most engineering teams actually ship. If your Claude usage is code generation and structured extraction, your text exposure is smaller than the coverage implies. Say so out loud rather than panic. Do not read it as zero: the exemption is per token, and comments, docstrings and prose inside generated code all still have choice.

Note what that does to retrieval. Chunk size stops being purely a recall decision, because how you size retrieval chunks also sets how much watermark signal each chunk can carry. Chunk small enough and you shred the signal by accident.

If you generate synthetic training data, it is the opposite. Instruction-tuning data is long, fluent, high-entropy prose. It is the single best-case input for this watermark, and it is the one artifact that does not stay where you put it.

Watermark radioactivity: how the mark reaches your fine-tuned model

This is the finding that changes the engineering decision, and it predates Anthropic's announcement by two years.

Sander and colleagues published Watermarking Makes Language Models Radioactive at NeurIPS 2024. The result, quoted from the abstract: "if the suspect model is open-weight, we demonstrate that training on watermarked instructions can be detected with high confidence (p-value below 10^-5) even when as little as 5% of training text is watermarked."

Read that as an engineer rather than as a researcher.

You fine-tune a model on a mix where one row in twenty came from a watermarked teacher. If you publish the weights, a third party holding the key can determine from the model's behaviour that you trained on that teacher's output, at a confidence level no court would call coincidence. The mark propagated into the weights, and it comes back out in generation.

Two qualifiers are load-bearing, and the paper carries both. That headline number is the open-weight result, so it applies directly to you only if you publish weights. If you serve an API and nothing else, it is not your number, and my read is that the property does not disappear but gets harder to measure from outside. Sander and colleagues also measured green-list-family schemes, and Claude uses SynthID-Text tournament sampling. Transfer between the two is plausible and unmeasured. Treat the mechanism as demonstrated and the exact figures as not yet established for Anthropic's implementation.

I would still not publish open weights trained on a mix I cannot decompose. Five percent is a lower bar than most teams assume their Claude-derived share sits at.

A related ICLR 2024 result, watermark distillation, shows the mechanism from the other side. A student trained on watermarked teacher output can learn to emit watermarked text itself. That is a much higher bar than 5 percent, and the two results must not be read as one number. Radioactivity says someone can prove you trained on marked data. Distillation says your model reproduces the mark in its own output, and that has been shown where the great majority of the training distribution was watermarked.

Most teams assume distillation launders provenance. Distillation is how the record gets made. This is the same feedback loop as the AI ouroboros, with one difference. Now the loop signs its work.

Here is why this costs money rather than merely being embarrassing. Anthropic's commercial terms assign you the outputs and separately forbid using them to train models that compete with Anthropic's own. From the outside, that clause has been close to unenforceable. Radioactivity is what changes it: a mark that survives fine-tuning turns a contractual restriction into a measurement.

That is the debt in its most concrete form. A 5 percent slice of Claude-derived instruction data today becomes a claim someone else may be able to make about your model later, strongest if you publish weights. By then the corpus has been shuffled, deduplicated, and merged into a mix you cannot decompose.

The concession worth making here: tournament sampling is designed to be non-distortionary. Your fine-tuned model is no worse for having eaten marked data, and no benchmark will move. The debt is not technical. It is legal and contractual, which is exactly why it stays invisible until someone bills you for it.

flowchart TD
    C["Claude output"] --> K{"What kind of<br/>output is it?"}
    K -->|"long prose"| A["Watermark signal present"]
    K -->|"code, JSON, short replies"| B["Little or no signal"]
    K -->|"png, jpg, svg"| I["C2PA manifest attached"]

    A --> S1["Docs and product copy<br/>published unchanged"]
    A --> S2["Retrieval index<br/>chunked to 200-400 tokens"]
    A --> S3["Fine-tuning corpus"]

    S1 --> R1["Attributable<br/>mark intact"]
    S2 --> R2["Weak<br/>near the detection floor"]
    S3 --> R3["Attributable in your weights<br/>radioactivity"]
    I --> R4["Not attributable<br/>manifest stripped on first resize"]
    B --> R5["Not attributable<br/>nothing to detect"]

    style C fill:#4A90E2,color:#FFFFFF
    style K fill:#7B68EE,color:#FFFFFF
    style A fill:#FFD93D,color:#2C2C2A
    style B fill:#95A5A6,color:#FFFFFF
    style I fill:#98D8C8,color:#2C2C2A
    style S1 fill:#98D8C8,color:#2C2C2A
    style S2 fill:#98D8C8,color:#2C2C2A
    style S3 fill:#98D8C8,color:#2C2C2A
    style R1 fill:#E74C3C,color:#FFFFFF
    style R2 fill:#FFA07A,color:#2C2C2A
    style R3 fill:#C2185B,color:#FFFFFF
    style R4 fill:#95A5A6,color:#FFFFFF
    style R5 fill:#95A5A6,color:#FFFFFF

Warm nodes are outcomes where the artifact stays attributable to Claude. Grey nodes are outcomes where attribution is lost, whether by design or by accident. Neither colour means good or bad. The fine-tuning path is the only one where the mark moves from an artifact into a system.

Why C2PA image provenance does not survive your own asset pipeline

Anthropic attaches C2PA signed provenance metadata to generated .png, .jpg, and .svg files. Its own caveat is that this "may not be supported on every platform".

That caveat covers more than it looks like it covers. The C2PA specification puts its manifest store in a PNG chunk type called caBX, and declares that chunk "ancillary, private, not safe to copy". In PNG, "not safe to copy" is a rule with teeth. An encoder that has modified the critical chunks must not carry the chunk forward, and a resize rewrites the image data, which is a critical chunk. A spec-compliant encoder is therefore required to drop the manifest.

No adversary is involved, and nothing is broken. A manifest asserting the original image should not survive onto a modified one, so this is the specification working as designed. The effect in your stack is the same either way. A Sharp resize, a Next.js image transform, a Content Delivery Network (CDN) converting to WebP, or an S3 Lambda generating thumbnails each destroy it, and none of them log that they did.

You can watch it happen in ten lines. Pillow will not write a raw caBX chunk, so this uses a text chunk instead. Note that the substitution runs against the argument rather than for it: a tEXt chunk is marked safe to copy, so an encoder is permitted to keep it. It gets dropped anyway.

from pathlib import Pathfrom PIL import Image, PngImagePluginSRC, OUT = Path("asset.png"), Path("asset@640.png")img = Image.new("RGB", (1280, 720), (74, 144, 226))meta = PngImagePlugin.PngInfo()meta.add_text("caBX", "c2pa-manifest-store-placeholder")img.save(SRC, pnginfo=meta)def has_marker(p: Path) -> bool:    return b"caBX" in p.read_bytes()print(f"{SRC.name:16} {SRC.stat().st_size:>7} bytes  caBX present: {has_marker(SRC)}")# The resize step every asset pipeline runs.Image.open(SRC).resize((640, 360)).save(OUT)print(f"{OUT.name:16} {OUT.stat().st_size:>7} bytes  caBX present: {has_marker(OUT)}")

asset.png           4369 bytes  caBX present: Trueasset@640.png       1487 bytes  caBX present: False

The byte counts depend on your zlib version. The True to False is the part that does not.

One resize, and the caBX chunk is gone. Nothing in the pipeline logged that it was ever there, because nothing in the pipeline knows what it was.

For a real Claude-generated image, use c2patool rather than a byte scan. A byte scan proves the chunk is absent, but it does not validate the signature when the chunk is present.

C2PA's own answer to this is Durable Content Credentials. It pairs the manifest with an invisible watermark and a fingerprint lookup, so provenance can be recovered after the manifest is stripped. Anthropic has not announced that it uses any of it. Until it does, verify with c2patool at ingest and record the result there, because that is the last point in your pipeline where the manifest still exists.

The wrong response: wait for the Claude watermark detector to ship

The common plan right now is to wait. The reasoning sounds sensible. Nothing is marked, no detector exists, so there is nothing to do until one of those changes.

Here is what waiting looks like in code. This is a synthetic data generator, and it is the version almost every team has:

# wrong: capability recorded, provenance discardedimport jsondef generate_pairs(client, prompts, out_path):    with open(out_path, "w", encoding="utf-8") as f:        for prompt in prompts:            resp = client.messages.create(                model="claude-sonnet-5",                max_tokens=1024,                messages=[{"role": "user", "content": prompt}],            )            f.write(json.dumps({                "instruction": prompt,                "output": resp.content[0].text,            }) + "\n")

Nothing here is broken. The problem is what it throws away. The model identifier is in the call and not in the row. The timestamp exists only as a file mtime that will not survive the first merge.

Six months from now, that file is in a training mix with four other sources. Someone asks which rows came from Claude and when. There is no answer, and there is no way to recover one, because the only two facts that would have answered it were never written down.

You do not have to imagine what that looks like. Run the audit from the next section against a corpus this generator produced, and it prints this:

model                     marking           format       rows  generated--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------unauditable rows (no model or no timestamp): 3malformed rows (unparseable or no output):   0

An empty table. Not a table showing low exposure, or uncertain exposure. The rows exist, they are long high-entropy prose, and they are exactly the kind of text this watermark marks best. The audit simply has nothing to reason with.

That is the cost of waiting. Waiting does not cost you a response to marked data. It costs you the ability to say anything at all about data that is not yet marked.

The right response: record source model and generation time on every row

Write the model and the timestamp into every row.

# right: record what served, not what you asked forimport jsonfrom datetime import datetime, timezoneMODEL = "claude-sonnet-5"def generate_pairs(client, prompts, out_path):    with open(out_path, "w", encoding="utf-8") as f:        for prompt in prompts:            resp = client.messages.create(                model=MODEL,                max_tokens=1024,                messages=[{"role": "user", "content": prompt}],            )            f.write(json.dumps({                "instruction": prompt,                "output": resp.content[0].text,                "source_model": resp.model,       # what served                "requested_model": MODEL,         # what you asked for; these diverge                "response_id": resp.id,                "generated_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),            }) + "\n")

Take source_model from resp.model, not from the string you passed in. claude-sonnet-5 is an alias, and an alias can be repointed at a new snapshot without you changing a character. If it is ever repointed at a post-cutoff snapshot, marking status flips and your corpus records the old name. That is the exact failure this section exists to prevent, and recording the alias you typed is the one way to walk into it. response_id costs one field and is the cheapest link you will ever have between your row and Anthropic's record of it.

Why both fields, when the marking rule is stated per model?

Because the rule has a second half. Models launched on or after 2 August 2026 are marked at launch, and older models get marking "added" later. Anthropic has not announced when. So a model you are calling today, unmarked, will start emitting marked text on some future date, under the same model identifier you are already using.

That means marking status is not a property of the model name. It is a property of the pair (model, generation time). The model name alone cannot tell you whether a given row is marked. Only the timestamp lets you bisect the corpus once the backfill date is announced.

Record the model and you know which rows are candidates. Record the timestamp and you can split them on the day the backfill date is announced.

How to run a corpus watermark exposure audit

Once the rows carry those fields, the audit is a short script. It buckets a corpus by model, marking state, and format, and prints the date span of each bucket so you can bisect later.

Two honest notes before you read it. The bucketing is a GROUP BY with a date comparison, and the point is not the query. The point is that MARKING_CUTOFF and Anthropic's sentence live in your repo, and that unauditable becomes a number somebody owns. And format_class measures format, not entropy. The honest version reads per-token logprobs captured at generation time. This is the stand-in you can run against a corpus you already have.

"""corpus_exposure_audit.py - classify a generated-text corpus by watermark exposure."""from __future__ import annotationsimport jsonimport reimport sysfrom collections import defaultdictfrom datetime import date, datetimefrom pathlib import Path# Anthropic: "Claude models launched on or after August 2, 2026 will support# machine-readable marking at launch." Older models get marking added later,# on a date Anthropic has not announced. Keep the quote next to the constant.MARKING_CUTOFF = date(2026, 8, 2)# Launch dates for the aliases you call. Pinned snapshots carry their own date# and do not need an entry here.MODEL_LAUNCHED = {    "claude-opus-5": date(2026, 7, 24),    "claude-sonnet-5": date(2026, 6, 30),    "claude-fable-5": date(2026, 6, 9),    "claude-haiku-4-5": date(2025, 10, 1),}SNAPSHOT = re.compile(r"-(\d{8})$")CODE_LINE_HINTS = (    "def ", "class ", "import ", "from ", "function ", "SELECT ", "#include",)FENCE = "`" * 3def launch_date(model: str) -> date | None:    """Resolve an alias or a pinned snapshot to a launch date.    A pinned id like claude-sonnet-5-20260630 carries the date you need, which    is one more reason to pin.    """    m = SNAPSHOT.search(model)    if m:        return datetime.strptime(m.group(1), "%Y%m%d").date()    if model in MODEL_LAUNCHED:        return MODEL_LAUNCHED[model]    for alias, launched in MODEL_LAUNCHED.items():        if model.startswith(alias + "-"):            return launched    return Nonedef format_class(text: str) -> str:    """Bucket by format, standing in for the per-token entropy you would rather measure.    Tournament sampling needs a choice between acceptable tokens. Exact output    offers none, so code and structured data carry far less signal than prose.    'mixed' is prose with embedded code and counts as exposed, not exempt.    """    body = text.strip()    if body[:1] in ("{", "["):        return "structured"    lines = body.splitlines()    code_lines = sum(1 for ln in lines if ln.lstrip().startswith(CODE_LINE_HINTS))    if code_lines and code_lines >= len(lines) / 2:        return "code"    if FENCE in body or code_lines:        return "mixed"    if len(body.split()) < 40:        return "short"    return "prose"def marking_state(model: str) -> str:    launched = launch_date(model)    if launched is None:        return "unknown-model"    return "marked-at-launch" if launched >= MARKING_CUTOFF else "backfill-pending"def audit(path: Path) -> dict:    buckets: dict[tuple[str, str, str], dict] = defaultdict(        lambda: {"rows": 0, "first": None, "last": None}    )    skipped = malformed = 0    with path.open(encoding="utf-8") as fh:        for line in fh:            if not line.strip():                continue            try:                rec = json.loads(line)                output = rec["output"]            except (json.JSONDecodeError, KeyError, TypeError):                malformed += 1                continue            model, stamp = rec.get("source_model"), rec.get("generated_at")            if not model or not stamp:                skipped += 1                continue            when = datetime.fromisoformat(stamp.replace("Z", "+00:00")).date()            b = buckets[(model, marking_state(model), format_class(output))]            b["rows"] += 1            b["first"] = when if b["first"] is None else min(b["first"], when)            b["last"] = when if b["last"] is None else max(b["last"], when)    return {"buckets": buckets, "skipped": skipped, "malformed": malformed}def report(result: dict) -> None:    print(f"{'model':<26}{'marking':<18}{'format':<12}{'rows':>5}  generated")    print("-" * 88)    for (model, state, fmt), b in sorted(result["buckets"].items()):        span = f"{b['first']} .. {b['last']}"        print(f"{model:<26}{state:<18}{fmt:<12}{b['rows']:>5}  {span}")    print("-" * 88)    print(f"unauditable rows (no model or no timestamp): {result['skipped']}")    print(f"malformed rows (unparseable or no output):   {result['malformed']}")if __name__ == "__main__":    report(audit(Path(sys.argv[1])))

Run it against this fixture. Eight rows, sized to hit every bucket: one pinned snapshot, one legacy row with no source_model, one row whose generation died before it wrote an output, and a mix of formats. Save it as fixture.py and run it once to write corpus.jsonl.

"""fixture.py - writes the eight-row corpus the audit runs against."""import jsonfrom pathlib import PathRETRY = (    "The retry budget belongs to the caller, not the client "    "library. A client that retries on its own turns one "    "caller-visible timeout into three upstream requests, and "    "the caller has no way to cap the amplification. Put the "    "budget where the deadline is, and let the client fail fast "    "so the caller can decide whether a second attempt is still "    "worth the remaining time.")INTENT = "{\"intent\": \"refund\", \"confidence\": 0.91}"NORMALIZE = (    "def normalize(text: str) -> str:\n"    "    return text.strip().casefold()")CHUNKING = (    "Chunk boundaries are a retrieval decision, not a "    "preprocessing detail. When a chunk splits a definition "    "from the sentence that qualifies it, the embedding for "    "that chunk encodes a claim the source never made, and the "    "reranker has no signal that would let it recover the "    "missing qualifier. Size the chunk to the unit of meaning "    "your queries ask about.")DEPRECATED = "Yes, that endpoint is deprecated."ESCALATE = (    "Escalate to a human when the tool call fails twice with "    "the same argument set, because a third identical call will "    "fail the same way and the loop is the only thing consuming "    "budget. The signal you want is argument-set repetition, "    "not raw failure count, since a retry with different "    "arguments is genuine progress and should not trip the "    "ladder. A worked example of the check, which a reader will "    "paste into their own agent loop, looks like this:\n"    "\n"    "from collections import Counter\n"    "\n"    "def should_escalate(calls, limit=2):\n"    "    return Counter(map(repr, calls)).most_common(1)[0][1] "    ">= limit")LEGACY = (    "Legacy row written before the pipeline recorded which "    "model produced it.")ROWS = [    {        "source_model": "claude-opus-5",        "generated_at": "2026-08-04T09:12:00+00:00",        "output": RETRY,    },    {        "source_model": "claude-opus-5",        "generated_at": "2026-08-11T14:03:00Z",        "output": INTENT,    },    {        "source_model": "claude-sonnet-5-20260630",        "generated_at": "2026-07-19T11:40:00+00:00",        "output": NORMALIZE,    },    {        "source_model": "claude-sonnet-5",        "generated_at": "2026-08-15T16:22:00+00:00",        "output": CHUNKING,    },    {        "source_model": "claude-sonnet-5",        "generated_at": "2026-08-16T10:05:00+00:00",        "output": DEPRECATED,    },    {        "source_model": "claude-haiku-4-5",        "generated_at": "2026-05-02T08:00:00+00:00",        "output": ESCALATE,    },    {        "generated_at": "2026-08-01T12:00:00+00:00",        "output": LEGACY,    },    {        "source_model": "claude-opus-5",        "generated_at": "2026-08-18T07:30:00+00:00",    },]Path("corpus.jsonl").write_text(    "\n".join(json.dumps(r) for r in ROWS), encoding="utf-8")

model                     marking           format       rows  generated----------------------------------------------------------------------------------------claude-haiku-4-5          backfill-pending  mixed           1  2026-05-02 .. 2026-05-02claude-opus-5             backfill-pending  prose           1  2026-08-04 .. 2026-08-04claude-opus-5             backfill-pending  structured      1  2026-08-11 .. 2026-08-11claude-sonnet-5           backfill-pending  prose           1  2026-08-15 .. 2026-08-15claude-sonnet-5           backfill-pending  short           1  2026-08-16 .. 2026-08-16claude-sonnet-5-20260630  backfill-pending  code            1  2026-07-19 .. 2026-07-19----------------------------------------------------------------------------------------unauditable rows (no model or no timestamp): 1malformed rows (unparseable or no output):   1

The mixed row is the one to look at twice. It is the haiku row: a long prose answer that happens to end in a code sample. A classifier that saw def and called it code would have filed the most exposed row in the corpus under the most exempt label. Prose about programming is still prose.

That output carries the whole article in two columns.

Every bucket reads backfill-pending. The classifier is right. As of 19 August 2026, no model in the table launched on or after the cutoff, so nothing in this corpus is marked and nothing in it can be. That is the interest-free window, rendered as a column.

And one row is permanently unauditable. It has text and no provenance, so no future detector result about it can ever be explained. Every row you generate without those two fields joins it.

Run this against your own generation logs before you read further. I expect that count comes back non-zero, and I expect the rows it flags are your oldest and most reused, because those were written before anyone thought provenance was a field.

For completeness, here is the other branch. No such snapshot exists yet, so this run uses an invented post-cutoff id purely to show what the column does once one ships:

model                     marking           format       rows  generated----------------------------------------------------------------------------------------claude-sonnet-5           backfill-pending  prose           1  2026-07-28 .. 2026-07-28claude-sonnet-5-20260915  marked-at-launch  prose           1  2026-09-20 .. 2026-09-20----------------------------------------------------------------------------------------unauditable rows (no model or no timestamp): 0malformed rows (unparseable or no output):   0

Two rows, one alias family, two different answers. That is the split you will be asked to produce, and the only reason this run can produce it is that both rows carry a date.

What to watch: four events that change this analysis

Put an alert on each of these. The topic itself will generate noise all year.

1. The first Claude model launched on or after 2 August 2026. On that day the top row of the audit flips to marked-at-launch and the interest-free window closes for new generation.
2. The backfill date for older models. Anthropic says marking is being added to pre-cutoff models. When that date is announced, the timestamp field is what lets you split existing corpora on it. Without it you regenerate.
3. The detection API's access model. If it is public, you can audit your own artifacts and Provenance Debt becomes measurable. If it stays with Anthropic, you have a property in your data that only the vendor can read. Engineers on Hacker News raised a sharper objection. A hosted detector means checking a document requires uploading it. That is a poor trade for unpublished research, legal drafts, or internal strategy documents.
4. Which tournament-layer count Anthropic ships. A March 2026 analysis proved that under mean-score detection, the true positive rate is non-monotonic in the number of tournament layers. A "layer inflation attack" drove it to 0.13 on Gemma-7B, so 87 percent of watermarked text read as clean. You cannot set that parameter. Anthropic can, and has not published the value. A detector whose sensitivity turns on an undisclosed generator-side constant is not something you can plan around.

There is no reported benchmark regression, latency change, or workflow breakage attributable to watermarking as of 19 August 2026, which follows from nothing being marked. The consumer story about users cancelling subscriptions because the watermark will catch them is not your story either. Both will keep generating headlines. Neither changes a line of your pipeline.

Watermark exposure checklist for AI engineering teams

Do these now, while the marking has not started.

• Add source_model and generated_at to every row your generation pipelines write. Both, not one.
• Run the exposure audit against every corpus that feeds a training run, and record the unauditable count as a number you intend to drive to zero.
• Separate corpora by entropy class before you mix them. Prose and instruction data carry the exposure. Code and structured extraction largely do not, and merging them hides which is which.
• Check whether any fine-tuning mix contains more than about 5 percent Claude-derived prose. That is the published radioactivity threshold for open-weight detection, and if you publish weights it is the number that matters to you.
• Stop treating C2PA on generated images as provenance.
• Write down which of your public-facing text is AI-generated. EU AI Act Article 50(2) binds Anthropic. Article 50(4) binds you as a deployer for text published to inform the public on matters of public interest, and that duty exists whether or not a watermark is present.
• Do not build a stripping step. I would not ship one even with legal sign-off. It works and it is cheap, which is exactly the problem: it moves you into the population the control was built to catch, it adds an unbudgeted pipeline stage, and that stage has a quality cost you will be paying on every request forever in exchange for defeating a signal that, on your code and structured output, was probably never strong enough to matter.

Why Provenance Debt comes due either way

The strongest objection to everything above is that none of it is live, so all of it is speculation. That objection is correct about the facts and wrong about the conclusion.

The liability is created now. The instrument that measures it is built afterwards, by someone else, to a threshold you will never see. You can price a risk today. You cannot price this one.

So the only move available is to stop accruing Provenance Debt blind. Two fields per row, one audit script, and a corpus you can still bisect on the day Anthropic names the backfill date.

That is a cheap loan to close out. Most teams will not, and will find out what they owe from someone else's detector.

References

• Anthropic. (2026, August 14). How Claude's text watermarking works. https://www.anthropic.com/news/claude-text-watermark
• Anthropic Help Center. How Claude marks AI-generated content. https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
• Anthropic Help Center. Can I use my Outputs to train an AI model? https://support.claude.com/en/articles/12326764-can-i-use-my-outputs-to-train-an-ai-model
• Wikipedia. Claude (language model) - model release timeline, used for the launch dates in the opening and in MODEL_LAUNCHED. https://en.wikipedia.org/wiki/Claude_(language_model)
• W3C. Portable Network Graphics (PNG) Specification (Fourth Edition) - chunk naming and the safe-to-copy bit. https://w3c.github.io/png/
• European Parliament and Council. Regulation (EU) 2024/1689 (AI Act), Article 50 - Transparency obligations. https://artificialintelligenceact.eu/article/50/
• European Parliament and Council. Regulation (EU) 2024/1689 (AI Act), Article 99 - Penalties. https://artificialintelligenceact.eu/article/99/
• Dathathri, S., et al. (2024). Scalable watermarking for identifying large language model outputs. Nature, 634, 818-823. https://www.nature.com/articles/s41586-024-08025-4
• Sander, T., Fernandez, P., Durmus, A., Douze, M., and Furon, T. (2024). Watermarking Makes Language Models Radioactive. NeurIPS 2024. https://arxiv.org/abs/2402.14904
• Gu, C., Li, X. L., Liang, P., and Hashimoto, T. (2024). On the Learnability of Watermarks for Language Models. ICLR 2024. https://arxiv.org/abs/2312.04469
• Pan, L., et al. (2025). Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation? ACL 2025. https://aclanthology.org/2025.acl-long.648/
• Jovanovic, N., Staab, R., and Vechev, M. (2024). Watermark Stealing in Large Language Models. ICML 2024. https://proceedings.mlr.press/v235/jovanovic24a.html
• ETH SRI. (2024, December 20). Probing Google DeepMind's SynthID-Text. https://www.sri.inf.ethz.ch/blog/probingsynthid
• Omidi, A., Dong, J., and Wang, Y. (2026). On Google's SynthID-Text LLM Watermarking System: Theoretical Analysis and Empirical Validation. arXiv:2603.03410. https://arxiv.org/abs/2603.03410
• C2PA. (2026, January 5). Content Credentials: C2PA Technical Specification 2.3. https://spec.c2pa.org/specifications/specifications/2.3/specs/_attachments/C2PA_Specification.pdf
• Content Authenticity Initiative. TrustMark and Durable Content Credentials FAQ. https://opensource.contentauthenticity.org/docs/trustmark/faq/
• TechCrunch. (2026, August 11). Anthropic says it will watermark text generated by its AI models. https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/
• TechCrunch. (2026, August 15). Anthropic shares more details about how Claude's new watermarks will work. https://techcrunch.com/2026/08/15/anthropic-shares-more-details-about-how-claudes-new-watermarks-will-work/
• Kumar, R. (2026). How SynthID Works: Build a Watermark in Python. https://ranjankumar.in/how-googles-synthid-actually-works-a-visual-breakdown

Related Articles

AI Engineering

• How SynthID Works: Build a Watermark in Python
• Why Your Embeddings Are the Wrong Shape for Your Domain

AI Security

• Deterministic Constraint Systems: Building Tool Registries That Keep Agents in Scope

MLOPS

• Compliance, Audit Trails, and Regulatory Requirements for Agentic Systems