AI Content Watermarking & C2PA Provenance: How Machines Stamp Their Own Work
本周 Anthropic 宣布给 Claude 全线输出加隐形文本水印与文件签名,EU AI Act 的机器可读标记义务也已生效。这份文档讲清:水印在技术上怎么做、怎么检测、能信到什么程度。
This week Anthropic announced invisible text watermarks and signed file provenance across all Claude outputs, just as the EU AI Act's machine-readable marking obligations took effect. This guide explains how marking works technically, how detection works, and how much you can trust it.
调研时间:2026-08-12 · 中英双语 · 右上角切换
Researched: 2026-08-12 · Bilingual · Toggle at top right
①30 秒速览
①30-Second Overview
「AI 内容标记」要解决的问题一句话就能说清:内容满天飞之后,怎么知道一段文字、一张图有没有 AI 参与?目前业界的主流答案不是「事后猜」(训练一个分类器判断像不像 AI 写的),而是「事前盖章」——在内容生成的那一刻,就把机器可读的标记埋进去。盖章有两条技术路线:
The problem "AI content marking" solves can be stated in one sentence: once AI content is everywhere, how do you tell whether a given text or image involved AI? The industry's mainstream answer today is not "guess after the fact" (training a classifier to judge whether something reads like AI) but "stamp at creation time" — embedding machine-readable marks the moment content is generated. There are two technical routes:
统计式文本水印(statistical text watermark):生成文字时,悄悄微调模型选词的概率,使产出的用词序列携带一个人眼看不出、但检测算法能统计出来的「偏好模式」。复制粘贴不掉,轻度编辑可能还在。代表:Google 的 SynthID-Text(已开源)、Anthropic 本周宣布的 Claude 文本水印。
Statistical text watermark: while generating text, the model's word-choice probabilities are subtly tweaked so the resulting token sequence carries a "preference pattern" invisible to human readers but statistically detectable by an algorithm. It survives copy-paste and may persist through light editing. Examples: Google's SynthID-Text (open-sourced) and the Claude text watermark Anthropic announced this week.
C2PA 溯源元数据(provenance metadata):给图片等文件附上一份经密码学签名的「履历」(manifest),记录它由谁、用什么工具生成或处理过;任何后续篡改都会让签名失效。C2PA 是内容来源与真实性联盟(Coalition for Content Provenance and Authenticity)制定的开放标准,OpenAI、Anthropic、Adobe 等均已采用。
C2PA provenance metadata: files such as images get a cryptographically signed "résumé" (a manifest) recording who produced or processed them and with what tool; any later tampering invalidates the signature. C2PA is an open standard from the Coalition for Content Provenance and Authenticity, adopted by OpenAI, Anthropic, Adobe and others.
生成时盖章 → 流通中携带 → 事后可检验:AI 内容标记的完整链路Stamp at generation → carried through distribution → verifiable afterwards: the full marking pipeline
🔑 一句话立场水印回答的是「这段内容有没有经过某个模型」,而不是「这段内容是不是 AI 写的思想」——Anthropic 官方也明确强调这一点。理解这个边界,是用好这项技术的前提。
🔑 The one-line caveatA watermark answers "did this content pass through a given model," not "is this content an AI's ideas" — a distinction Anthropic itself explicitly stresses. Understanding that boundary is the prerequisite for using this technology well.
②背景与动机:为什么是 2026 年 8 月
②Background: Why August 2026
水印研究早就有(Google 2024 年就把 SynthID-Text 开源并内建进 Gemini),但让它从「可选项」变成「必答题」的,是欧盟的监管时间表。EU AI Act 第 50 条要求:生成合成音频、图片、视频、文本的 AI 系统提供方,必须确保输出以机器可读的方式被标记、且可被检测为 AI 生成。这一义务 2026 年 8 月 2 日起适用;2026 年 5 月的 AI Omnibus 临时协议给已上市的存量系统宽限到 2026 年 12 月 2 日。2026 年 7 月 8–9 日,欧盟委员会与 AI Board 认定《AI 生成内容 Code of Practice》为合规的认可路径——签署它就是履行第 50(2)、(4)、(5) 条的官方通道。
Watermarking research is not new — Google open-sourced SynthID-Text back in 2024 and built it into Gemini. What turned it from optional into mandatory is the EU's regulatory clock. Article 50 of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text to ensure outputs are marked in a machine-readable format and detectable as AI-generated. The obligation applies from August 2, 2026; the May 2026 AI Omnibus provisional agreement grants systems already on the market a grace period until December 2, 2026. On July 8–9, 2026, the European Commission and the AI Board assessed the Code of Practice on AI-generated content as adequate — signing it is the recognised route to complying with Articles 50(2), (4) and (5).
Anthropic promptly signed that Code of Practice and, around August 10, published its concrete approach: new Claude models launching in the EU on or after August 2, 2026 ship with marking built in, and there is no regional switch — it applies globally across all products (API, the Claude apps, Claude Code, Cowork, Claude Tag); existing older models are being retrofitted. That makes Anthropic the first major lab to enable model-level text watermarking plus file signing globally by default — and the direct reason this topic heated up this week.
从研究到义务:AI 内容标记的关键时间点(来源见文末清单)From research to obligation: key dates for AI content marking (sources listed in footer)
📌 Labs are not alignedGoogle took the open-source route (SynthID built into Gemini); Anthropic went "globally on by default"; and according to The Decoder, OpenAI has been sitting on a ChatGPT text detector with roughly 99.9% accuracy for about two years without releasing it — citing concerns that translation or rewriting defeats it easily, that it could stigmatize certain groups, and likely its own business exposure. Under the same legal duty, the divergence in vendor strategy is itself worth watching.
③核心机制:两种「盖章」各自怎么工作
③Core Mechanics: How Each "Stamp" Works
3.1 统计式文本水印:在选词概率里藏信号
3.1 Statistical text watermarks: hiding a signal in token probabilities
First, some background: LLMs write token by token — at each step the model scores every candidate token with a probability, then samples one of the likely options. The watermark hooks in exactly there: following a pseudo-random rule known only to the watermarker, it quietly gives certain candidate tokens a tiny boost, without noticeably changing meaning or quality. Any single word looks perfectly normal; but across a few hundred tokens, the statistical bias — "boosted tokens show up slightly too often" — becomes detectable.
Google 官方文档描述 SynthID-Text 的具体做法叫 Tournament Sampling(锦标赛采样):候选 token 先经过随机水印函数打分「打比赛」,胜者胜出成为输出;整个过程生成开销极小,且尽量不损伤文本质量。检测时,拿着同一套水印函数对文本重新打分,统计「胜者模式」出现的强度,给出置信度分数。
Google's official docs describe SynthID-Text's specific method as Tournament Sampling: candidate tokens are scored by random watermarking functions and "compete", with the winner emitted as output; the process adds minimal generation overhead and is designed to preserve text quality. At detection time, the same watermarking functions re-score the text and measure how strongly the "winner pattern" appears, yielding a confidence score.
统计式文本水印原理示意(机制依据 Google SynthID 官方文档;Anthropic 未公开 Claude 水印算法细节)How statistical text watermarking works (mechanism per Google's SynthID docs; Anthropic has not published Claude's algorithm details)
⚠️ 注意区分Anthropic 只说明了 Claude 文本水印的性质(模型层嵌入、不影响可读性、复制粘贴后保留、「部分编辑后可能保留」),没有公开算法。上图的概率微调机制是这一类水印的通用原理(以 SynthID 公开文档为据),不代表 Claude 的具体实现。
⚠️ A distinction to keepAnthropic has only described the properties of Claude's text watermark (model-level, no impact on readability, survives copy-paste, "may persist through some editing") — not the algorithm. The probability-tweaking mechanism above is the generic principle of this watermark family (per SynthID's public docs), not necessarily Claude's exact implementation.
A text watermark hides inside the content itself; C2PA is the opposite — the information is not hidden but openly attached to the file, with cryptographic signatures guaranteeing it hasn't been altered. A C2PA manifest records what tool generated or processed the content, when, and what edits occurred; the issuer signs it with a private key. Anyone can verify with public tools: a valid signature means the record is trustworthy and the file untampered; if the file was modified without updating the manifest, verification fails. Anthropic attaches C2PA metadata to Claude-produced .svg/.png/.jpg files, meaning "Claude processed this file," with later tampering detectable.
🔑 Complementary, not either-orThe two routes cover each other's failure modes: statistical watermarks survive copy-paste and format changes but degrade under thorough rewriting; C2PA carries rich context but is stripped by a single screenshot or re-save. Hence Anthropic uses watermarks for text and C2PA for files — each on its own post.
术语小抄
watermark(水印):嵌入内容本身的隐蔽标记;manifest(清单):C2PA 附在文件上的签名履历;provenance(溯源):内容从生成到现在经历了什么的可验证记录;post-hoc detector(事后检测器):不依赖任何预埋标记、纯靠文风统计判断是否 AI 生成的分类器(如 Pangram)。
Cheat sheet
Watermark: a covert mark embedded in the content itself. Manifest: the signed record C2PA attaches to a file. Provenance: a verifiable history of what content went through since creation. Post-hoc detector: a classifier (e.g. Pangram) that judges AI-ness purely from stylistic statistics, with no pre-embedded mark.
④怎么用:嵌入与检测的实操现状
④Hands-On: Embedding & Detection Today
按「你是谁」分三种视角看实操:
Three practical viewpoints, depending on who you are:
Claude 用户 / 集成 Claude 的开发者:什么都不用配——水印在模型层自动嵌入,API、Claude Code、Cowork 全覆盖;经 AWS Bedrock、Google Cloud、Microsoft Foundry 调用时文本水印同样生效(文件签名元数据云平台未必支持)。要注意的是合规责任:Anthropic 明确说,把 Claude 集成进自家产品的开发者需要自行判断 Article 50 的哪些义务适用于自己的服务。检测工具与技术文档 Anthropic 承诺发布但暂无时间表——在那之前,第三方还无法把 Claude 水印检测接进自己的合规管线。
想给自家模型加水印的工程师:SynthID-Text 已开源,并已集成进 Hugging Face Transformers 生态——生成时传入水印配置(基于你自己的密钥),检测时用配套的 detector 类训练/加载检测器。具体 API 以 Google 官方文档与 Transformers 当前版本文档为准(接口迭代快,此处不贴可能过时的代码)。
Claude users / developers integrating Claude: nothing to configure — the watermark is embedded at the model level, covering the API, Claude Code, and Cowork; text watermarks also apply via AWS Bedrock, Google Cloud, and Microsoft Foundry (signed file metadata may not be supported on those platforms). Mind the compliance angle: Anthropic states that developers integrating Claude into their own products must determine which Article 50 obligations apply to their services. Anthropic has promised detection tools and technical docs but given no date — until then, third parties cannot wire Claude-watermark detection into their own compliance pipelines.
Engineers watermarking their own models: SynthID-Text is open source and integrated into the Hugging Face Transformers ecosystem — pass a watermarking config (keyed by your own secret) at generation time, and use the companion detector class for detection. Consult Google's official docs and current Transformers docs for exact APIs (they iterate fast; we avoid pasting potentially stale code).
Anyone verifying whether an image has a C2PA record: use the Content Credentials verify tool from the C2PA ecosystem (the web version accepts drag-and-drop), or the c2patool CLI to read and verify manifests. A valid signature means a trustworthy record; a missing manifest only means "no record," not "not AI-generated."
⚠️ 解读检测结果的四条纪律(Anthropic 官方口径)① 检出水印 ≠ Claude 撰写——人们大量用 Claude 润色、翻译、总结自己的文字,产物同样带水印;② 未检出 ≠ 人写——模型可能早于水印上线、文本被重度编辑或翻译过、片段太短不够统计、或元数据被格式转换/截图剥离;③ 短文本不可靠;④ 把水印当「AI 参与过的线索」,不要当「作者身份的证据」。
⚠️ Four rules for reading detection results (Anthropic's own framing)① Watermark found ≠ Claude authored it — people routinely use Claude to polish, translate or summarize their own writing, and the output still carries the mark; ② No watermark ≠ human-written — the model may predate watermarking, the text may have been heavily edited or translated, the passage may be too short for reliable statistics, or metadata was stripped by conversion/screenshot; ③ short texts are unreliable; ④ treat a watermark as "evidence of AI involvement," never as "proof of authorship."
Enterprise compliance: companies providing or deploying generative AI in the EU fall under Article 50 from August 2 (grace until December 2 for existing systems). Using models with built-in marking (Claude, Gemini) effectively outsources the "machine-readable marking" engineering to the model vendor — but detectability and downstream disclosure duties still need your own review. Education: more reliable detection means fewer false positives — purely statistical detectors have already led to wrongful cheating accusations; schools must equally digest that "watermark ≠ ghost-written." Publishing & platforms: third-party black-box detectors (like Pangram) produce hard-to-explain results; wiring in vendor-published watermark detection would give a signal far more reliable than style guessing. The public information ecosystem: C2PA records give news photos and official assets an infrastructure for source verification — but only display layers in browsers/platforms will bring it to ordinary readers.
🧭 A real commercial tensionThe Decoder notes that Claude is popular with students and knowledge workers precisely because its prose reads naturally; more reliable detection could deter some of those users. The tension between watermark policy and business interest is real — and one reason OpenAI has withheld its own detector.
⑥对比与选型:水印、C2PA、事后检测器
⑥Comparison: Watermark vs C2PA vs Post-hoc Detectors
Tweak token probabilities at generation to bury a statistical signal
Attach a cryptographically signed manifest to the file
Classify purely from stylistic/statistical features
Survives copy-paste
✅ Yes
❌ Lost on plain-text copy (it governs files)
✅ (needs no mark)
Survives rewrite/translation
⚠️ May persist through light edits; heavily degraded by thorough rewriting or translation (research shows one round of LLM paraphrasing pushes detection below 0.3)
❌ Stripped by screenshot/re-save
⚠️ Equally defeated by rewriting
Error profile
Clear, explainable signal; but "detected ≠ authored"
Verification is definitive; "no record ≠ not AI"
Black-box, hard to explain; documented false accusations of humans
Prerequisite
Model vendor cooperation (must embed at generation)
Rules of thumb: if you control the generation side (your own model, or a major vendor's API) → use pre-embedded marks, the most reliable option; if all you have is text of unknown origin → a post-hoc detector is your only tool, and its output must be treated as a probabilistic hint, not evidence; if what you need is an auditable file history → C2PA is the only standard answer.
⑦局限与常见坑
⑦Limits & Pitfalls
这一节把「官方承认的限制」与「研究揭示的攻击面」分开说。
This section separates vendor-acknowledged limits from research-demonstrated attack surfaces.
Vendor-acknowledged limitsAnthropic: heavy editing, translation, or format conversion can strip the marks entirely; short texts detect unreliably; a watermark indicates AI involvement, not AI authorship. Google (SynthID docs): watermarking has little room on factual responses (few "boosts" are possible without hurting accuracy); thorough rewrites or cross-language translation greatly reduce detector confidence.
Research-demonstrated attacksAdversarial evaluations (arXiv 2407.04794) show a single round of ChatGPT paraphrasing pushed detection of all mainstream watermark schemes tested below 0.3 — "using one LLM to launder another LLM's watermark" is a practical threat. Theoretical and empirical analysis of SynthID (arXiv 2603.03410) confirms moderate degradation under paraphrase attacks; other work demonstrates stealthier attacks such as PRNG hijacking (arXiv 2605.28632). Bottom line: watermarks raise the cost of disguise but are no hard wall against a determined adversary.
坑:把「检出水印」当作弊铁证。学生用 Claude 润色自己写的论文,产物照样带水印。机构如果据此直接处罚,重演的就是旧检测器时代的冤案——把水印检出当「启动人工核查」的触发器,而不是判决书。
坑:把「未检出」当人写证明。改写、翻译、截图都能洗掉标记;「没有章」永远不等于「没经过机器」。
坑:合规只做一半。用了带标记的模型只覆盖 Article 50 的机器可读标记义务;交互披露(告知用户在和 AI 对话)、deepfake 标注等义务仍需产品侧自行落实。
坑:现在就想接 Claude 水印检测。Anthropic 的第三方检测文档尚未发布(截至调研时),合规管线目前还接不了;SynthID 的检测则已可用。
Pitfall: treating a detected watermark as proof of cheating. A student who polishes their own essay with Claude gets watermarked output all the same. Institutions that punish on that basis alone will replay the wrongful-accusation era of legacy detectors — use detection as a trigger for human review, not a verdict.
Pitfall: treating "not detected" as proof of human authorship. Rewriting, translation and screenshots all launder the marks; "no stamp" never means "no machine involved."
Pitfall: doing only half of compliance. Using a marking-enabled model covers only Article 50's machine-readable marking duty; interaction disclosure (telling users they're talking to an AI) and deepfake labeling remain your product's responsibility.
Pitfall: wiring up Claude watermark detection today. Anthropic's third-party detection docs are not yet published (as of this research date), so compliance pipelines can't integrate it yet; SynthID detection, by contrast, is available now.
主页