---
title: "クロードがテキストに透かしを入れるようになりました: どのように機能し、何が欠けているのか"
description: "Anthropic は、2026 年 8 月に Claude の出力に透かしを入れ始めました。透かしの実際の内容、隠し文字ではない理由、および透かしが切れる場所は次のとおりです。"
canonical: "https://www.yaps.ai/ja/blog/ai-watermarking-claude"
language: "ja-JP"
---

エントリ 01 Analysis · 13 AUG 2026

# クロードがテキストに透かしを入れるようになりました: どのように機能し、何が欠けているのか

証明不可能な AI 執筆の終了を発表する広く共有された投稿自体が、検出器によって 100% AI とスコア付けされました。これが私たちの現状をうまくまとめたものです。ここでは、Anthropic が実際に出荷したもの、透かしで証明できることと証明できないこと、そしてその下の気まずい質問を示します。

Yaps Team 16 分で読めます

[日記に戻る](/ja/ブログ)

**このエントリーでは**

エントリー 01 · 11 セクション

- [0.0序文](#preface)
- [1.0 Anthropic が実際に出荷したもの](#what-anthropic-actually-shipped)
- [2.0非表示文字ではありません。それは思っている以上に重要です。](#it-is-not-invisible-characters-that-matters-more-than-it-sounds)
- [3.0人間がそれ自体を主張する限界](#the-limitations-anthropic-states-itself)
- [4.0誤検知の問題を正確に説明](#the-false-positive-problem-described-accurately)
- [5.0厄介な質問](#the-awkward-question)
- [6.0誰も答えていないコードの問題](#the-code-problem-nobody-has-answered)
- [7.0正直な答えは回避ではない](#the-honest-answer-is-not-evasion)
- [8.0実際にどうすればいいのか](#what-to-actually-do-about-it)
- [9.0ショートバージョン](#the-short-version)
- [10.0よくある質問](#frequently-asked-questions)
- [·クロードはテキストに透かしを入れますか?](#does-claude-watermark-its-text)
- [·透かしは非表示の文字なので削除できますか?](#is-the-watermark-an-invisible-character-i-can-delete)
- [·テキストに透かしが入っているかどうかを確認できる人はいますか?](#can-anyone-check-whether-text-is-watermarked)
- [·ウォーターマークによって誤検知が発生しますか?](#does-the-watermark-produce-false-positives)

エントリー 01 · Yaps ジャーナル
13 AUG 2026 · 16 分で読めます
分析

![いくつかの単語がかすかに輝き、隠れた文字ではなく通常の単語の選択に隠されたパターンを示す、テキスト行のあるほぼ黒のフィールド](/images/blog/ai-watermarking-claude.jpg)

0.0

## 序文

A post went around recently announcing that the era of unprovable AI writing had ended. It explained, with some drama, that Claude now signs its own work.

Someone ran it through a detector. It came back 100 percent AI.

That is not a cheap shot at the author, and it is worth sitting with rather than laughing at, because it contains the whole problem in miniature. The post was right about the news. It was also, apparently, written by the thing it was describing. And the detector that flagged it was not reading a watermark at all. It was guessing from style.

Three different things are getting mixed together in every conversation about this: what Anthropic actually shipped, what detectors actually do, and what any of it proves. They are not the same, and the gap between them is where most of the confusion lives.

01 / Live from

Aug 2

Models launched on or after 2 August 2026 mark their text at launch

02 / Hidden characters

0

It is a pattern in word choice, not invisible symbols you could strip

03 / Public detector

Not yet

Anthropic says it is working to enable third-party detection

04 / Prior art

2024

Google has watermarked Gemini text since 2024 and open-sourced the method

自分で試してみてください

もうこの記事全体を口述筆記できたかもしれません。

Yaps はあなたの音声をクリーンテキストに変換します。オフラインであっても、デバイス上で。

[ダウンロード Yaps](/ja/ダウンロード)Android · Windows · Mac · Linux

1.0

## Anthropic が実際に出荷したもの

Worth being precise, because the summaries flying around have been looser than the source.

From **2 August 2026**, models launched on or after that date mark the text they generate. Older models are described as "in progress" rather than done. It covers the Claude apps, the API, Claude Code, Claude Cowork, and Claude Tag, and it applies worldwide.

For files, Anthropic adds **signed provenance metadata** using the **C2PA** standard, the same open standard the camera and photo-editing industry has been adopting for image provenance. That covers supported file types such as `.svg`, `.png`, and `.jpg`. Cloud partners including AWS, Google Cloud, and Microsoft Foundry have platform limitations around that metadata.

One correction worth making early, because it is the thing most people get wrong: **there is no public detector yet.** Anthropic's own wording is that it is "working to enable users and other third parties to detect" the marks, with technical documentation to follow. The widely shared claim that your professor can already run the same check you can is describing a future state, not a shipped one.

> The announcement was read as "everyone can check now". What it says is "we intend to let people check". Those are very different worlds to plan around.
>
>
> Yaps

2.0

## 非表示文字ではありません。それは思っている以上に重要です。

The word "watermark" makes people picture something embedded in the file: a hidden character, a zero-width space, an invisible symbol tucked between the words. Something you could find and strip out if you knew where to look.

That is not what this is, and the misunderstanding leads people badly astray in both directions.

A language model does not write words. It repeatedly picks the next one from a ranked set of candidates, each with a probability. Usually several options are perfectly good: *begins*, *starts*, *opens*. The model has genuine freedom in that choice, and normally it picks according to those probabilities.

Watermarking uses that freedom. A secret key nudges the ranking, very slightly, toward certain candidates over others. Any single choice looks entirely ordinary, because it *is* ordinary, and every word remains a word the model might plausibly have picked anyway. But across a few hundred words, the accumulated nudges form a statistical pattern. Somebody holding the key can measure that pattern and say, with a confidence score, that the text was very probably produced by that model.

Google's SynthID, running on Gemini since 2024, works on the same principle: adjust the probability scores where doing so will not hurt quality, then detect by comparing expected scores against observed ones.

![A line of four words, three of them showing stacks of equally ordinary alternative words above, with the selected word marked in ember at each point](/images/blog/ai-watermarking-choice-point.jpg)

At each of those positions the model could have written *sentence* or *phrase* or *clause*, and any of them would have been unremarkable. The key decides which. Repeat that a few hundred times and the accumulated choices carry a measurable signal, even though no individual choice looks like anything at all.

So the watermark is not *in* the text the way a character would be. It is a property of the text, spread across all of it, in the shape of the word choices. There is nothing to find and delete. There is only a pattern that gets weaker the more you rewrite.

What people assume

### A hidden mark you could strip

An invisible character, a zero-width space, a signature tucked into the file. Find it, delete it, and the text is clean. This model is wrong, and it makes people think there is a trick that defeats the whole thing.

What it actually is

### A bias in which words got chosen

A secret key tilts the model toward some candidate words over others. Each choice looks normal because it is. Across hundreds of words the tilts form a measurable pattern. Nothing to delete, only a signal that fades as you rewrite.

3.0

## 人間がそれ自体を主張する限界

To Anthropic's credit, the documentation is fairly candid about where this stops working. Worth quoting the shape of it rather than paraphrasing it into something stronger than it is.

The mark may not survive text that is **heavily edited, paraphrased, translated, or mixed into other writing**. **Very short** passages may not carry a reliable signal at all, because the pattern needs length to become measurable. File metadata can be **stripped by format conversion, re-saving, or screenshots**. Take a screenshot of an image and the C2PA signature is simply gone.

And then the two statements that matter most, which cut in opposite directions:

**No detected mark does not mean the content is not AI-generated.** Plenty of AI text will carry no usable signal.

**A detected mark does not confirm full provenance.** It tells you a model was involved somewhere. It does not tell you who prompted it, how much a human changed afterwards, or whether the person presenting it wrote the thinking behind it.

![An ember curve descending in four steps from as written through lightly edited, paraphrased and translated, flattening near the baseline without reaching it](/images/blog/ai-watermarking-signal-decay.jpg)

The useful mental model is a fade rather than a switch. Text as the model wrote it carries the strongest signal. Light editing keeps most of it. Paraphrasing and translation strip most of what remains, because both replace the very word choices the mark is made of. What is left at the far end is weak, but weak is not the same as absent, which is why nobody should treat rewriting as a clean erasure.

Important 01

Both failure modes will be misread in practice. Institutions will treat "no mark found" as proof of human authorship, which it is not. And they will treat "mark found" as proof of cheating, which it also is not, because a student who dictated their own argument and asked a model to tighten one paragraph is in a completely different position from one who submitted generated work unread.

4.0

## 誤検知の問題を正確に説明

There has been a rush to declare that the watermark produces false positives. It is worth being careful here, because the most-cited test does not show what it is often said to show.

Andrea Saez built a statistical detector to demonstrate how this class of detection works, and ran it over her own writing. The crucial caveat is hers: she was **not testing Anthropic's watermark**, and could not, because detection requires the secret key and nobody outside Anthropic has it. She was testing the principle.

What she found is still the useful part. Her detector produced confident-looking signals on ordinary human text. Short passages threw stray high scores simply because short samples are statistically noisy. Running a full blog post lit up "every other word as red", because the tool was scoring repeated word pairs, and natural language repeats function words like *the*, *a*, and *of* constantly. Her conclusion is the line worth keeping: a statistically sound method can still produce a confident-looking false signal on ordinary text if it is not built to account for how repetitive real language actually is.

That is not a finding about Claude's watermark. It is a finding about the category, and it is a fair warning: this whole family of techniques rests on measuring patterns in word choice, and human writing is full of patterns in word choice.

Anthropic has an enormous advantage over her demo, because it holds the key, so it is measuring a specific expected pattern rather than fishing for any pattern. That should make it far more precise. But precision is a number, not a guarantee, and at internet scale even a very small false-positive rate produces a large absolute number of wrongly accused people. Nobody outside Anthropic can currently check that number, which is precisely why the promised technical documentation matters.

We wrote separately about [how AI writing detectors work and where they break](/blog/how-to-detect-ai-writing), which covers the stylistic detectors like the one that flagged that post. Those are a different and much weaker technology than watermarking, and conflating them is how people end up wrongly confident in both directions.

5.0

## 厄介な質問

Now the part that is harder to write neutrally, and worth writing anyway.

The training data for these models was, substantially, the open internet and the books on it. In Anthropic's case that is not an abstract complaint. In **Bartz v. Anthropic**, a US court found that training on lawfully acquired books was fair use, but that building a library from pirated sources was not. Anthropic settled for **$1.5 billion**, covering roughly half a million works, at about $3,000 per book, the largest copyright settlement in US history, given final approval in 2026.

So the sequence, stated plainly: the corpus was assembled partly from work taken without asking. Now the output gets marked so that its provenance can be established.

It is not hypocrisy exactly, and it is worth resisting the easy version of that argument. Watermarking is a genuinely good thing to have. Provenance for synthetic media is one of the more important problems of the decade, and a lab voluntarily marking its own output before regulation compels it is better than the alternative. Google did it first and quietly. Anthropic doing it publicly raises the floor for everyone.

But the asymmetry is real and it should be named. Attribution is being applied rigorously in the direction that protects the model's outputs, and was applied loosely in the direction that would have protected the writers who supplied the inputs. The authors whose books were in that library did not get a watermark. They got a settlement, years later, after litigation.

> The internet was read without asking. The output is marked without asking. Both decisions were made by the same party, and neither was made by you.
>
>
> Yaps

6.0

## 誰も答えていないコードの問題

Claude Code is listed among the covered products. The documentation does not spell out how marking applies to generated code, and that gap is worth flagging rather than filling in with assumptions.

Here is why it is a genuinely harder case than prose.

Watermarking works by exploiting freedom of word choice. Prose has enormous freedom: a dozen words fit most slots. **Code has far less.** Variable names are somewhat free, but syntax, API calls, argument order, and control flow are constrained by correctness. There is no synonym for a closing brace. The room available to encode a pattern is dramatically smaller, which means either the signal is weaker in code, or the tilt has to push harder against choices that actually matter.

That second possibility is the one to watch. In prose, nudging *begins* to *starts* costs nothing. In code, if a bias ever nudged the choice of one construct over another, you would have a system optimising partly for provenance rather than entirely for the correctness of what you asked for. Even a small tilt in that direction is a different product than the one developers think they are buying.

To be clear about what is known: **there is no evidence this is happening**, and nothing in the documentation says it does. The point is that the documentation does not say it does not, either, and the priority ordering between "mark this output" and "answer this request as well as possible" is exactly the thing a developer would want stated explicitly. It is the most reasonable open question in the whole announcement.

What the mark can tell you

04

- A model was involved somewhere in producing this passage, with a confidence score.
- It survived copy and paste because the pattern lives in the words, not in the file.
- A file kept its metadata if it was not converted, re-saved, or screenshotted since.
- The passage is long enough to carry a measurable signal in the first place.

What it cannot tell you

05

- Who did the thinking a mark says a model touched it, not who authored the argument.
- That text is human no mark found is not evidence of human authorship.
- How much was edited a lightly tidied draft and a wholly generated one can look alike.
- Which model, across labs each lab holds its own key; there is no shared registry.
- Whether it was fair provenance is a technical fact, not a judgement about honesty.

設計によりプライベート化

Yaps が聞いたものはすべてデバイスに残ります。

ディクテーション、音声メモ、読み上げ。あなたが言ったことはすべてあなたのデバイスに残ります。

[ダウンロード Yaps](/ja/ダウンロード)Android · Windows · Mac · Linux

7.0

## 正直な答えは回避ではない

There is a version of this article that tells you how to launder watermarked text. Paraphrase aggressively, run it through translation and back, chop it into short pieces below the detection threshold. All of that reportedly works to some degree, and Anthropic says as much in its own limitations.

That advice is worth skipping, for a reason that has nothing to do with morality and everything to do with it being a bad plan.

You would be spending real effort to make a machine's writing pass as yours, in a world where the checks are getting better every year and the archive is permanent. The work of disguising it is not obviously less than the work of writing it. And the thing you would be protecting is a draft you did not think through, which is usually the actual problem rather than the detection.

The durable position is not "text that beats the detector". It is **text where the provenance question does not arise, because the words are yours**.

That sounds like a call for slow, laborious typing. It is not. Typing was always the bottleneck, and it is the reason people reached for generated prose in the first place: not because they had nothing to say, but because getting what they had to say into a document was slow enough to be worth outsourcing.

Speaking is not slow. Most people talk at around 150 words a minute against 40 typed. Dictate the thing and you get your own argument, your own phrasing, your own examples, at roughly the speed you were using a model to avoid.

That is the whole case for [dictation](/features/dictation) here, and it is worth being precise about what it does and does not involve. With Yaps, speech becomes text on your own machine. Nothing is sent to Anthropic, or to Google, or to us. There is no model composing sentences on your behalf, so there is nothing for a watermark to be woven into, because a watermark can only exist where a model chose the words.

The honest caveat: Yaps does run a small on-device cleanup pass that strips filler words and fixes punctuation and capitalisation. That is a model touching your text. The distinction that matters is that it tidies what you already said rather than deciding what to say. Your sentences, your structure, your argument, with the *ums* removed. If that distinction ever stops being true of a tool you use, the provenance question comes back, and you should want to know.

Scroll

| What matters | Dictating it yourself | Generating then editing | Generating and sending |
| --- | --- | --- | --- |
| Whose words they are | Yours | Mixed, hard to characterise | The model's |
| Anything to watermark | No, no model composed it | Partly, and unpredictably | Yes |
| Speed against typing | About 3x faster | Fast, then slow to fix | Fastest |
| Survives a policy change | Yes, nothing to detect | Unclear | No |
| Leaves your device | No, runs on device | Yes, sent to the provider | Yes |
| Contains your actual thinking | Necessarily | Sometimes | Not reliably |

**Where a model is still the right tool.** None of this is an argument against using one. Ask it to check your reasoning, to find the hole in an argument you dictated, to explain something you do not understand, to review code. Those uses do not involve passing its prose off as yours, so the watermark is irrelevant to them. The narrow thing that changed is the economics of having it write *for* you, in your name, in contexts where authorship is the point.

8.0

## 実際にどうすればいいのか

**If you write for work.** Nothing urgent, and no reason to panic about your archive. Know that generated prose is becoming traceable in principle, and that your own words never were. If you have been using a model to draft things you will sign, that is the habit worth revisiting, not last year's emails.

**If you teach or run a team.** Please do not build a policy on this yet. There is no public detector, both failure modes are live, and stylistic detectors like the one that flagged that post are much weaker than watermarking and already produce false accusations. A tool that says 100 percent with a confident dial is not evidence of anything on its own.

**If you are a student.** The dial can be wrong in both directions, and being wrongly accused is a genuinely horrible experience that is now more likely, not less. Keep drafts. Keep version history. Dictating your first draft has the useful side effect of leaving a trail that is actually yours.

**If you write code.** Watch for clarity on how marking interacts with generated code, and treat its absence as an open question rather than a settled one.

9.0

## ショートバージョン

Anthropic began marking Claude's output on 2 August 2026, using a statistical tilt in word choice rather than hidden characters, plus C2PA metadata on supported files. There is no public detector yet, despite widespread claims otherwise. The mark degrades under paraphrasing, translation, and short passages, and its absence proves nothing.

The company that trained on a partly pirated corpus is now the one insisting on provenance. That is worth noticing without pretending the watermark is a bad idea, because it is a good idea introduced by an awkward party.

The response that survives all of it is not a laundering technique. It is writing things you actually wrote, fast enough that doing so is not a sacrifice. Dictate the draft, keep it on your machine, and the question of what a detector thinks stops applying to you.

01 Yaps をお試しください

## Write at the speed of talking, in words that are actually yours.

Yaps runs on Android, Windows, macOS, and Linux. Dictation happens on your device, so nothing is uploaded and nothing is watermarked.

[ダウンロード Yaps](/ja/ダウンロード)or[yaps.ai](/ja)

携帯電話のカメラでスキャン

10.0

## よくある質問

### Does Claude watermark its text?

Yes. From 2 August 2026, Claude models launched on or after that date embed a mark in the text they generate, covering the Claude apps, the API, Claude Code, Claude Cowork, and Claude Tag worldwide. Older models are described as in progress. For supported file types such as SVG, PNG, and JPG, Anthropic also attaches signed provenance metadata using the C2PA standard.

### Is the watermark an invisible character I can delete?

No, and this is the most common misunderstanding. There are no hidden symbols or zero-width spaces to find. The model tilts its word choices very slightly according to a secret key, so every individual word looks completely ordinary, and the pattern only becomes measurable across a few hundred words. There is nothing to strip out, only a signal that weakens as text is rewritten.

### Can anyone check whether text is watermarked?

Not yet. Anthropic's documentation says it is working to enable users and third parties to detect the marks, with technical documentation to follow. Claims that your professor or employer can already run the same check are describing an intention rather than a shipped capability. Detection requires the secret key, which is why nobody outside Anthropic has been able to test the real watermark.

### Does the watermark produce false positives?

Nobody outside Anthropic can currently measure that, because testing requires the key. What has been demonstrated is that this general class of statistical detection can produce confident-looking signals on ordinary human writing, particularly on short passages and on text with heavy repetition of common function words. Anthropic holds the key and is checking for a specific expected pattern rather than fishing for any pattern, which should make it far more precise, but the actual rate is unpublished.

### Does paraphrasing remove the watermark?

Anthropic's own documentation says the mark may not survive text that is heavily edited, paraphrased, translated, or mixed into other writing, and that very short passages may not carry a reliable signal. So yes, in practice, aggressive rewriting degrades it. That is a stated limitation rather than a loophole, and building a workflow on it means doing roughly as much work as writing the thing yourself.

### Does a watermark prove someone cheated?

No. A detected mark indicates a model was involved somewhere; it says nothing about who did the thinking, how much a person changed afterwards, or whether the work was presented dishonestly. Anthropic states directly that a detected mark does not confirm full provenance. Someone who dictated their own argument and had a model tighten a paragraph is in a completely different position from someone who submitted generated text unread.

### Is Google doing this too?

Yes, and earlier. Google has watermarked Gemini text with SynthID since 2024, using the same underlying principle of adjusting token probabilities where it will not hurt quality, and open-sourced the method through Hugging Face and its Responsible Generative AI Toolkit. Anthropic joining means the two most-used writing models both mark their output, though each lab holds its own key and there is no shared registry.

### What is C2PA and how is it different from the text watermark?

C2PA is an open standard for attaching signed provenance metadata to files, widely adopted across the camera and photo-editing industry. It is separate from the text watermark: the metadata rides along with the file rather than living in the content. That makes it more precise but much more fragile, since format conversion, re-saving, or simply taking a screenshot removes it entirely.

### Does this apply to code written by Claude Code?

Claude Code is listed among the covered products, but the documentation does not spell out how marking applies to generated code, so this is best treated as an open question. Code is a harder case than prose because watermarking works by exploiting freedom of word choice, and syntax, API calls, and control flow are constrained by correctness in a way that prose is not. There is no evidence that marking affects code quality, and nothing states that it does not either.

### Why is Anthropic watermarking controversial?

Because of the sequence. A US court found that Anthropic's use of pirated books to build a training library was not fair use, and the company settled for $1.5 billion covering roughly half a million works at about $3,000 per book, the largest copyright settlement in US history. The same company now applies rigorous provenance marking to its own outputs. Watermarking is genuinely worth having, but the asymmetry between how carefully attribution is handled on the way out versus the way in is a fair thing to notice.

### How do I use AI without my writing being watermarked?

By using a model for the parts that are not writing. Ask it to check your reasoning, find holes in your argument, explain something, or review code; none of that involves presenting its prose as yours. For the writing itself, dictating is roughly three times faster than typing and produces your own words, so there is nothing for a watermark to exist in. With Yaps that speech becomes text on your own device, so nothing is sent to any model provider in the first place.

### Does dictation count as AI-generated text?

Not in the sense the watermark is concerned with. Dictation transcribes words you chose and said; it does not compose them. Yaps does run a small on-device cleanup that removes filler words and fixes punctuation, which is a model touching your text, but it tidies what you said rather than deciding what to say. Your sentences and your structure survive intact, which is the part authorship actually turns on.

### Should schools use watermark detection to catch students?

Not on current information. There is no public detector, absence of a mark proves nothing, presence of a mark proves less than people assume, and the stylistic detectors already in use produce false accusations at a meaningful rate. Our guide to [how AI detectors work and where they break](/blog/how-to-detect-ai-writing) covers why a confident-looking percentage is not evidence. Asking students to keep drafts and version history is a far better policy than any detector.

Yaps ジャーナルは Yaps で書き込まれます

あなたの声を活かしてください。

乱雑な音声入力、すぐに貼り付けられるきれいなテキスト出力。プライベート、オフラインファースト、そして無料で始められます。

[ダウンロード Yaps](/ja/ダウンロード)Android · Windows · Mac · Linux

読み続けてください

## 読み続けてください

[ANALYSIS · 16 MIN READ Can the Government Shut Down an AI Model? Anthropic Just Did](/ja/ブログ/政府-停止-ai-モデル-オープン-ソース) [GUIDE · 13 MIN READ Microsoft Teams Is Blocking AI Notetaker Bots: Take Notes Anyway](/ja/blog/teams-blocking-ai-notetaker-bots)

**Yaps 日記** · 2026 · エントリ 01

[について](/ja/概要) [ブランド](/ja/ブランド) [キャリア](/ja/採用情報) [RSS](/blog/rss.xml) [アーカイブ](/ja/ブログ) [サイトマップ](/sitemap.xml)