$ cat wiki/concepts/content-provenance.md
Content Provenance (AI output marking)
Definition
Making a model's output identifiable as machine-generated after it has left the API. Two techniques are in deployment, and they are not the same thing:
- Watermarking — a statistical signal embedded in the output as it is generated, invisible to a person, detectable by a matching detector. It rides inside the content, so it survives copy-and-paste.
- Signed provenance metadata — a cryptographic manifest attached to a file, most commonly under the C2PA standard. Verifiable and tamper-evident, but it is metadata, so anything that strips metadata strips it.
The distinction matters because they fail in opposite directions: a watermark survives re-hosting and dies to paraphrase; C2PA survives paraphrase of the pixels and dies to a screenshot.
Why It Matters
A legal obligation now exists where a working technology does not. Article 50 of the EU AI Act became applicable on 2026-08-02 and requires AI-generated output to be marked in a machine-detectable form (Article 50 guide). Reporting read alongside states that no single watermarking technology currently meets all four criteria Article 50 imposes — effectiveness, interoperability, robustness and reliability (source).
That gap is the whole subject. What labs ship under this heading is a best effort against a deadline, and the honest ones say so in the release.
For this wiki specifically: marking is the first governance requirement that changes what the models themselves do at generation time, rather than what a lab must publish about them. AI Governance tracks the rules; this page tracks whether the mechanism works.
State of the Art (as of 2026-08-12)
Anthropic marks Claude output worldwide (announced 2026-08-11, effective 2026-08-02)
Anthropic applies machine-readable marking to content from supported Claude models (source) (TechCrunch):
- Text: an imperceptible pattern inserted directly into generated text, expected to survive copy-and-paste and some editing
- Files: digitally signed C2PA provenance metadata on generated SVG, PNG and JPG files
- Applied at the model level to new Claude models launched from 2026-08-02; older models are described as a work in progress during the EU AI Act transition period
- Applied worldwide, not only in the EU, across Claude Platform (API), Claude, Claude Code, Claude Cowork and Claude Tag
Anthropic publishes the limits itself: a detected mark is not conclusive evidence Claude produced the content, and the absence of a mark does not guarantee AI was not involved. Detection can fail on text that is heavily edited, paraphrased, translated, mixed with other writing, or too short (source) (The Register).
SynthID as the cross-vendor layer
Google has open-sourced SynthID text watermarking and partners with Apple, ElevenLabs, Kakao, NVIDIA and OpenAI on interoperable marking (source) (GCN). SynthID audio is reported as embedded in all GPT-Live output through ChatGPT Voice and the OpenAI API as of 2026-08-01 (source).
So the deployment order across modalities is audio and images first, text last — text being reported as the hardest and least widely deployed (source).
The EU Code of Practice is voluntary
Adherence to the Code of Practice on Transparency of AI-generated Content is voluntary; providers who do not sign must demonstrate compliance another way and may face greater scrutiny (EC). The obligation in Article 50 is not voluntary; the named route to satisfying it is.
Open Problems
- Paraphrase defeats it. A not-yet-peer-reviewed evaluation of three representative watermark schemes reported that meaning-preserving paraphrasing removed nearly all detectable marks in the tested configurations, with already-high false negatives in some baselines (source). The evaluation itself was not read here — recorded as a claim to check, not as a finding.
- Code is close to unmarkable. Programming-language syntax leaves few
positions with equivalent alternatives to carry a signal, and a pass of
prettier,blackorgofmtrewrites style deterministically (The New Stack). This is a pointed limitation for a vendor whose flagship surface is an agentic coding tool. - Streaming narrows the technique space. The signal must be inserted while generating, not by rewriting a finished passage (The New Stack).
- No public detector. As read, there is no named list of marked models and no detector third parties can use (source). A mark nobody outside the lab can check is a compliance artefact before it is a transparency one — and it puts attribution back in the hands of the party being asked about.
- The mark proves processing, not authorship. TechTimes' framing, and it is the correct reading of Anthropic's own caveats: a watermark says text passed through a model, not that a model composed it, and not who prompted it (source).
- Forensic marks are already being used as evidence in trade policy — Treasury's July 21 distillation case cited "American model watermarks inside Chinese products" (AI Governance). What that referred to, and whether it is the same class of mechanism as Article 50 marking, is unresolved in anything this wiki has read.
Key Papers
None held. Everything on this page is vendor documentation, regulation and press. The paraphrase-robustness evaluation named above is the obvious gap — if it surfaces with an identifier, it belongs here.