Paste a paragraph into Claude to fix the grammar, and something new comes back with the corrections.

A hidden signal, woven into the words:

“WRITTEN BY CLAUDE”

You cannot see it. You cannot remove it by hand. It travels when you copy and paste.

Here is what a watermark actually is, and what it changes for how we write and review. I also got one part of this wrong, and I will show you where.

👋🏽 First a quick announcement: I would love to have you in my 5-Week LIVE AI Academic Writing Accelerator (Complimentary with Research Boost subscription) • Starts September • Only 100 Seats → Apply for Your Seat HERE

1. What exactly happened

Anthropic announced on August 11 that it will mark the output of Claude.

The rule covers models launched on or after August 2, 2026. Older models are next. It applies worldwide, on every Claude product, and through AWS, Google Cloud, and Microsoft Foundry.

The trigger was the EU AI Act. Article 50(2) tells providers to mark synthetic content in a machine-readable format. OpenAI, Google, Meta, Microsoft, Mistral, and Cohere signed the same code. Expect them to follow. xAI has not signed.

NOTE: The code is voluntary, and the Commission states that non-signature “does not constitute non-compliance.”

2. What a watermark actually is

Two different technologies carry this name, and they behave differently.

The text watermark

This is the one that matters for manuscripts and grants. Anthropic describes it as an imperceptible signal woven into the text. It does not change the meaning or quality of the writing. Anthropic did not publish its method, but the research literature shows how this class of method works.

A language model picks each word from probabilities. At every step it holds a ranked list of plausible next words. The foundational 2023 paper by Kirchenbauer and colleagues splits that vocabulary in two. One half becomes a “green list,” the other a “red list.” Green words get a small bonus. The text still reads normally, because the model chose among acceptable options anyway. A party with the key counts the green words.

The signal lives in the statistical fingerprint of the word choices. It is not a hidden character or an invisible font.

Provenance metadata

This applies to files, not prose. Anthropic attaches signed metadata to .svg, .png, and .jpg files, following the C2PA provenance standard. Think of it as a tamper-evident label on the outside of the file. It matters only if you use AI-generated figures, and most journals do not allow them.

How much text the mark needs. Kirchenbauer reports detection from as few as 25 tokens, about 15 to 20 English words. One corrected sentence sits near that floor. A corrected paragraph sits well above it.

What breaks the mark. Anthropic lists 4 conditions:

Condition	Effect
Text is heavily edited, paraphrased, translated, or mixed	Watermark can be lost
Passage is very short	Too little text to hold a reliable signal
File is converted, re-saved, or screenshotted	Metadata is stripped
Content comes from an unsupported platform or file type	No mark applied

Who it catches. Note the asymmetry:

• Researcher A wrote every sentence and asked Claude to fix the grammar. They changed far less than a quarter of the words, so their mark survives.
• Researcher B had AI write the whole paper, then ran one paraphrasing pass, and detection fell to about 53%.

The mark is most durable on the people using AI the way the guidelines intend.

Who can read it. Nobody yet, outside Anthropic. Detection tools are promised, not delivered.

What Anthropic says it means. A detected mark is “not fully conclusive.” Claude “may not be the original author,” because people use it to proofread and summarize. That sentence is why a watermark must never become a proxy for “AI slop”.

3. A watermark is not an AI detector. I conflated them, and you will too.

For 2 years the fight was about classifiers. Turnitin. GPTZero. These tools read your writing style and guess.

Liang and colleagues at Stanford ran 7 classifiers over 91 TOEFL essays by non-native English writers. Average false positive rate: 61.22%. For US eighth-grade essays: 5.19%. Classifiers measure lexical diversity, not authorship. They punished the writers with the smallest vocabulary range.

A watermark is different. It never reads your style. It runs a statistical test for a keyed token pattern, with a false positive rate set by mathematics rather than prose. Kirchenbauer’s threshold gives about 3 in 100,000.

AI detectors hurt international researchers most. The watermark, in theory, cannot, because it never looks at how the sentence sounds.

4. Where the real danger moved: spoofing

If a watermark can be read, it can be forged.

Jovanović, Staab, and Vechev showed this at ICML 2024. Their finding: “for under $50 an attacker can both spoof and scrub” state-of-the-art watermarks. Spoofing lets somebody stamp an AI watermark onto text a human wrote.

Picture the grievance cases your institution already handles. A disputed authorship order. A hostile reviewer. A lab conflict that ended badly. Now add a tool that costs less than a submission fee and makes an innocent researcher’s chapter test positive.

That is the harm to plan for. Not a classifier flagging your careful English. A cheap forgery that a committee treats as proof.

5. What the mark says, and what your reviewer will hear

3 claims sit on top of each other, and we need to separate them.

• What the watermark certifies: Claude processed these words.
• What your reviewer will hear: Claude wrote this paper.
• What the rules actually regulate: whose ideas these are, and who takes responsibility.

NIH Notice NOT-OD-25-132 states that NIH “will not consider applications that are either substantially developed by AI… to be original ideas of applicants.” Note the target. Original ideas. Not word processing. ICMJE bars AI authorship on the same logic.

Neither rule mentions word-level provenance, because that was never the point. A watermark on your Discussion section tells you nothing about whether the hypothesis was yours, whether the analysis is sound, or whether the finding replicates.

The regulation agrees. Article 50(2) carries its own exemption. The obligation “shall not apply to the extent the AI systems perform an assistive function for standard editing.” Article 50(4) exempts published text that “has undergone a process of human review” where a person holds editorial responsibility.

COPE already told editors that “AI indicators are still inconsistent” enough that their output cannot be relied upon.

6. Two problems specific to us

Watermarking is not free in medical text. Rieff and colleagues benchmarked five schemes across 11 models on clinical reasoning. Watermarking “can induce substantial degradation” through lexical corruption and hallucinated terminology. Google reported no quality cost at all. Both are true. A distribution-preserving watermark protects the aggregate output, not one response’s precision. In terminology-dense clinical writing, a token swap that looks harmless in aggregate can be clinically wrong.

Our reviewers are past their limit. Editors now need an average of 4.5 invitations to secure one review, nearly double the 2018 rate. A watermark scan costs less than reading the Methods section, and returns a number that feels like evidence. Predict what happens.

7. The disclosure decision has been made for you

Schilke and Reimann ran 13 experiments with 4,093 participants. Their finding is unambiguous: “an actor exposed for using AI will be trusted least.” Exposed 2.49. Disclosed 3.15. Silent 4.02.

Silence here is definitely not a good strategy. Now, a watermark turns every silent use into a future exposure. You cannot decide whether the record exists. You decide only whether your account or the mark speaks first.

Your Acknowledgements section has one job now. Say more than the watermark can.

Not this: “AI was used in the preparation of this manuscript.”

This instead: “Claude Opus 5 (August 2026) was used for grammar and clarity editing of author-written text. All ideas, analyses, and interpretations are the authors’ own. The authors verified every citation.”

Placement depends on the journal. COPE says Methods. ICMJE says cover letter plus the appropriate section. Elsevier wants a separate declaration, and states that basic grammar checks need none at all.

8. What to do this month

Nature surveyed 5,000 researchers and found more than 90% comfortable using AI to edit their writing. Within 2 years most manuscripts will carry a mark, then nearly all, and a label on every paper distinguishes between none of them. The transition is the dangerous part, and it starts now.

1. Write your disclosure language now. Name the tool, the task, and what stayed human. Put it in your Acknowledgements template.

2. Keep receipts by default. Dated outlines. Version history. Analysis notes. A watermark records that a model was present. Your version history records what you did. Since spoofing costs under $50, that trail is the one defense that does not depend on a vendor.

3. Set the norm in your group out loud. One sentence: tell me what you used and how you checked it. Destigmatize it. Otherwise, you are only going find out in journal correspondence.

4. Never paraphrase just to strip a mark. It works, and that is the problem. It remains concealment with extra steps.

5. On an editorial board? Write the policy first. Elsevier, Springer Nature, Wiley, Taylor & Francis, PLOS, and JAMA do not yet have a policy on watermarks or C2PA provenance. Whoever moves first will fill that gap.

The mark is coming to your manuscripts whether you consent or not. The story it tells about your work is still yours to write, if you write it first.

AI literacy matters for exactly this. Your institution will write its first watermark policy soon, and somebody in that room needs to tell a watermark from a classifier.

Top Papers on AI in research this week:

1. AI Isn’t Ready to Research Itself – Princeton’s team turned an agentic system loose on two computer science papers, then asked the original authors to grade the output. Scores came back 2 out of 6 and 1 out of 6. The agent ran hundreds of experiments without collapsing into error loops, but it locked onto early hypotheses and rarely backtracked.
2. LLM-Polished Grant Proposals – Northwestern analyzed 5,700 confidential NSF and NIH proposals alongside 131,000 public awards. Proposals with strong AI writing signals were about 4 percentage points more likely to win NIH funding. They were also less semantically distinctive, and the resulting projects produced more papers without more highly cited ones.
3. LLM Fingerprints Across Biomedicine – Kobak’s group measured excess LLM-associated vocabulary in full texts from PubMed Central. By late 2025, 89% of open access biomedical papers carried the signature. Discussion sections were flagged twice as often as Methods, at 68% versus 32%.
4. Models Can’t Spot Junk Science – The TRACES benchmark fed 30 models 42 retracted, fraudulent, or pseudoscientific papers. Models engaged with untenable premises in 95% of non-empty responses. Every model failed more than 71% of agentic probes, and 22 of 30 failed over 90%.
5. Agents That Botch the Statistics – P-Bench put LLM agents through 425 realistic hypothesis testing scenarios drawn from economics, biology, and medicine. The agents ran analyses correctly, then made subtle statistical errors. Fisher-R1, trained with reinforcement learning on verified statistical rewards, beat DeepSeek-V4-Pro by 21% on average.
6. Rare Disease Diagnosis Reality Check – A meta-analysis pooled 15 studies covering 39,529 cases. The top-ranked diagnosis was correct 43.3% of the time. Retrieval, reasoning, or fine-tuning lifted that to 52.5% against 35.4% for standalone models, though data leakage in retrospective benchmarks clouds the picture.
7. Clinicians Versus AI in the ICU – Models trained on 46,631 ICU admissions went head to head with bedside clinicians on 238 prospective admissions. AI beat most individual clinicians. Seven clinicians pooled together beat the AI, subspecialists beat it on their own, and the hybrid usually won.
8. Personas Change Tone, Not Reasoning – GPT-5 simulated a gastrointestinal tumour board across 100 cases under six prompting frameworks. Specialty-specific language appeared 97% to 100% of the time. Underneath, outputs stayed nearly identical, with cosine similarity between 0.805 and 0.836 and no significant difference in concordance.
9. Two Kinds of Pathologist – Twenty-one pathologists read 30 difficult rare renal cancer cases with and without AI support. Accuracy climbed from 60.0% to 73.3%. Readers split into receptive and resistant groups independent of experience, and the receptive ones gained more while also getting misled more.
10. Watermarks and the Peer Review Problem – Claude models released after August 2 now embed statistically detectable text watermarks, driven by EU AI Act deadlines. Researchers doubt this stops determined bad actors, since paraphrasing through another model strips the signal. ICML 2026 did use watermark detection to catch 506 reviewers violating its no-AI policy.

Top Papers on AI in education this week:

1. Child Modes Aren’t Actually Safer – The KORA benchmark ran 14,839 simulated conversations across 12 AI products and 19 child or adult variants. 41% of exchanges failed. Across seven matched pairs, there was no statistically significant safety gap between child mode and adult mode.
2. Take-Home Exams Are Broken – A Brown economist watched his take-home midterm average hit 96%, against a historical band of 65% to 80%. He moved the final in person. The average fell to 48.6%, and several students dropped the course.
3. Safety and Teaching Pull in Opposite Directions – ELBench scored nine models on general capability, safety, basic education, and higher-level cultivation. Safety and practical teaching ability correlated at r = -0.83. The top six models were statistically indistinguishable overall, and neither education-specialized model led either education module.
4. Teaching a Tutor to Withhold the Answer – A deployed system enforces answer-withholding with a non-LLM policy core, a deterministic code detector, and a separate judge auditing risky replies. The motivating evidence is sharp. Students on an unguarded chatbot scored higher during practice, then worse on a later unaided test.
5. Inside Khanmigo – Khan Academy published the metrics it uses to judge AI tutoring quality and student engagement at classroom scale. The paper reports which changes actually moved those metrics, spanning model swaps, prompting, personalization, and agents. This kind of industry transparency is rare.
6. What Students Actually Say to Tutors – Every student turn from a Socratic AI tutor in an intro mechanics course was coded and clustered into 357 categories. The top 25 cover roughly half of all turns. Equation handling dominates, alongside meta-procedural requests where students hand strategic control to the tutor.
7. Students Wrote Their Own AI Policy – Ninety-eight high schoolers from all 50 states drafted the STUDENTS FIRST Act over three days in Boston. It asserts a right to refuse AI with alternative assignments offered. It also bars AI as the sole basis for a grading decision.
8. Singapore Goes All In – The National University of Singapore is giving ChatGPT Edu and Codex to every student, faculty member, and staff member. An OpenAI survey of 514 Singapore students found 94% using AI several times a week or more. Course integration starts with pilots before the wider undergraduate rollout.
9. Predicting Courses and Grades Together – TRACE is a transformer trained on ten years of institutional records. It predicts next-semester enrollment and the grades that follow in one shot. Modeling course concurrency mattered, cutting mean absolute error by close to half versus the same architecture predicting grades alone.