Under what circumstances does the metadata get added? When Claude Code CLI needs a media file usually I just see it run an imagemagick or ffmpeg command to create one, which isn't going to have C2PA metadata.

Edit: I asked Opus 5 for "a jpg of a cat" via the web chat. It did it by writing an svg and then rendering that to a jpeg. Clicking the "download" button saved a jpg which did have C2PA metadata, seemingly injected by the artifact-presentation thing.

Then I told it to put it in a zip file. I downloaded the zip, and the extracted jpeg had no C2PA metadata.

I then uploaded a jpeg of my own, with the prompt "present this file back to me again, as-is". The downloaded file had C2PA metadata injected.

Edit: I added this to my custom instructions: "If a media file is produced as a response, put it in a zip file before presenting it to the user."

As far as I can tell, this and the recent change to add watermarking to text outputs[1], is to become compliant with the EU AI Act[2] and CA's AI Transparency Act[3], SB-942[4]. For large enough companies, all generated AI content is required to have watermarking.

[1] https://www.anthropic.com/news/claude-text-watermark

[2] https://digital-strategy.ec.europa.eu/en/policies/code-pract...

[3] https://www.kqed.org/news/12095398/new-california-law-requir...

[4] https://www.leginfo.legislature.ca.gov/faces/billTextClient....

This is just C2PA for Claude-processed files, apparently. It's not related to their text watermarking.

C2PA is file metadata and can be trivially stripped away, unlike hidden watermarks, e.g. SynthID.

This is really fascinating. Even the AI companies have incentives to reject AI generated content. It's like they want you to use AI for everything, but they don't want AI output fed back to them.

At work, right after an AI training, we were asked to use our "authentic" voice when writing mid year reviews.

What is interesting to me is that stripping the C2PA data is easy, but faking it is hard.

You can resave the file and the "made with Claude" signal disappears, but you cannot make a random file pass as Claude-made without Anthropic's signing key. So the useful guarantee is one-way. No signature means almost nothing.

Up next:

1. Generate a bunch of responses with both Claude and various non-Claude LLMs (ChatGPT, Gemini, Kimi)

2. Train a discriminator model that can differentiate Claude vs. non-Claude

3. Train a de-watermarking model using the discriminator model as loss

The idea of forcing an entity (or entire categories of entity) to add traceable watermarks to all the work they create is... an interesting precedent.

Translating that into the human realm, it would be like if every digital thing you touched were "fingerprinted" with your identity, or at least with a proof of what category of individual you have been categorized as.

Due to the flood of AI, which may soon become indistinguishable from human video, I expect to see something similar. Blue checkmark, but for humans.

This thing works using WebAssembly - https://claude.com/_next/static/media/c2pa_verify_wasm_bg.53... - which is a WASM compiled version of this Rust library: https://github.com/contentauth/c2pa-rs

Could this be used to perform some sort of distillation or exploit? e.g. reminds me of the OWASP guideline on attack vectors where knowing if an ID is present or not in the database can be a form of exploit, like in password resets where they will say 'email foo@bar.com not found' rather than 'If foo@bar exists we have sent an email to foo@bar' or some other generic equivalent

Does code also get watermarked? Surely you can't add non printable characters, except perhaps in comments?

How long before they change the terms and conditions to subtly claim ownership of your files? When you write code they already insert Co author attribution/

Say I write a text by hand And then I tell it to clean up the grammar and fix some sentences Did it make it?

This is also interesting for those companies that siphoned the entire open web

I think all of this it's so they don't get ai generated content in their training data

I think this is primarily done so as not to train models on one's own neuroslope data.

Off topic: Is the grammar off here? Shouldn't it be "by Claude" instead of "with Claude"?

>Supported formats: JPG, PNG, GIF, WEBP, TIFF, HEIC, AVIF, SVG, DNG, JXL, MP4, MOV, AVI, WAV, MP3, M4A, FLAC · up to 100 MB

I'm wondering why they have restricted file types. You can't check a PDF for example... surely the main use case for people will be to check if a document was produced or edited by an LLM? That could be an attractive (if not misunderstood) proposition for academics

Tried one of simonwillison's pelicans: We didn’t find any signs this file was processed by Claude!

I just made a figure with Claude and fed it to the tool, which told me there was no evidence it was made with Claude.

So… this utility appears to be pretty worthless.

Unfortunately this is just for Media? Some manual tells for Excel or PDFs is to check the author. Claude creates PDFs via wkhtmltopdf so the PDF Producer will be Qt and the Content Creator is wkhtmltopdf. Xlsx files are being created via openpyxl so in the metadata that is the author.

I could do without more surveillance.

For anyone wondering who the text watermarking works:

  Instead of using an arbitrary random number generator
  to pick the next word, watermarking uses a secret key
  and a few words that come before to settle what
  word the model should pick.

https://www.anthropic.com/news/claude-text-watermark

* Edited the above from initially asking if anyone has any ideas how it works. Found the answer, rewrote the comment.

Like so many things with AI, I like this and hate it at the same time.

The actual implementation matters less than the fact that they can be perceived to be working on something. You're never going to have a perfect solution here, and perfect is the enemy of good.

Is this a trick to get more data to train on?

droped some source files from different languages and i could process non of them

The primary functionality is that LLM text is watermarked, but this tool doesn't accept any text formats as input...

Can't they just store checksums of all their output

> Knowing where content came from, and whether AI was involved, makes it easier to trust what you see online.

That’s a cute way to imply their service is used to generate misinformation. They are basically saying to not trust the AI content made from their own product :)

A watermark answers "did this model touch the file?" It doesn't answer "did a person read it and stand behind it?"

Detection will get gamed, and a lot of useful text is already mixed. The more useful check, for me, is still human: would I put my name on this before it goes out?

To see the signed metadata: go to claude.ai and ask: "generate an image of a cat". When you'll go to download the image, it will offer an SVG and a PNG version that both have the metadata.

In the case of SVG, it's literally `<metadata><c2pa:manifest>(signature)...` right after the <svg> tag. In the case of PNG, it's stuffed as a `caBX` chunk.

To declaw these files, you can ask in your CLAUDE.md to run `exiftool -jumbf:all=` (for jpg & png), and to simply directly remove the <c2pa:manifest> tag in SVG files. I haven't looked at video files yet.

[dead]

Claude watermarks are a farce and a waste of time. It's hilarious to me that they burn cash to even entertain the idea.

Any attempts they use are defeated by a text editor and CTRL SHIFT V. Unicode characters are no new thing.

Reminds me of how people tried to argue that NFTs aren't anything more than just jpegs.