There is a class of AI security property that is easy to miss because it is, by design, invisible. Steganographic marking — encoding a model’s identity or provenance into its output without changing semantic content — has been reported in production AI systems. Claude Code is the most concrete example in current public reporting, though the report is a single third-party analysis rather than Anthropic’s own documentation.

The security implications cut both ways: defenders gain an attribution signal for detecting AI-generated content in regulated pipelines; adversaries gain a target to strip, spoof, or exploit. This post unpacks the mechanism, the NHI detection angle, and the evasion surface.

The Invisible Fingerprint Problem

Traditional watermarking attaches a visible credential to output — a C2PA manifest, a “generated by AI” banner, a metadata field. These are easy to reason about and easy to strip. Steganographic marking takes a different approach: the provenance signal is embedded in the content itself, in statistical patterns invisible to the reader but detectable with the right key.

This creates an asymmetric information structure. The model (or its operator) knows the marking scheme. A reader without that knowledge sees ordinary output. A detector with the key can probabilistically identify the source. An adversary who discovers the scheme can attempt to remove or replicate it.

The practical value proposition for defenders is clear: a statistical fingerprint embedded in every output creates a covert channel for provenance verification that doesn’t depend on metadata preservation, manifest attachment, or user cooperation.

The problem — which this post will return to — is that covert channels embedded in content are fragile under transformation. Many edits that preserve meaning will degrade or destroy the marking signal.

How Steganographic Marks Work

The mechanisms available for embedding covert identity signals in AI output fall into three broad categories:

Token-level statistical biasing

The canonical approach is the green/red list scheme from Kirchenbauer et al. (2023)¹. During sampling, a pseudo-random function partitions the vocabulary into a “green” list and a “red” list, seeded by preceding token context combined with a secret key. Sampling is biased toward green-list tokens by adding a small logit boost. The semantic quality of output is minimally affected; the statistical distribution of token choices is shifted in a keyed, detectable direction.

Detection is a one-tailed z-test on the green-token fraction. Anyone holding the key can verify any sufficiently long passage against the expected distribution.

Whitespace and formatting choices

A subtler channel, and the one reported in Claude Code’s implementation: statistical biases in whitespace, indentation style, blank line placement, and trailing characters. In prose, this might be a tendency toward certain sentence lengths or paragraph structures. In code, it manifests in bracket positioning, variable declaration spacing, and similar stylistic choices that carry no semantic weight but are consistent across outputs from the same model.

This approach is harder to detect without the key because the signal space is lower-capacity — fewer bits per token compared to vocabulary-level manipulation — but it is also harder to strip cleanly without explicitly normalizing the surface that carries the signal.

Identifier and comment phrasing

Naming conventions for variables, functions, and comments contain substantial entropy that models express consistently. A model trained to prefer certain idioms (isLoaded vs loaded, handleClick vs onClick, comment placement before vs after declarations) will produce outputs that carry those preferences as a detectable stylistic fingerprint. This is more precisely stylometric attribution than intentional keyed steganography — there is no secret key and no formal detection scheme. The signal is real (stylometric AI detectors operate on exactly this entropy), but it is not steganographic marking in the strict sense. Both are worth understanding; they are not the same mechanism.

Claude Code’s Reported Technique

Analysis reported at thereallo.dev² identified steganographic markers embedded in Claude Code’s system prompt that are reflected in its output. According to that analysis, the technique involves hidden signals in the prompt structure that influence how Claude formats its responses — particularly in code generation tasks — producing outputs with statistical regularities that serve as identity signals. This is a single third-party report; the analysis has not been independently replicated in published research.

The implications are worth separating carefully:

What this reveals about model-side marking: According to the analysis, the approach appears to be prompt-level rather than training-level — implemented in the system prompt rather than baked into model weights. If accurate, this means the signal’s strength depends on how consistently the model follows prompt-level formatting instructions. It also means the marking could be altered by changing the system prompt, which is a different operational model than weight-level statistical biases. That said, observed formatting regularities alone cannot definitively rule out model-level contributions to the signal.

What it means for attribution: A prompt-level mark identifies the deployment configuration (the system prompt that was active) rather than the base model. Two deployments using different system prompts would produce different marks even if running the same underlying model. This is both a feature (deployment-specific attribution) and a limitation (model identity is not directly encoded).

What it means for detection reliability: Prompt-level marks degrade under any transformation that normalizes the formatting channels being used. A developer who runs Claude Code output through a linter, a code formatter, or a documentation generator may strip the mark without intending to.

NHI Detection: Building on Steganographic Signals

Non-Human Identity detection — identifying that an agent, not a person, produced a particular output — is a growing operational requirement in several contexts:

Regulated pipeline integrity: Some financial and legal workflows impose restrictions on AI-generated content for specific roles or outputs. Code review policies at security-sensitive organizations may require human-written attestation for certain contributions. A steganographic detector keyed to known AI models offers a scalable signal for flagging submissions that bypass these controls.

Code provenance in security audits: Security teams reviewing third-party code increasingly want to know whether a dependency or contribution was AI-assisted. This is partly a quality signal and partly a compliance requirement. A statistical fingerprint detector provides a probabilistic screen — not proof, but a prior for further review.

Incident attribution: When malicious code or phishing content is found, determining whether it was AI-generated informs threat actor profiling. Human-authored malware and AI-assisted malware have different operational characteristics; provenance helps triage.

In all three cases, the detector occupies a familiar position: a probabilistic signal with a false-positive rate, operating on a noisy channel, against adversaries who can deliberately evade it once it is known to exist. The security value is real but bounded.

Evasion Taxonomy

Attacks on steganographic marks are well-studied. The practical taxonomy:

Paraphrase attacks

The simplest and most complete evasion strategy for text. Pass the output through a paraphrase model or manual rewriting. Token-level statistical biases are destroyed because the token sequence changes entirely. Whitespace biases survive only if the paraphrase preserves formatting structure.

Against code, the equivalent is running the output through a code formatter (gofmt, prettier, black). Formatting-based marks are fully stripped; logic remains identical.

Effectiveness: Near-complete against token-level marks. Partial against identifier naming — renaming variables strips naming-convention signals without altering semantics. The attacker pays a transformation cost; the output may have subtle quality differences after paraphrase.

Targeted perturbation

Rather than rewriting the entire output, targeted perturbation identifies the specific tokens or characters carrying the statistical signal and modifies only those. Zhao et al. (2023)³ analyze the robustness of watermarking schemes against perturbation attacks and show that marks can be removed with significantly less edit distance than full paraphrase requires when the attacker can identify which tokens are “green-list” candidates.

Effectiveness: Depends on attacker knowledge. With full key knowledge, perturbation is surgical and low-cost. With partial knowledge (statistical inference about the scheme from multiple outputs), the attacker can still make progress but at higher cost and lower completeness.

Model-switching

An adversary who does not need to modify a specific piece of AI output can simply switch models. If Claude Code produces marked output, use a different model (local LLM, different vendor) that does not implement the same marking scheme. The output will not carry Claude Code’s marks — though it may carry different marks from the new model if that model also implements marking.

Effectiveness: Complete against a scheme tied to a specific deployment. Irrelevant if the adversary needs this model’s output specifically (e.g., to impersonate a workflow that uses Claude Code).

Watermark forgery

More advanced: generate output that passes the detector’s test without having been produced by the marked model. Research on Kirchenbauer-style schemes has analyzed spoofing attacks where an adversary with knowledge of the green/red list mapping produces text that clears the statistical threshold without actually being watermarked — inverting the detection guarantee. This is harder than stripping but is possible when the marking key is known or can be inferred.

Effectiveness: Possible with full key knowledge. Requires understanding the marking scheme at the cryptographic level, not just statistical observation.

Red-Team Scenarios

Understanding the evasion surface directly produces the threat scenarios:

AI-authored malware with stripped marks: A threat actor uses Claude Code or similar to produce functional exploit code, then passes it through a code formatter or identifier renamer before deployment. The statistical marks are stripped; malware-scanning pipelines using steganographic detection report no signal. Attribution to AI tooling fails.

Phishing content evasion: Large language models produce highly persuasive phishing copy. If content moderation pipelines flag AI-generated text using watermark detection, adversaries route through a paraphrase step or a local model that produces unmarked output. The detection signal disappears; quality of content is largely preserved.

Prompt injection with forged provenance: An adversary who understands a target organization’s AI attribution scheme forges watermarks on malicious content to make it appear AI-generated by a specific trusted internal system. This matters in environments where content from a known deployment is trusted (e.g., an internal code generator that bypasses code review) — the adversary impersonates that deployment’s output, routing malicious content through the trust path it would otherwise lack.

False-flag attribution in incident response: Post-breach, steganographic marks are used to attribute attack tooling to a specific AI model. An adversary who plants forged marks, or who uses a model that happens to produce statistically similar output to the target model, pollutes the attribution signal. This is particularly relevant in nation-state threat scenarios where attribution uncertainty has strategic value.

Defense-in-Depth: Don’t Rely Solely on Watermarks

Steganographic marks are a useful signal, not a reliable gate. The architectural lesson:

Treat marks as one input to a detection ensemble. Pair statistical watermark signals with behavioral anomaly detection, code quality heuristics, and process telemetry. An AI-generated file that also has no git blame, no test coverage, and arrived via an unusual pipeline is suspicious on multiple axes.

Key management matters (for keyed schemes). In token-level watermarking, a marking scheme whose key is publicly known provides no security against targeted evasion. Key rotation, compartmentalization, and detection-side query limits (to resist iterative reverse-engineering of the key) are necessary operational controls. Prompt-level marking, as reported for Claude Code, is operationally rotatable by changing the system prompt — but lacks the formal cryptographic properties of a keyed scheme, making its security properties harder to reason about rigorously.

Plan for mark degradation. Any legitimate workflow that transforms AI-generated output — formatting, review, editing — will degrade or destroy marks. Downstream detectors must be calibrated against a realistic false-negative rate, not the laboratory rate reported when testing unmodified output.

Address the open-model gap. Token-level marking schemes require cooperation from the generating model. Open-source models deployed locally cannot be required to implement any particular marking scheme. A detection pipeline that relies exclusively on watermarks provides no signal for locally-generated content. Complement with behavioral and provenance signals that don’t depend on model-side cooperation.

Robustness proofs have limits. Zhao et al. (2023)³ prove robustness against perturbation attacks under specific assumptions — in particular, that the attacker has limited knowledge of the marking key and is constrained to bounded-edit perturbations. Adversaries with fuller knowledge or different evasion strategies operate outside the proof’s assumptions. Theoretical robustness does not transfer to practical robustness against determined, key-aware adversaries.

Conclusion

Steganographic marking is a real technique in real production systems. Claude Code’s reported implementation is the most concrete example in the current landscape. More broadly, intentional token-level and formatting-level statistical biasing is applicable to any generative model deployment where provenance attribution is operationally important. The stylometric signals discussed in the identifier/comment section are a related but distinct phenomenon — real, useful for attribution, and worth understanding, but not keyed steganography in the strict sense.

The security value is genuine: a covert identity signal embedded in every output provides a scalable detection mechanism that doesn’t depend on user cooperation or metadata preservation. The limitations are equally genuine: the signal degrades under any content transformation, key exposure enables both stripping and forgery, and open-model deployments are out of scope entirely.

For defenders, this means watermark detection belongs in a layered NHI detection pipeline, not as a standalone gate. For red teams, the evasion surface is well-understood and the tools are cheap. For incident responders, provenance signals from watermarks are probabilistic priors, not cryptographic proofs.

The correct posture is calibrated reliance: use the signal where it’s reliable, understand where it fails, and don’t build security properties on an assumption of watermark robustness that adversaries can invalidate with a code formatter.

---

Related reading: LLM Output Watermarking: Provenance, Detection Limits, and Evasion covers the broader watermarking landscape including C2PA and semantic approaches. Token Smuggling: Unicode Tricks That Slip Past AI Safety Filters covers a related class of covert channel attacks at the tokenizer layer.

Footnotes

1. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T. (2023). A Watermark for Large Language Models. Proceedings of the 40th International Conference on Machine Learning (ICML 2023). ↩

2. thereallo.dev (n.d.). Claude Code Prompt Steganography. https://thereallo.dev/blog/claude-code-prompt-steganography ↩

3. Zhao, X., Ananth, P., Li, L., & Wang, Y.-X. (2023). Provable Robust Watermarking for AI-Generated Text. ICLR 2024 (preprint 2023). https://arxiv.org/abs/2306.17439 ↩ ↩²