ClaudeMark: Building an Open-Source AI Watermark & Provenance Forensics Platform
2026-08-17 · 3 min read
Why AI Watermark Forensics Matters
As AI-generated content floods the web, developers and security teams face a real problem: how do you know if a file was AI-generated, watermarked, or had its provenance metadata stripped? Most existing tools send your files to cloud services — which is unacceptable for sensitive content.
ClaudeMark solves this locally, combining several forensic techniques into one auditable Python platform.
What ClaudeMark Does
ClaudeMark covers four distinct forensic attack surfaces:
1. Statistical AI Watermark Detection
Not all watermarks are invisible characters. Some AI providers embed statistical patterns into generated text — subtle biases in word choice or token distribution that survive copy-paste. ClaudeMark runs probability-based signal analysis to surface these patterns.
2. Unicode Steganography Analysis
The most common watermarking technique: invisible Unicode characters (zero-width spaces, homoglyph substitutions) injected between visible characters. To a reader they're invisible. To a detector, they're unmistakable.
def detect_unicode_steganography(text: str) -> dict:
invisible_chars = [
'\u200b', # zero-width space
'\u200c', # zero-width non-joiner
'\u200d', # zero-width joiner
'\ufeff', # byte order mark
'\u2060', # word joiner
]
findings = []
for i, char in enumerate(text):
if char in invisible_chars:
findings.append({
"position": i,
"char_code": hex(ord(char)),
"context": text[max(0,i-10):i+10],
})
return {"count": len(findings), "findings": findings}
3. C2PA / Metadata Inspection
The C2PA standard (Coalition for Content Provenance and Authenticity) embeds cryptographically signed provenance chains into files. ClaudeMark reads and validates these chains — surfacing publisher identity, editing history, and AI involvement claims without external verification services.
4. SARIF/CI Integration
Every finding can be exported as SARIF (Static Analysis Results Interchange Format), the format used by GitHub CodeQL and security scanners. This lets you integrate ClaudeMark into CI pipelines as a pre-commit or PR check:
# .github/workflows/content-audit.yml
- name: Run ClaudeMark forensic audit
run: claudemark audit --output sarif --path ./content > forensics.sarif
- name: Upload SARIF results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: forensics.sarif
Evidence Bundle MCP Integration
In v2.2.0 I added an MCP integration — ClaudeMark can now serve as a forensic tool within an agentic workflow. An AI coding agent can call claudemark.audit(file) as a tool and receive structured forensic findings as a JSON evidence bundle.
The Hardest Part: Distinguishing Legitimate Unicode
The trickiest engineering challenge was avoiding false positives on legitimate Unicode. Technical documentation often uses non-breaking spaces. Multilingual content uses combining characters. The detector must distinguish intentional steganographic injection from legitimate Unicode usage.
My solution: context-aware scoring. A single zero-width space at a paragraph boundary is different from 20 zero-width spaces distributed uniformly across a paragraph. The scoring model weighs frequency, distribution, and position.
Results
ClaudeMark has:
- 9 GitHub stars, 1 fork — growing open-source forensics community
- v2.2.0 with full C2PA, SARIF/CI, evidence bundle MCP, AVIF/HEIC support
- Native workspace integration for Claude, Cursor, and Windsurf