How Claude's Text Watermark Works (and How It Breaks)
Anthropic deployed a statistical watermark across all Claude models on August 2, 2026. Two independent research groups have already shown that a single paraphrasing pass destroys the signal more than 90% of the time. This piece traces the mechanism, the evidence against it, and the structural contradiction at the center of the EU mandate that required it.
What it is and why it shipped
On August 2, 2026, Anthropic turned on a text watermark across every Claude surface: the consumer product, the API, Claude Code, Claude Cowork, Claude Tag, Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry. All models released after that date carry the watermark by default, and older models are being retrofitted over the coming months under the EU’s transition window for pre-existing systems.
The regulatory trigger is
For images, PDFs, and other files, Anthropic uses
The technique: how the watermark enters the text
Every language model generates text by choosing one token at a time from a probability distribution. For a given prompt and context, the model assigns a probability to every candidate next token, and then samples from that distribution using a random number generator. Many of these choices are semantically equivalent: “The weather was cold” and “The weather was gray” are equally valid completions, and which one appears depends on which random seed the sampler drew.
The watermark changes where that randomness comes from. In normal generation, the RNG seed is arbitrary. In watermarked generation, the seed is derived from a cryptographic key combined with the preceding tokens via HMAC, making the randomness reproducible for anyone who holds the key. The output reads identically to a human, costs the same, runs at the same speed (Anthropic reports zero latency impact). The pattern of which synonyms were chosen, however, becomes statistically detectable by the key holder.
Here is the insertion point in pseudocode:
Anthropic’s implementation is a version of
The lineage is worth tracing because the weaknesses are inherited. Scott Aaronson proposed the core idea in 2022 during his time as a guest researcher at OpenAI. Kirchenbauer et al. at the University of Maryland formalized it in 2023 as the KGW (Key-based Green/Red list) scheme (arXiv 2301.10226), which partitions the vocabulary into green and red lists at each generation step using a hash of the preceding k tokens, then boosts the logits of green-list tokens by a constant δ. DeepMind’s Tournament sampling replaced the hard green/red partition with a softer, multi-round competition, which improves text quality at the cost of a weaker signal per token. Anthropic’s deployment is the second production-scale implementation after Google’s, which ran across Gemini and Gemini Advanced with no measurable quality degradation across approximately 20 million responses.
What changes in the output
The watermark is invisible to readers. Both outputs below respond to the same prompt. The first was generated with a standard RNG. The second was generated with the keyed HMAC seed. Hover any token to see its watermark signal intensity.
The warm tokens are where the keyed RNG steered the choice. “Cold” became “gray,” “quiet” became “still,” “walked” became “headed,” “old” became “aging.” All four substitutions are semantically equivalent. Function words like “the,” “and,” “as” carry almost no signal because they have no viable synonyms, as Anthropic notes: “where there isn’t a choice, the watermark isn’t applied.” The sentences read identically to a human. The statistical pattern is visible only to the key holder.
Watermark density varies by content type. Creative prose, where almost every content word has synonyms, carries a dense signal. Factual text is sparser: “Isaac Newton’s most famous work was called Principia Mathematica” has no room for substitution, because the proper noun is the only correct completion. Code is barely watermarked at all, because exact syntax matters and comments are a small fraction of output. Translations carry a full watermark, since every word is chosen by the model. Proofreading carries almost none, since most words remain the human’s.
How detection works
Detection requires the cryptographic key. The detector replays the same HMAC computation for each token position, reconstructing the RNG state that would have been used during watermarked generation, and checks whether the token that actually appears matches the one the keyed RNG would have favored. Each match is weak evidence on its own. Across hundreds of tokens, the cumulative signal becomes statistically significant.
Here is the same watermarked text colored by detection confidence per token:
Red tokens are where the detector has high confidence that the keyed RNG steered the choice: “gray,” “still,” “headed,” “aging” all score above 0.78. Blue tokens are function words where the match could be coincidence, because there was only one plausible option regardless of the RNG. The detector aggregates across all tokens and reports a single probability.
The statistical nature of the signal means detection confidence scales with text length. Short texts have too few token positions where synonyms were available for the cumulative evidence to reach significance. The scatter plot below shows this relationship: each point represents a simulated text sample, with token count on the x-axis and detection confidence on the y-axis.
Below roughly 100 tokens, the watermarked and unwatermarked distributions overlap enough that confident attribution is impossible. By 300 tokens, the separation is clear. Anthropic has not published an exact minimum length threshold, but the mechanism requires on the order of hundreds of tokens to produce a confident verdict, which means a tweet-length response or a single paragraph falls below the detection floor.
Anthropic confirmed on August 12, 2026 that a public detection API is in development and will “soon” be available. The EU Code of Practice requires third-party access, so the API will be publicly callable. No launch date, endpoint specification, or pricing has been published. The API will answer one question: what is the likelihood this text was partly processed by Claude? Anthropic is careful about the phrasing here: the watermark proves Claude’s involvement in generating the text, but it cannot distinguish “Claude wrote this from scratch” from “Claude lightly edited a human draft,” because the watermark attaches only to the tokens Claude chose, and a human’s tokens carry no signal.
How it breaks
Two independent research groups have tested SynthID-Text’s durability, and their findings converge on the same conclusion: the watermark does not survive contact with a paraphraser.
Tamim and Khan published a forensic evaluation in July 2026 (arXiv 2607.16010) that tested three watermarking schemes (KGW, Unigram, and SynthID-Text) across 846 runs using the MarkLLM evaluation framework. They applied a single meaning-preserving paraphrase pass to each watermarked output and measured how many retained a detectable signal. KGW and Unigram lost their watermark in 100% of runs. SynthID-Text, the scheme Anthropic’s deployment is based on, lost it in 98.3%. The study also developed a Forensic Readiness Score (FRS) framework with 12 criteria, three mandatory gates, and a 60-point scale, then scored all three schemes against Daubert admissibility standards (the legal test for whether expert evidence is admissible in US federal courts). None of the three schemes satisfied more than two of five Daubert factors.
Even before any attack, the false-negative rates were high. Tamim and Khan found that SynthID-Text failed to detect its own watermark in 80% of outputs, with 18.6% landing in an uncertainty zone where the detector could not commit to a verdict. The distribution below shows detection scores across their SynthID-Text runs before any paraphrasing was applied:
Most scores cluster below 0.5. Only 20% of outputs crossed the detection threshold even with the watermark present and unmodified. This baseline fragility means the watermark was already operating at the edge of detectability before anyone tried to remove it.
ETH Zurich’s SRI Lab (Jovanović, Staab, and Vechev) reached a compatible conclusion through a different methodology. In work presented at ICML 2024, they built a black-box watermark-stealing attack that reverse-engineers watermark rules through public API queries, using a budget of under $50 and 30,000 C4 dataset queries to train an auxiliary model (Mistral-7B) to mimic the watermark pattern. Their probing attacks against SynthID-Text found scrubbing success rates above 90% at a 10⁻³ false-positive threshold, even for naive adversaries using only an off-the-shelf paraphraser (DIPPER-11B) without the stolen watermark parameters.
On spoofing (planting a false watermark to frame human text as AI-generated), SynthID-Text’s defenses performed better than predecessors. The full SynthID-Text stack achieved a 4% spoofing success rate at baseline, compared to 82% for the simpler LeftHash scheme. But tripling the attacker’s query budget to 90,000 pushed SynthID-Text spoofing success to 15%. The ETH Zurich team also showed that the presence of SynthID-Text can be detected in a black-box way using a simple Red-Green statistical test, which means an attacker can confirm whether a given API is using the watermark without any insider knowledge.
The removal mechanism is straightforward. Run the watermarked text through any LLM with a “paraphrase this” prompt, and the output is a semantically equivalent passage where every token was chosen by the paraphraser’s own RNG, destroying the original keyed pattern. Translation round-trips have the same effect. Manual rewriting works if thorough enough. Anthropic’s own position on this is pragmatic and worth quoting: if you rewrite every word, “it’s arguable whether the text can any longer be described as AI-generated.”
Here is the watermarked output before and after one paraphrasing pass:
Every high-signal token from the original (“gray,” “still,” “headed,” “aging”) has been replaced by the paraphraser’s own choices (“chilly,” “hushed,” “made her way,” “old”). The sentence structure changed. The meaning did not. Detection confidence dropped from 0.94 to 0.12, below any useful threshold.
The evasion oracle problem
The EU AI Act requires Anthropic to offer public third-party detection. That detection API, once live, becomes a free evasion oracle: submit text, check the verdict, paraphrase, resubmit, confirm the watermark is gone. The cost is approximately four cents per paraphrasing pass through a commodity LLM. In practice, one pass is enough 98.3% of the time, so iteration is rarely needed.
The structural tension here is worth being precise about. Article 50(2) requires providers to mark AI-generated content. The Code of Practice requires providers to support third-party detection. Any public detection endpoint, by definition, can be queried by an adversary who wants to confirm their paraphrased text no longer triggers detection. These requirements produce a system that is easy to comply with and easy to defeat, because the compliance mechanism and the evasion mechanism are the same API call.
Within days of Anthropic’s announcement, scam “watermark removal” apps and services appeared. Forbes reported on August 16 that tools like “claude-watermark-cleaner” and “remove-ai-watermarks” have been posted to GitHub, many making unverifiable claims (since Anthropic hasn’t released the detector yet). BleepingComputer found that several contain malware. The effective method remains the simplest: paste the text into any LLM and ask it to paraphrase.
When the watermark survives
Watermark survival depends on two variables: how much synonym freedom the original content had (which determines signal density) and how aggressively the text was edited (which determines how many keyed tokens remain). The matrix below estimates survival rates across content types and editing methods:
Creative prose starts with a high survival rate because it has the most synonym freedom, giving the watermark the most room to embed signal. Code starts low because exact syntax leaves almost no room for synonym substitution; the watermark was barely there to begin with. The “heavy paraphrase” column collapses everything below 10% regardless of content type, and the “LLM rewrite” and “translation round-trip” columns are effectively zero across the board.
The interpretive asymmetry compounds the problem. Unmarked text does not prove a human wrote it: the text could come from an older model that predates the watermark, from a different AI system entirely, or from Claude output that was subsequently paraphrased. Marked text does not prove AI wrote the entire passage: Claude may have only proofread or lightly edited a human draft, contributing a watermark to the few tokens it changed while leaving the human’s words intact. The watermark proves processing, as TechTimes put it, not authorship. A radio host pointed out the practical consequence: “I had ditched Grammarly for Claude for proofreading… now the stuff I’ve written will be watermarked.”
The courtroom problem
Tamim and Khan’s study is worth examining in more detail because it asks a question most watermarking research ignores: would this evidence hold up in court?
They built their Forensic Readiness Score (FRS) framework around 12 criteria drawn from NIST SP 800-86 (the US standard for digital forensic evidence handling) and scored each watermark scheme on a 60-point scale with three mandatory gates. A scheme that fails any gate scores zero regardless of its other merits. All three schemes failed at least one gate.
They then evaluated the schemes against the five Daubert factors, the legal standard US federal courts use to determine whether expert testimony and the methodology behind it are admissible. The five factors are: whether the method can be (and has been) tested, whether it has been subjected to peer review, what its known error rate is, whether standards controlling the technique exist, and whether the technique is generally accepted in the relevant scientific community. None of the three watermarking schemes satisfied more than two of the five.
The known-error-rate factor is where text watermarking fails most concretely. SynthID-Text’s 80% false-negative rate before any attack, combined with a 98.3% removal rate after one paraphrasing pass, would be difficult to defend under cross-examination. For comparison, DNA evidence has a false-positive rate below 10⁻⁹. Fingerprint analysis, often criticized as less rigorous than DNA, still operates at error rates below 1%. A watermark that misses four out of five of its own outputs and can be removed by a tool that costs four cents to run occupies a different evidentiary category entirely.
Structural limitations
Three constraints are inherent to any token-level statistical watermark and will not be resolved by engineering improvements to Anthropic’s specific implementation:
Short texts lack signal. A single sentence has too few token positions where synonyms were available for the cumulative evidence to reach significance. The scatter plot in the detection section illustrates the problem: below 100 tokens, watermarked and unwatermarked texts are statistically indistinguishable. Most real-world AI use cases (answering a question, writing a paragraph, drafting a Slack message) produce outputs in this range.
Constrained outputs have no room. When there is only one correct answer (“What is 2 + 2?”), the model has no synonym choices to steer, and the watermark carries zero signal. This applies to any output where factual accuracy or syntactic correctness eliminates alternatives: mathematical proofs, code, proper nouns, direct quotations, fixed-format data.
Public detection enables evasion. Any public detection endpoint is an oracle for confirming that evasion succeeded. The EU AI Act requires public third-party detection. These two requirements produce a system where the same API call that satisfies compliance also enables removal. This is a structural property of any watermark-then-detect scheme operating under a transparency mandate, and it applies equally to any provider that ships a public detector, whether Anthropic, Google, or OpenAI.
The interoperability gap
Approximately 190 organizations signed the EU Code of Practice on Transparency. Each signatory that operates a generative AI system will need to implement its own watermark, and each will key it differently. Google already runs SynthID-Text across Gemini. OpenAI has not announced a text watermarking deployment but will face the same Article 50 obligation. Smaller providers face the same requirement with fewer resources to implement it.
Each provider’s detection API can only identify its own system’s output. If a text was generated by Claude, paraphrased by GPT-4o, and then lightly edited by a human, Anthropic’s detector will see no watermark (the paraphrase destroyed it), OpenAI’s detector will see its own watermark on the paraphrased layer, and neither can identify the original provenance. There is no cross-provider detection standard in development, no shared key infrastructure, and no interoperability protocol. The EU Code of Practice requires marking but does not specify that marks be interoperable across providers.
C2PA content credentials for generated images and files will continue alongside the text watermark. C2PA provides cryptographic provenance for media files (signed metadata baked into the file format), while the text watermark provides a statistical signal for prose, the one content type where the text is the content and no metadata layer survives a copy-paste.
Where this goes
Anthropic has confirmed the detection API is in development, with no specific launch date. Older Claude models will receive watermarking retroactively over the coming months. The deployment is global, with regional scoping under evaluation.
Text watermarking under a transparency mandate is a compliance mechanism. It satisfies Article 50’s requirement that providers mark AI-generated content, and Anthropic can credibly tell regulators that every token leaving their system carries a statistical signal. Whether the mark survives long enough to be detected in practice is a separate question, and the research so far suggests the answer is: only when the user does not try to remove it, and sometimes not even then.
The broader problem of AI content attribution remains open. A watermark that works against casual, unmodified reuse and fails against anyone who spends four cents on a paraphrase pass serves a specific regulatory function. It does not solve the attribution problem, because the attribution problem requires a mark that survives adversarial conditions, and no statistical text watermark demonstrated so far can do that. The question for regulators is whether a compliance mechanism that works only in the cooperative case is worth mandating, given that the adversarial case is the one that actually matters for misinformation, academic fraud, and content provenance.