Anthropic just watermarked everything Claude writes.
Ask it to fix a typo in your own text and it brands that with a hot iron too, no consent asked. 🐄 🧲
And the research that breaks that watermark has been sitting in public for 18 months.
Not a flaw somebody found after the fact. A whole research field, published, with papers presented at NDSS, ICML, ACL, quietly taking apart this exact class of solution since the foundational paper came out in 2023. So the question that actually matters isn't "does the mechanism work." It's simpler than that: is this watermark going to change anything for anyone who publishes or detects content written by Claude?
The mechanism is elegant on paper. A quiet bias in which tokens get picked during generation, invisible to the eye, detectable if you have the key. But that bias can only show up where several words are roughly equally likely, otherwise the text degrades into nonsense. And that exact constraint, the one that keeps the watermark invisible, is precisely what published attacks have been exploiting for a year and a half.
Anthropic Just Marked Every Word Claude Writes
On August 10, Anthropic announced an invisible watermark embedded in text generated by every Claude model released after August 2, 2026. Global rollout, not just the EU. It covers Claude.ai, the API, Claude Code, Cowork, Tag, and the cloud partners (AWS, GCP, Microsoft Foundry).
The regulatory driver is Article 50(2) of the EU AI Act and the Code of Practice Anthropic signed on to. Watermarking generated text is now something labs commit to on paper, not just something they experiment with in a research blog post. It's the same institutional reflex behind most guardrail decisions of the last couple of years, restrict first, defend the calibration later (I went deeper on the technopanic cycle that shapes most AI guardrail decisions elsewhere, if that pattern interests you).
The reaction was immediate. Within hours, coverage of the announcement was pulling several hundred thousand views on the first wave of media relays, according to trade press tracking the story. People care about this. The framing that spread fastest was simple: Claude text is now traceable. The framing that got less attention is the one this article is about.
Why the Invisible Watermark Leaves a Crack
Here's the actual mechanism. During generation, the model splits its vocabulary into a green list and a red list of tokens, seeded by a hash of what came before. Sampling gets biased toward the green list. Detection later checks whether green tokens show up more often than chance. That's the whole trick, nothing more.
But the bias can't be strong everywhere. If the model has an obvious next word, biasing the choice degrades quality immediately, and a degraded model isn't shippable. So the green-list nudge only really does its job in high-entropy spots, the places where several tokens are close to equally likely and picking the green one costs nothing in quality.
That's the crack. A watermark hiding only in the ambiguous parts of a sentence is about as well-concealed as a stormtrooper standing under a spotlight in an otherwise dark hallway. You know exactly where to look.
Which raises the obvious next question: if the watermark has to leave this crack open to survive, how far can it actually be pushed, and how much effort does it take?
The Research Already Broke This Class of Watermark
Not much effort, it turns out. Since Kirchenbauer's 2023 paper defined this green-list, red-list approach, a whole subfield has built up specifically around attacking it, and the results are not close.
SIRA (Cheng et al., May 2025) hits close to 100% attack success across 7 recent watermark schemes, for 0.88 dollars per million tokens, without touching the model or knowing the watermarking algorithm. It works by calculating each token's self-information, which is a fancy way of saying it finds the ambiguous spots directly, the exact same high-entropy zones the watermark depends on to stay invisible.
BIRA (Hwang et al., September 2025) gets over 99% evasion while keeping more of the original meaning than standard paraphrasing tools. RLCracker hits 98.5% success on long texts. Vaporizer, out of Nanyang Technological University in May 2026, confirms that watermark schemes marketed as robust, scalable, and production-grade keep breaking under lexical swaps, machine translation, and neural paraphrasing.
[INFOGRAPHIC: TITLE "Watermark Attacks, Ranked by Success Rate" + subtitle "5 published methods, one target class of watermark". Metaphor: shooting gallery with 5 targets in a row, each target cracked open. Style: engineer blueprint, thin technical line art, grid paper background, precise annotations. Palette: navy #14213D, amber #FCA311, muted red #C1121F, light gray #E5E5E5, black #111111. Content: 5 targets labeled SIRA (99 percent, 0.88 dollars per million tokens), BIRA (99 percent evasion), RLCracker (98.5 percent on long text), Vaporizer (confirmed break across lexical, translation, neural paraphrase attacks), Character-Level Perturbations (works without any secondary LLM). Highlight: SIRA and BIRA targets shown with a bold amber crack line and small burst icon, denoting model-free or near model-free attacks. Legend: sticky note bottom-left, "amber crack = no model access needed / gray crack = uses a secondary LLM". Footer: © rentierdigital.xyz. NOT flat corporate vector, NOT stock infographic style.]
And you don't even need an LLM for some of this. Character-level perturbations, swaps, typos, homoglyphs, affect several tokens at once and beat token-level substitution under a tight editing budget, according to a September 2025 NDSS paper. Translate the text into a pivot language and back and the watermark loses coherence too, across every method and every model an ACL 2024 paper tested it on.
Every scheme that shipped and got tested against this field got the same treatment Dark Souls gives a new player. You died. Try again.
These numbers target known watermark families, KGW, Unigram, SynthID-like schemes. Reasonable question: does any of it actually apply to what Anthropic just shipped?
Anthropic Already Told You the Watermark Isn't Conclusive
Anthropic's own help center, updated the same day as this article, is upfront about the limits. A detected mark isn't conclusive proof of full AI authorship, because Claude might have only edited or translated text a human wrote. And the absence of a mark proves nothing either. Heavily edited text, paraphrased text, translated text, or text that's just too short can carry no detectable signal at all, same as text from any Claude model released before August 2, 2026.
So even before the independent attack research gets involved, the company shipping the watermark is telling you, in writing, that it's not a yes-or-no instrument. That matters more than it sounds like it should.
What Gets Caught Is Laziness, Not AI Use
Follow that through to the second-order effect. If the watermark breaks under reformulation, translation, or basic editing, what actually gets caught is copy-paste laziness, not Claude use as such.
For anyone publishing on a platform with an AI-disclosure policy, Medium included (I covered the infrastructure fight over calling content authentic in more depth elsewhere), that distinction is the whole ballgame. The mark isn't proof of compliance if it's there, and it isn't proof of a violation if it's absent. It just tells you who bothered to rewrite a sentence and who didn't.
I think that's actually the most honest way to read this rollout, though I could be wrong about how much weight regulators end up putting on the mark itself once the first real disputes show up.
There's a sharper version of this that has nothing to do with catching AI slop. Say you paste a letter you wrote yourself, something personal, and ask Claude to fix 2 typos and a comma. The mark goes in anyway, on words that were mostly yours to begin with. You never got a say in that.
You asked for a proofread. You got a stamp you didn't agree to.
Random tangent, nothing to do with any of this: I spent an hour last week figuring out why a distributor CSV feed kept silently truncating product descriptions at 255 characters. No error, no warning, just quietly eating data past the limit.
The Pattern Is Clear. The Implementation Isn't.
What holds up without hedging is this: the entire class of solution, statistical watermarking through sampling bias, has been taken apart repeatedly and independently, by multiple teams, months before Claude's version even shipped, and SIRA, BIRA, RLCracker, and Vaporizer aren't isolated exploits so much as 4 data points from a research field running at full speed on exactly this problem, one that's been active since well before the EU AI Act deadline turned into anyone's actual concern. What doesn't hold up yet is any claim about Anthropic's specific implementation, because no technical specification has been published, which means none of the attacks cited above have actually been run against this exact scheme, and that gap isn't a loophole in the argument, it's the honest edge of it, the point where the pattern stops and guesswork would have to start if I let it.
Watermarking text, images, video, all of it says something about where we are right now. We've built tools powerful enough to be hyperrealistic, and in the same breath we want to be able to track everything those tools produce.
The next step of that same instinct isn't hypothetical, and it's not exactly subtle either: it's cameras that don't just record images anymore but encode movement, location, identity, in real time, recognizing individuals and vehicles as a matter of course. Skynet never needed to nuke anything. It just needed your license plate, mine, and a database that doesn't forget.
Overpowered. Paranoid. Controlling. Degrading.
You really think that one day, if I quietly fart, a bot files a report?
Sources
- Anthropic's Claude Help Center describes how the mark works and states plainly that a detected mark isn't conclusive on full provenance, and that heavy editing, translation, or short text can leave no signal at all.
- The Register's coverage of the announcement ties the rollout directly to the EU AI Act's Article 50(2) obligations.
- SIRA (Cheng, Guo, Li, Sigal), "Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks," ICML 2025.
- BIRA (Hwang et al.), "LLM Watermark Evasion via Bias Inversion," 2025.
- RLCracker, a reinforcement-learning based watermark evasion method published in 2025.
- Vaporizer (Ng, Ngo, Chattopadhyay, Nanyang Technological University), confirming systematic breakability across major watermark schemes, 2026.
- Zhang et al., "Character-Level Perturbations Disrupt LLM Watermarks," NDSS 2026.
- He et al., "Can Watermarks Survive Translation?", ACL 2024.
- Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein, "A Watermark for Large Language Models," ICML 2023, the foundational paper behind the mechanism described in this article.
This post may contain affiliate links. If you click them, I might earn a small commission — costs you nothing, and helps me keep shipping quality articles every day for your reading pleasure.
Top comments (0)