Claude Fable 5.1's watermark has a critical flaw in code generation

Anthropic rolled out Claude Fable 5.1 this week with an embedded statistical watermark designed to identify text produced by the model. However, the system reveals significant limitations when handling code—a gap developers will need to understand and work around.

How the watermark operates#

Rather than adding hidden metadata or special characters, Anthropic's approach adjusts the randomness Claude applies when selecting between multiple possible next tokens. This creates a detectable statistical signature across longer outputs while ostensibly preserving output quality and accuracy.

The technology, derived from Google DeepMind's SynthID-Text, persists even when text is copied elsewhere since it's woven into the language itself rather than attached externally. Anthropic notes the signature can survive light editing, though substantial rewrites will eventually wash it away.

The company adopted this watermarking strategy after committing to the EU Code of Practice on Transparency of AI-Generated Content in August. The system will roll out globally to older Claude models in the coming months, as Anthropic determined regional restrictions weren't practical to implement.

Code exposes the watermark's vulnerability#

The fundamental problem emerges when the model needs to generate code. In natural language, Claude often has flexibility in phrasing—multiple valid ways to convey the same idea. Code operates under much stricter constraints: swapping a variable name, operator, or function call can render the program broken or incorrect.

To handle this, Anthropic deliberately skips the watermark when a particular token choice is essential for correctness. This creates a significant blind spot: developers and others cannot reliably detect whether code fragments originated from Claude. Comments and other unconstrained portions of code may still carry the signature, but short snippets often lack sufficient signal for reliable detection.

Anthropic is piloting a detection API in private preview, currently restricted to regulators, law enforcement, media, fact-checkers, researchers, and enterprises managing AI Act compliance. Broader availability is planned for later.

Rethinking preserved thinking and model distillation#

A second change targets model distillation risks. Claude's Messages API supports encrypted thinking blocks that developers can pass back to continue reasoning across conversation turns. The risk: if a developer modifies earlier conversation content while keeping those thinking blocks intact, Claude might decrypt and surface its internal reasoning—data that could then train competing models.