Anthropic's watermark technology survives copy-paste but falters in real development pipelines

Anthropic plans to add invisible watermarks to text generated by new Claude models across its API, cloud partnerships and coding tools. The initiative responds to transparency rules under the EU AI Act, which took effect in August 2026 and require generative AI providers to make synthetic content machine-detectable.

The watermark will appear in Claude output worldwide, including through AWS, Google Cloud and Microsoft deployments. While the marking system can persist through basic copying and light editing, the approach faces real-world challenges once content enters typical developer workflows.

How the watermarking works#

The watermarking operates at the token level, leveraging techniques that likely resemble the KGW method described in AI security research. Rather than modifying text after generation completes, the system adjusts token selection probabilities while the model streams its response — a constraint necessary for real-time output.

According to Alex Cui, CTO of AI detection firm GPTZero, the approach divides candidate tokens into favored and unfavored groups using a secret key. A detector with access to the same key can identify passages where unusually high numbers of favored tokens appear.

More sophisticated variants can derive the watermark signal from semantic context rather than exact token sequences, potentially allowing some resilience to paraphrasing since word substitution doesn't always alter surrounding meaning.

Fragility against real development practices#

The watermark's real-world resilience remains uncertain. Code presents an acute problem: programming rarely tolerates arbitrary changes without breaking functionality. While variable names might accept synonyms, the watermark must work without compromising executable output.

Anthropic has not published test results showing how well the watermark survives standard developer practices — pull requests, code review, or integration into applications. Subsequent transformations pose similar threats: summarization by a different model, translation, structural reorganization, or mixing with database content could all degrade or eliminate the signal.

Research on watermark robustness supports these concerns. The "Watermarks in the Sand" paper demonstrates that determined attackers can remove watermarks while preserving content quality. Paraphrasing and synonym-replacement attacks — tested against Google DeepMind's SynthID watermark — have proven effective in practice.