![\"picture](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/picture-taken-april-16-2026-shows-jung.jpg\")
<\/p>\n<\/p>\n
This picture taken on April 16, 2026, shows Jung Hui-hun, a digital forensic specialist at the NEC’s cyber investigations unit, explaining a deepfake detection system at the headquarters of the National Election Commission (NEC) in Gwacheon.
\nJung Yeon-je\/AFP via Getty Images<\/p>\n
When Anthropic confirmed on August 12 that a publicly callable text detection API is in development, the announcement resolved one open question about Claude’s new watermarking system and immediately raised a harder one. The watermark itself \u2014 embedded at the model level in every Claude text output since August 2, 2026 \u2014 was already globally deployed at model level<\/a>. The detection API is the second half of that system. And building it means handing every party who wants to evade the mark a free evasion oracle.<\/p>\n An engineer on Anthropic’s Claude Code team offered three previously unconfirmed facts in a public exchange on August 12: the company will ship “a text detection API that you can use yourself,” the model is unaware it is being watermarked (the mechanism operates in the sampling pipeline below the model, not inside it), and other AI labs are adding similar watermarking. The engineer also conceded the system’s core limitation plainly: the August 12 detection update<\/a> shows he said it “is not perfect, you can edit it, but it’s a first step.”<\/p>\n Anthropic’s detection API announcement came one day after the company updated its Help Center to confirm the watermarking system \u2014 a deployment driven by the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, which Anthropic signed. The Code requires providers to support third-party detection<\/a> of their marks. That obligation set the detection API in motion. It also created the central tension this article examines.<\/p>\n What Is the Evasion-Oracle Problem?<\/p>\n A detection API that is publicly accessible is also a perfect adversarial target. Anyone who wants to produce text that passes undetected can now iterate paraphrases against the API until the watermark no longer registers. The economics are not prohibitive: at frontier API rates, one paraphrase pass over a 1,000-word article costs approximately four cents<\/a>. Paraphrase, check, repeat. The mark disappears before detection becomes a meaningful deterrent.<\/p>\n This is not a hypothetical concern. A July 2026 forensic evaluation (arXiv 2607.16010) tested three leading watermark methods \u2014 KGW, Unigram, and the MarkLLM implementation of SynthID-Text \u2014 against meaning-preserving paraphrase across 846 runs. Every single KGW- and Unigram-marked text lost its watermark after one paraphrase pass. The removal rate for SynthID was 98.3%, per the July 2026 forensic study<\/a>. Anthropic has not published its own method or its own paraphrase-resistance figures.<\/p>\n The evasion-oracle problem is structural: the EU AI Act’s Article 50(2) Code of Practice, which Anthropic signed and which drove the watermarking deployment, requires providers to support third-party detection. That obligation means Anthropic cannot gate the detection API arbitrarily \u2014 it must be accessible enough for legitimate verification. Yet the more accessible it is, the more efficiently an adversary can systematically exhaust it to find unmarked paraphrases. Anthropic has confirmed the API; it has not addressed this tension publicly.<\/p>\n Academic research on watermark stealing has shown that an adversary can recover the watermarking rules of current state-of-the-art schemes for under $50 in API queries and then execute both scrubbing and spoofing attacks at scale, per Jovanovic, Staab, and Vechev’s ICML paper<\/a>. Spoofing attacks \u2014 in which an adversary produces text that falsely triggers a positive watermark detection result \u2014 are the mirror-image risk: a bad actor could frame another party as having used Claude when they did not.<\/p>\n How Claude’s Watermark Actually Operates<\/p>\n The mechanism Anthropic deployed is consistent with the Kirchenbauer-Geiping-Wen (KGW) green-list family of text watermarks, first introduced in the original KGW paper<\/a> at ICML 2023. An analysis published August 11 by a technical observer familiar with the KGW method characterized Anthropic’s approach as belonging to this family \u2014 a determination consistent with the company’s published description of model-level, inference-time marking.<\/p>\n The mechanism works as follows: at each decoding step, a pseudorandom function keyed by a secret combines with a window of previously generated tokens to partition the model’s full vocabulary into a “green” set and a “red” set. The logits of green-set tokens are incremented by a fixed bias \u03b4 before softmax sampling, making green tokens statistically over-represented in the output without preventing the model from choosing red tokens when factual or syntactic constraints demand them. Detection does not require access to the language model itself \u2014 only the secret key and the text under analysis. A one-proportion z-test on the ratio of green-set tokens to total tokens determines whether the sequence exceeds the baseline expected from normal text, per AI content watermarking literature<\/a>.<\/p>\n Google DeepMind’s SynthID-Text, the field’s other major production deployment, uses a different approach: tournament sampling, in which multiple candidate tokens are drawn from the model’s distribution and a series of pseudorandom binary tournaments \u2014 each scored by a function derived from the secret key and context \u2014 selects the surviving token. SynthID is designed to be non-distortionary in expectation, a stronger quality guarantee than KGW’s logit-biasing approach, and it was validated in a 20-million-response live experiment on Google’s Gemini system without statistically significant quality degradation, as Dathathri et al. described in the SynthID-Text Nature paper<\/a>.<\/p>\n Anthropic has not published its specific technical scheme. The Anthropic engineer confirmed that the agent would not be aware of the watermarking, pointing to SynthID as the reference implementation for how inference-level watermarking works \u2014 an architecture applied in the sampling pipeline, not instructable or overridable by any user-facing prompt command<\/a>.<\/p>\n What the Watermark Cannot Mark: Code, Short Text, and Mixed Documents<\/p>\n All known generation-time text watermarks share a fundamental constraint: their signal strength is proportional to the entropy of the model’s next-token distribution. High-entropy outputs \u2014 essays, creative writing, long-form prose \u2014 provide ample near-equivalent token choices for the green-list bias to accumulate a statistically detectable signal. Low-entropy outputs offer almost no room, as the underlying technical literature on AI content watermarking<\/a> documents.<\/p>\n Source code is the most commercially significant low-entropy case. Where prose lets the model choose among many nearly synonymous phrasings at each step, code is syntactically rigid: identifiers must match declarations, indentation must be consistent, and only a small number of token sequences produce valid syntax. The green-list bias has little to work with. Then formatters, linters, and refactoring tools rewrite whatever entropy remained. A single pass through a code formatter is functionally an adversarial attack on a token-level watermark.<\/p>\n Anthropic’s coverage list explicitly includes Claude Code, suggesting that the watermark applies to the prose Claude Code produces \u2014 plan summaries, commit messages, PR descriptions, inline documentation \u2014 where token entropy is high. The mark on code itself is likely weak to absent, and the first format-on-save removes it. Anthropic has not addressed this distinction in public documentation.<\/p>\n Short texts carry no reliable signal regardless of content. The KGW paper established that approximately 25 watermarked tokens are required to achieve a false-positive rate below 10^-5. Practical detection in realistic settings requires 100 or more tokens for robust confidence. Social media posts, brief email replies, and commit subject lines fall below that minimum token threshold for reliable detection<\/a>.<\/p>\n Mixed-provenance documents are the hardest case. A document that combines Claude-generated text with output from an open-weight model and original human prose will carry a Claude watermark only on the Claude-originated passages. A detection tool with no knowledge of the document’s full composition cannot distinguish which segments are marked because they reflect Claude’s sampling distribution and which are marked by coincidence.<\/p>\n The open-source ecosystem is structurally exempt from any provider’s watermarking commitment. Models released without watermarking capability \u2014 which encompasses virtually every open-weight model \u2014 produce text that no vendor detection tool can mark or identify. A 2024 Nature commentary accompanying the SynthID-Text paper noted this asymmetry directly: closed-source providers can enforce watermarking; open-source cannot. The gap risks creating a two-tier provenance landscape unless watermarking can be moved into the model weights themselves<\/a>.<\/p>\n Watermark Evidence Fails the Daubert Standard<\/p>\n The July 2026 forensic evaluation (arXiv 2607.16010) was not about evasion rates alone. Its primary purpose was to evaluate whether watermark detection evidence meets the admissibility standard US courts apply to expert scientific evidence under Daubert v. Merrell Dow Pharmaceuticals (509 U.S. 579, 1993).<\/p>\n The five Daubert factors require that a scientific method be testable, have a known error rate, have been peer-reviewed and published, follow applicable professional standards, and be generally accepted within the relevant scientific community. None of the three methods tested \u2014 KGW, Unigram, and SynthID \u2014 satisfied more than two of these five factors, according to the Daubert forensic readiness study<\/a>.<\/p>\n The false-positive rate for SynthID, measured on paraphrased human-written controls, was 5.4%. The same scheme showed an 18.6% paradox rate \u2014 cases in which the scheme produced contradictory detection results \u2014 with 80% of its own watermarked output landing in an uncertainty zone where the scheme itself could not determine whether the text was watermarked. These are not hypothetical failure modes. They are empirically measured failure rates in a published study submitted to the AAAI\/ACM Conference on AI, Ethics, and Society 2026.<\/p>\n The practical implication: courts in the United States cannot admit watermark detection results as expert evidence without additional foundation, and the current scientific literature does not provide that foundation. Institutions \u2014 academic, corporate, governmental \u2014 that plan to use Claude watermark detection results as documentary evidence in misconduct proceedings, employment decisions, or compliance audits will be building on an evidentiary base that the relevant scientific literature has already characterized as inadequate for high-stakes use<\/a>.<\/p>\n There is a deeper problem beneath the empirical failure rates. Zhang et al. at ICML 2024 proved an impossibility theorem: under standard assumptions about what an attacker can do (access to a quality oracle and a perturbation oracle), strong watermarking is theoretically impossible for generative models. Not just practically difficult \u2014 provably impossible. As the gap between watermarked and unwatermarked high-quality outputs becomes a vanishingly small subset of all high-quality text, an attacker can always find quality-preserving perturbations that escape detection. The result formalizes the intuition behind the paraphrase attack results, as shown in Zhang et al.’s ICML 2024 paper<\/a>.<\/p>\n What the Detection API Infrastructure Requires<\/p>\n The engineer’s confirmation was brief: a text detection API “that you can use yourself” is coming. What that means in operational terms is a distinct engineering problem from the watermarking system itself.<\/p>\n A production detection API requires a callable endpoint that accepts arbitrary text, applies the statistical test against Anthropic’s secret key, and returns a confidence result at scale with low latency and across the full query volume a publicly accessible verification service will attract. That is not a documentation page. It is a new service tier. It requires decisions about pricing (pay-per-query, subscription, free tier), rate limits (how many queries per API key per hour), access controls (who qualifies for access), SLA guarantees (what response time Anthropic commits to), and the governance model for abuse cases.<\/p>\n None of these operational parameters have been announced. A developer who wants to integrate watermark verification into a content ingestion pipeline, a document review workflow, an academic integrity system, or a trust-and-safety stack needs all of them before they can make an architectural commitment. Anthropic has confirmed the product; it has not confirmed any of the terms that make the product integrable.<\/p>\n The pricing question has a structural dimension beyond cost. If Anthropic offers the detection API freely and without rate limits, evasion is maximally efficient \u2014 an adversary can query until the mark disappears at negligible cost. If Anthropic gates it behind a paid tier or strict rate limits, third-party verification of Anthropic’s own claimed transparency commitments becomes practically restricted to entities willing to pay for programmatic access. The Code of Practice requires supporting third-party detection; it does not specify how that support must be priced. How Anthropic resolves that tension will define whether the detection API functions as a genuine transparency tool or primarily as an internal compliance instrument.<\/p>\n What Developers and Enterprises Must Do Now<\/p>\n The watermarking system is live. Every output from a Claude model launched on or after August 2, 2026 \u2014 across the Claude Platform API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and Claude models accessed through AWS, Google Cloud, and Microsoft Foundry \u2014 carries an embedded statistical watermark and, for supported file types, a C2PA signed manifest, as confirmed in Anthropic’s Help Center<\/a>.<\/p>\n There is no configuration parameter to disable it. No API flag requests unmarked output. Developers building on Claude cannot opt out, and third-party developers whose products pass Claude output to end users carry a watermarked product whether or not they disclose it.<\/p>\n Anthropic is explicit that the model-level watermark satisfies Anthropic’s own obligation under the EU Code of Practice. It does not satisfy a deployer’s separate obligation under Article 50(1) to inform end users that they are interacting with an AI-powered system. A company that built a customer service chatbot on Claude and has not disclosed that Claude powers it has a watermarked product \u2014 it does not have a compliant one. These are different obligations, and the watermark satisfies neither both nor the other<\/a>.<\/p>\n The legacy model question is on a separate timeline. Claude models launched before August 2, 2026 fall under a transition period: Anthropic says it is working to add watermarking support before December 2, 2026, when the EU’s grace period for pre-existing systems expires. The company will update its Help Center as retroactive support becomes available.<\/p>\n For code specifically: developers concerned about AI provenance in repositories have more protection than the policy language suggests and less than the policy language implies. Commit messages, PR descriptions, and documentation will mark normally. The code diffs themselves will not \u2014 the physics of the token-entropy constraint, combined with formatting tools that rewrite identifier casing and whitespace on every save, are adversarial to the mechanism in a way that prose is not.<\/p>\n Is Watermarking Worth the Infrastructure Investment?<\/p>\n The detection API confirmation is the most consequential fact in the engineer’s statement, but it sits in a field where the theoretical and empirical literature has grown increasingly pessimistic about what any watermarking system can reliably achieve.<\/p>\n The EU AI Act requires that marking be “sufficiently reliable and robust.”<\/a> California’s SB 942 required disclosures that are “permanent or extraordinarily difficult to remove.” The July 2026 forensic evaluation concluded that no current method meets either standard when subjected to meaning-preserving paraphrase. That is not a criticism of Anthropic’s specific implementation \u2014 Anthropic has not published its method, and its approach may perform differently than the evaluated schemes. But it is a statement about the state of the field that Anthropic is working within.<\/p>\n The Kirchenbauer engineers who published the original 2023 paper, the Google DeepMind team that published SynthID-Text in Nature, and the auditors who published the July 2026 Daubert evaluation are all operating on the same foundational constraint: any system that produces high-quality outputs with and without a watermark can, in principle, be evaded by an attacker who can generate alternative high-quality text. The impossibility theorem proves this in the limit. Current deployments are working in a regime where the attacker’s tools are not yet sophisticated enough to fully exploit that gap \u2014 and where watermarking still provides meaningful signal for passive detection and regulatory compliance purposes.<\/p>\n What the detection API does, when it ships, is accelerate adversarial discovery of that gap. It gives any party the ability to measure whether a given paraphrase has escaped the mark, at low cost, without needing to understand the underlying scheme. That is a different capability profile than the watermark alone \u2014 and a different risk calculus than the one Anthropic presented when it announced the watermarking system on August 11.<\/p>\n Frequently Asked QuestionsDoes the Claude watermark prove that an AI wrote a document \u2014 or just that Claude touched it?<\/p>\n The mark proves only that a supported Claude model processed the text. It does not distinguish between Claude having generated the full content and Claude having corrected a single word in a paragraph a human wrote. Anyone who proofreads, translates, summarizes, or reformats their own writing through Claude will produce marked text. Anthropic’s own Help Center states this explicitly: Claude “may not be the original author.” Academic institutions, employers, and platforms that treat a detected Claude mark as evidence that “AI wrote this” are making an inference the system is not designed to support \u2014 and one that the scientific literature says fails the forensic admissibility standard<\/a>.<\/p>\n Can the Claude watermark be removed, and how easily?<\/p>\n Through meaning-preserving paraphrase: yes, and with high reliability. The July 2026 forensic evaluation (arXiv 2607.16010) found that paraphrase removed KGW and Unigram marks in 100% of tested cases, and removed the SynthID mark in 98.3% of cases<\/a>. One pass through a paraphrase tool is sufficient. Heavy manual editing degrades the mark. Translation breaks it. The C2PA metadata attached to image and file outputs is even more fragile: any screenshot, format conversion, or social media re-upload strips it, and open-source removal tools<\/a> already exist on GitHub. The statistical text watermark is a more durable provenance signal than C2PA metadata \u2014 but “more durable than trivially strippable” is a low bar, not a security guarantee.<\/p>\n What does the detection API have to do with evasion \u2014 can’t Anthropic just build it safely?<\/p>\n Once a detection API is publicly accessible, it functions as an oracle: any party can feed in a candidate text, receive a verdict, and iterate with modified text until the verdict changes. The cost of one paraphrase iteration is negligible at current API pricing. The Code of Practice that Anthropic signed requires supporting third-party detection, which limits how restricted the API can be. Gating it behind a paid tier or strict rate limits addresses the economics of systematic evasion while creating a different problem: limiting verification to parties willing to pay, which reduces the API’s value as a transparency tool. Anthropic has not yet disclosed how it will balance these competing obligations. The pricing model, rate limits, access controls, and SLA guarantees for the detection API have not been announced<\/a>.<\/p>\n Can any watermark system be made truly unbeatable?<\/p>\n No. Zhang et al. proved at ICML 2024 that under standard assumptions \u2014 an attacker with access to a quality oracle and a perturbation oracle \u2014 strong watermarking is theoretically impossible for generative models. The intuition: as the gap between watermarked and unwatermarked high-quality text shrinks, any attacker who can generate quality-preserving perturbations can systematically escape detection. Current deployments work because today’s adversarial paraphrase tools are not fully exploiting this gap. The detection API Anthropic plans to ship will make that gap easier and cheaper to exploit \u2014 not because of anything Anthropic designed poorly, but because that is what a public evasion oracle does to any detection system<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"This picture taken on April 16, 2026, shows Jung Hui-hun, a digital forensic specialist at the NEC’s cyber…\n","protected":false},"author":2,"featured_media":137752,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[1494,68097,68099,53,3154,182,68096,68098,1977,26986],"class_list":["post-137751","post","type-post","status-publish","format-standard","has-post-thumbnail","category-anthropic","tag-ai-content-watermarking","tag-ai-text-watermark-detection","tag-ai-watermark-evasion","tag-anthropic","tag-anthropic-claude","tag-claude","tag-claude-watermark-detection-api","tag-daubert-standard-ai-watermark","tag-eu-ai-act","tag-synthid"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/137751","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=137751"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/137751\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/137752"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=137751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=137751"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=137751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}