To comply with the European Union's AI Act, Anthropic has globally deployed invisible watermarks across its Claude AI models. While the system embeds traceable patterns at the model's sampling level, Anthropic's confirmation of an upcoming public text detection API has raised security concerns. Experts warn this API will function as an 'evasion oracle,' allowing users to cheaply bypass the watermark using automated paraphrasing. Academic research highlights that similar watermarks have a 98.3% removal rate after a single paraphrase pass and fail to meet US legal standards for expert evidence.
Claude watermark deployment
- ▪Anthropic began embedding invisible watermarks into text generated by its Claude models and chatbot on August 2, 2026.
- ▪The Claude watermarking policy applies globally to all regions where Claude is offered, including its consumer app, Claude Platform API, Claude Code, Claude Cowork, Claude Tag, and versions accessed via AWS, Google Cloud, and Microsoft Foundry.
EU AI Act compliance driver
- ▪Anthropic signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content in July 2026 alongside approximately 190 other signatories.
- ▪Non-compliance with the EU AI Act's transparency obligations can trigger fines of up to €15 million or 3% of total global annual turnover, whichever is higher.
- ▪Anthropic's watermarking deployment is driven by its commitment to comply with Article 50 of the European Union's AI Act, which requires providers of synthetic content to mark their outputs.
Detection API evasion vulnerability
- ▪A publicly accessible detection API creates an 'evasion oracle' where adversaries can repeatedly test and iterate paraphrases of watermarked text until the mark no longer registers.
- ▪An Anthropic engineer confirmed on August 12, 2026, that the company is developing a publicly callable text detection API to allow third-party developers to verify Claude AI markings.
Paraphrase attack effectiveness
- ▪The July 2026 forensic evaluation (arXiv 2607.16010) concluded that KGW, Unigram, and SynthID watermark detection methods failed to satisfy more than two of the five Daubert factors required for scientific evidence admissibility in US courts.
- ▪A July 2026 forensic evaluation published in arXiv 2607.16010 found that the removal rate of Google DeepMind's SynthID-Text watermark was 98.3% after a single meaning-preserving paraphrase pass.
Watermark technical implementation
- ▪Anthropic uses a variant of Google DeepMind's SynthID-Text method, which tweaks the randomness source during word selection to embed a traceable pattern without affecting text readability or quality.
- ▪Anthropic's text watermarking mechanism operates in the sampling pipeline below the model level, meaning the Claude model itself is unaware that its output is being watermarked.
- ▪For files generated by Claude, such as .svg, .png, or .jpg, Anthropic attaches signed provenance metadata using the open C2PA standard to signal that the file was processed by Claude.
Story comments
Loading comments…