Anthropic Reveals What The Watermark Is And How It Can Be Defeated

Aug 15, 2026 05:46 PM - 2 hours ago 1

Anthropic announced really its watermark works, confirming virtually each of the specifications antecedently reported astir a akin watermarking method called MirrorMark. Similar to MirrorMark, the watermark is the randomness shape itself which mirrors the randomness of the LLM erstwhile it generates text.

How The Watermark Works

Contrary to what immoderate AI influencers say, location are nary Unicode characters that are embedded into the text. So it’s not thing that you tin transcript and paste into a matter record to region aliases to identify.

Also, it’s not astir em dash usage and neither is it astir patterns that LLMs thin to use, for illustration “It’s not this, it’s that” style of writing. It’s not looking for the likelihood that thing was written by an AI.

What it’s looking for is simply a circumstantial watermark pattern.

LLMs make the adjacent apt matter successful a series but pinch randomness built in. It doesn’t ever prime the astir apt adjacent word; location is an constituent of randomness to the connection that’s chosen. SynthID uses that randomness to group a shape that’s dictated by a watermark cardinal positive the discourse of preceding words. Because a SynthID-style watermark subtly alters the connection prime randomness, the matter that’s generated is indistinguishable from regular generated text. Users can’t place the watermark without the watermark key.

Anthropic explains:

“That shape is undetectable to the reader, but is detectable to anyone who has a cardinal that encodes it. When watermarking is used, choices are still made astatine random, but the root of the randomness is different. Instead of utilizing an arbitrary random number generator to prime the adjacent word, watermarking uses the cardinal and a fewer words that travel earlier to settee what connection the exemplary should pick. That is, the words that Claude picks are still random, but now, 1 tin cheque the series of words and spot if it’s accordant pinch the choices Claude would make if it was utilizing the key.”

A Version Of SynthID

The announcement said that the caller watermark is simply a type of SynthID-Text which was developed by Google DeepMind successful 2024. It’s not SynthID, it’s a type of it. The authorities of the creation for this benignant of watermarking has importantly improved successful the intervening 2 years.

The announcement states:

“Claude’s matter watermark is simply a type of the SynthID-Text attack published by Google DeepMind successful a Nature insubstantial successful 2024. It belongs to a family of approaches that spell backmost to a connection by Scott Aaronson successful 2022, each of which stock the aforesaid creation rule that we described above—the watermark only changes the root of the randomness utilized to prime among words.”

Can Anthropic’s Watermark Be Defeated?

Yes, it tin beryllium defeated done paraphrasing. According to Anthropic, ray editing astir apt won’t conclusion it.

According to Anthropic:

“Can’t personification conscionable edit the matter to get astir the watermarking?
To immoderate extent, yes. Light editing astir apt won’t region the watermark completely; a complete rewrite wherever each connection is replaced will. In the second case, of course, it’s arguable whether the matter tin immoderate longer beryllium described arsenic AI-generated.”

SynthID looks for the watermark connection shape that was inserted astatine the clip the matter was generated. So if you paraphrase aliases edit capable of the archive it’s going to erase the words that enactment arsenic a watermark.

It’s Not SynthID

SynthID was developed successful 2024 and the authorities of the creation has moved connected complete the past 2 years.

A caller type of SynthID, called MirrorMark, extends SynthID by spreading the watermark crossed the generated matter and utilizing the surrounding words arsenic discourse for determining wherever each portion is placed, which makes it much resistant to editing.

SynthID is simply a zero-bit watermark, which intends it’s detecting watermark aliases nary watermark. MirrorMark tin encode aggregate bits of information, fundamentally spreading the watermark crossed the generated text.

Here’s what a 2026 type for illustration MirrorMark tin do:

It adds multi-bit encoding.
It mirrors the randomness of the LLM’s matter generation.
It uses CABS, a Context-Anchored Balanced Scheduler, which decides wherever the different watermarks are embedded.
It’s specifically designed to beryllium resistant to editing (like Anthropic’s, which is resistant to ray editing).

I americium not saying that MirrorMark is what Anthropic is using. But I americium saying that earlier you put each your eggs into the SynthID basket, which is 2 years old, it whitethorn beryllium useful to spot what a 2026 type of SynthID tin do.

Major Takeaways From Anthropic’s Watermark Reveal

Here are the awesome takeaways from what Anthropic revealed:

Claude will watermark early matter outputs.
Anthropic says early Claude models will make watermarked matter arsenic portion of its compliance pinch the EU AI Act.
The watermark is simply a shape created during matter generation.
It is not Unicode, metadata, aliases hidden characters. The watermark is created done the word-selection process itself.
Claude’s watermark is simply a type of SynthID-Text.
Anthropic says its method is based connected Google DeepMind’s 2024 SynthID-Text approach.
The watermark changes the root of randomness utilized to prime words.
Claude still makes random choices among plausible words, but the watermark cardinal and preceding words are utilized to find that randomness.
The watermark creates a detectable shape successful Claude’s connection choices.
Someone pinch the cardinal tin cheque whether the series of words is accordant pinch the choices Claude would person made utilizing that key.
Nothing is added to the text.
Anthropic explicitly says location are nary hidden characters, nary other tokens, and nary visible additions.
Watermarked matter cannot beryllium distinguished from non-watermarked text.
Anthropic says the watermark has nary effect connected value aliases the generated content.
The watermark does not origin Claude to make different connection choices.
Anthropic says it does not bias Claude toward peculiar words.
Less words make it little detectable.
Anthropic says watermark discovery performs poorly connected mini samples. It useful amended pinch much words.
The watermark is weaker successful actual content.
It’s little reliable erstwhile location are less words to take from because of constraints based connected actual type of content.
The watermark is weaker erstwhile utilized for proofreading type edits.
Anthropic says if you “ask it to edit only the grammar and punctuation and thing else, the watermark tin only unrecorded successful the fistful of corrections, which mightiness beryllium excessively fewer to register.”
Anthropic plans to merchandise a watermark discovery API.
Non-text image files for illustration JPG, PNG, and SVGs will usage C2PA metadata.
Watermarking has a trivial effect connected velocity and adds nary further token cost.