Anthropic's text watermarks are easy to bypass on older Claude models

Expanding the watermark

Anthropic is currently in the process of retrofitting its older Claude models with a text watermarking system. This initiative is part of a broader effort to ensure the company meets the December deadline set by the EU AI Act. While newer models released after August 2, 2026, already include these marks, older versions are being updated in stages.

The latest wave of updates includes Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Haiku 4.5. These models are scheduled to receive the watermarking technology by November 16, 2026. Some models, like Claude Opus 4.6, were originally slated for an earlier release date but have seen slight delays in the rollout schedule.

The company describes the watermark as an imperceptible pattern in word choice that does not affect the readability or quality of the output. It is designed to be statistically detectable without adding extra characters, tokens, or slowing down the response speed. Furthermore, Anthropic states that the watermark does not contain any information regarding the user, their organization, or their specific conversations.

How the technology works

Anthropic utilizes a variant of the SynthID text method, which was originally developed by Google DeepMind. This method works by tweaking the randomness behind how a model selects specific words. By influencing these choices, the system creates a detectable pattern that remains invisible to the average human reader.

The watermark is embedded at the model level, meaning it functions across all platforms where these models are hosted. This includes major providers like Amazon Web Services, Google Cloud, and Microsoft Foundry. Because the mark is built into the model itself, customers using these APIs cannot turn the feature off manually.

The implementation relies on three specific sampling parameters: temperature, top_p, and top_k. These settings determine how much randomness a model uses when picking words from its vocabulary. For the watermark to remain active on certain older models, these three parameters must be left at their default values. If a developer changes even one of these settings, the watermark can be avoided.

Loopholes and limitations

The current rollout reveals a significant loophole for developers and power users. On models like Claude Opus 4.6 and Claude Sonnet 4.6, the watermark only kicks in when the sampling parameters are at their defaults. A minor tweak to any of these values is enough to dodge the mark, even though Opus 4.6 remains a top-tier writing model.

Anthropic has acknowledged this limitation by warning customers who rely on the watermark for compliance to keep their settings at the defaults. However, the company did not include this specific caveat for other models in the same wave, such as Claude Mythos 5 or Claude Opus 4.7. This suggests that the watermark might be more persistent on those specific models regardless of the settings used.

The effectiveness of these watermarks remains a subject of debate among experts. Some critics argue that because synonyms rarely mean exactly the same thing, choosing words based on a watermark key could eventually degrade the precision of the AI. Others worry about the practical implications for law firms, where multiple layered watermarks could create confusion in legal documents.

Industry context and compliance

Anthropic's move is largely driven by the need to comply with the EU AI Act. Every model released since August 2026 has shipped with the watermark on day one to ensure regulatory alignment. By retrofitting older models, Anthropic is attempting to create a consistent standard for AI-generated content across its entire product line.

Other major players are also developing their own methods for identifying AI content. For example, OpenAI launched a system called textGrain in October 2026. However, that system only activates by default for specific users in the EU, while API customers worldwide can choose to flip it on or off. This contrasts with Anthropic's approach, where the watermark is mandatory and cannot be disabled by the user.

The rollout on Amazon Bedrock may take a few extra days compared to other platforms. Because the watermark is embedded at the model level, it is designed to be a universal standard. As more models are retrofitted, the industry moves closer to a system where AI-generated text can be identified by software, even if it remains indistinguishable to the human eye.