Side Maker Log
USBuddingPlanted Nov 5, 2026Last tended Nov 5, 20267 minViews 0

Claude's Text Watermark Now Covers Older Models: What Changed on November 3 and Where the Gaps Are

Anthropic extended its invisible text watermark to Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. How it works, who can detect it, the sampling loophole, and what writers and developers should do.

Starting November 3, text written by Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6 carries an invisible watermark. Anthropic had applied it only to models released after August 2, 2026. Now the older ones are in. You cannot turn it off, and you cannot check your own text for it. Detection runs through a private-preview API open only to approved organizations such as regulators, newsrooms and researchers. The trigger is the EU AI Act, but the watermark applies worldwide. If you write with Claude or build on the Claude API, this is a good moment to learn what the mark is, and what it is not.

What happened

On August 14, 2026, Anthropic published a post titled "How Claude's text watermark works." It said future Claude models would embed a watermark to comply with the EU AI Act. Models launched before August 2 fell under a transition period in the law, and Anthropic promised to add them "over the coming months."

Those months ended on November 3. The Decoder reported on October 31 that an email to Claude Platform customers named four models: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. The Amazon Bedrock rollout "may take a few additional days." Newer models such as Opus 5.5 were already watermarked.

One detail does not line up. According to CellCog, the November 3 release note lists only Mythos 5, Opus 4.7 and Sonnet 4.6. Opus 4.6 is missing. The email says four models, the release note says three, so the exact start date for Opus 4.6 is still open.

Why now: the EU AI Act

The transparency provisions of the EU AI Act took effect on August 2, 2026. Content generated or edited by AI must be marked so other systems can identify it. Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July, and TechCrunch reported that Google, Meta, Microsoft and OpenAI committed to the same code.

Why does a European rule reach users in Ohio or Seoul? Anthropic wrote that there is "no durable way yet to scope it by region," so the watermark ships globally. The Independent contrasted this with OpenAI, whose ChatGPT watermark feature it says applies automatically only in Europe.

How it works: no hidden characters, just a steered choice

A text watermark is not a faint logo in the corner. There are no hidden characters and no extra tokens. The mark lives in how the model picks its next word.

At every step, a language model has several candidate words with probabilities, and normally a random number generator makes the pick. With the watermark, a secret key plus the few preceding words make the pick instead. The output still looks random. But whoever holds the key can run a statistical test: these word choices line up with the key far more often than chance would allow. Anthropic says the method is a version of SynthID-Text, which Google DeepMind published in Nature in 2024.

How the Claude text watermark is embedded and detected

  1. Candidate wordsThe model computes the next-word candidates and their probabilities
  2. Key-driven pickA secret key plus the preceding words choose among candidates instead of a random number
  3. Finished textNo extra characters or tokens. The mark travels with copy and paste
  4. DetectionOnly a key holder can compute the probability that Claude was involved

The last step matters most. Detection does not return "AI" or "human." It returns the likelihood that Claude was partly involved. It cannot prove a human wrote something, and it cannot recognize other companies' models, because they use different keys.

Anthropic lists its own limits plainly:

  • Short passages give too little signal. Confidence rises with length.
  • Factual text with one right answer leaves nothing to choose, so little mark remains.
  • Light proofreading may change too few words to detect.
  • Code needs exact output, so the mark is weak and mostly lands in comments.
  • Translation is fully watermarked, since Claude chooses every word.
  • Light editing "probably won't remove the watermark completely." A full rewrite that replaces every word will.

Anthropic says quality, speed and price are unchanged, since no tokens are added. It also states the watermark "carries no identifying information and can't be traced to a specific person, organization, or chat."

The sampling loophole

The most interesting part of this rollout is a caveat The Decoder pulled from the email. On Opus 4.6 and Sonnet 4.6, the watermark applies only when temperature, top_p and top_k are all left at their defaults. Change any one of them, even slightly, and the mark is gone. The email includes no such caveat for Mythos 5 or Opus 4.7, which suggests those models are watermarked regardless of settings.

Anthropic's wording: "If you rely on the watermark for your own compliance, keep these settings at their defaults." So this is a disclosed condition, not a hidden hole. Still, the result is lopsided. A developer on the API can skip the mark with one parameter. A consumer in the Claude app cannot.

Other views and open questions

A September arXiv paper, "Watermarks Without Verification" by Nemecek, Chaudhary and Ayday, argues the real problem is not the technique but that nobody can verify the claims. Users suspect quality loss and hidden identifiers. The vendor says neither is true. With no public tool to test the deployed system, neither side can be checked.

The authors ran the open-source SynthID-Text implementation on two open-weight models. In prose, the watermark's effect did not exceed the effect of changing the random seed. In code, one model lost about three points of correctness. That broadly supports Anthropic's "no quality impact" claim, but it was not a test of Claude itself. The paper asks for five things: released matched outputs, configuration disclosure, accredited audits, a shared evaluation protocol and interoperable detection.

The Independent relayed user worries from August: proofreading or fact-checking with Claude might still flag a document, while rephrasing with another AI could strip the mark. Anthropic conceded the short-text weakness and rejected the quality complaint.

The biggest gap is simple. The person who wrote the text cannot check it. The detection API is in private preview, reached through an access request form, for approved organizations only. Anthropic says it plans to widen access but gave no date.

What this means for you

If you write with Claude at work or school: Anything produced by the four models after November 3 carries the mark. If the recipient is an organization with detection access, a "Claude involvement" probability can be computed. Per Anthropic, a spell-check pass is hard to detect. Pasting in a full draft and polishing your own paragraph leave very different footprints.

If you build on the Claude API: With default sampling, Opus 4.6 and Sonnet 4.6 output is watermarked. If you serve EU customers and plan to lean on this watermark for transparency obligations, leave temperature, top_p and top_k alone. If your product tunes those for creativity, know that the mark drops out. Cost and latency do not change. API behavior is shifting quickly this season, as with the message-threads change covered in Anthropic Message Threads: Claude API Agents Stop Resending the Whole Conversation, so reading release notes is worth the habit.

If you run a newsroom, school or research group: The access request form is open. Treat results as probabilities, distrust them on short or purely factual text, and remember the tool cannot certify that a human wrote something.

What to watch

  • The exact start date for Opus 4.6, and the timing on Bedrock, Google Cloud and Microsoft Foundry.
  • The schedule for remaining pre-August models. The Independent notes users can still select models back to Opus 3, which are not yet covered.
  • Whether and when detection opens to ordinary users.
  • How other vendors line up ahead of the EU AI Act's December deadline mentioned by The Decoder.

Closing thought

Reading this, I kept circling one structure: my text carries a mark I cannot see, and someone else holds the only reader. If Anthropic's account is accurate, there is no identifier and no quality cost, so maybe there is nothing to fear. But "you can't check, so trust us" is a sentence technology companies say often.

As someone who builds small apps alone, a second thought followed. If a product delegates writing to an API, whose watermark ends up in the output is now part of the product. And one line of configuration changes it.

Are you fine with a mark in your Claude-written text, or should you at least be able to check your own words?

Sources

한국어로 읽기 →

Keep reading

USAnthropic Message Threads: Claude API Agents Stop Resending the Whole ConversationTrends · Nov 4, 2026KoreaKrafton's Kiff and Ludi 0.2: Why a Game Studio Launched a K-pop AI Chat App and a Robot Brain on the Same DayTrends · Nov 3, 2026USThe October 2026 AI Stock Selloff, Explained: Why Intel, Alphabet and Amazon Spooked the MarketTrends · Nov 2, 2026

Comments 0

Be the first to leave a comment.

No sign-in needed. Comments with links appear after review.