The First AI Watermark War - Claude, SynthID-Text, the EU AI Act, and the Fight Over Who Gets to Cer

Question

🧠TL;DR

• The EU’s Article 50 transparency regime is pushing frontier AI providers toward machine-readable provenance. Anthropic has confirmed that Claude’s text watermark1 uses a version of Google DeepMind’s SynthID-Text5.
• SynthID-Text hides no magic phrase inside the prose. Its signal emerges from the model’s token-selection process, so rewriting can disturb the statistical trace without anyone recovering the secret key.
• Open-source tooling appeared almost immediately. In the GitHub snapshot used for this article—17 August 2026, 17:34 ICT—[guillaumemeyer/watermarks-remover][3]2 displayed 12.6k stars and 1.4k forks. The speed is evidence of developer attention, not proof that Anthropic’s private production detector has been defeated.
• Real workflows make the meaning of detection messy. Claude may draft a document, merely proofread it, translate a human-written passage, or touch only comments and identifiers in code. A positive provenance signal does not settle authorship.
• Longer term, one watermark will carry too much weight if schools, employers, publishers or platforms treat it as a verdict. A useful provenance system needs to preserve what happened after generation as well.

---

Part I — The Technical Contest

A European Rule Reaches the Sampling Loop

!ChatGPT Image Aug 17, 2026, 10_55_54 PM (2).png.png)

By the time Anthropic explained Claude’s watermark in detail on August 14, the regulatory machinery behind it had already been moving for months.

The European Commission published the first draft of its transparency Code on December 17, 2025 and the final Code of Practice on Transparency of AI-generated Content3 on June 10, 2026. The relevant obligations under Article 50 of Regulation (EU) 2024/16894 became applicable on August 2.

The Code gives providers and deployers a voluntary route for demonstrating compliance; Article 50 supplies the legal obligation underneath it. The provider-side requirement covers machine-readable marking and detectability of artificially generated or manipulated text, audio, images and video.

Claude is one implementation arriving inside a much larger regulatory movement. By the end of July, the Commission said about 190 organizations had signed at least one part of the Code. Its official register, last updated August 5, listed 82 Section 1 signatories and 152 Section 2 signatories.

Anthropic appears in Section 1 alongside Google, Meta, Microsoft, OpenAI, Mistral, Cohere, Aleph Alpha, Black Forest Labs and Synthesia. The small 82-versus-83 discrepancy that appeared in secondary reporting is therefore no longer worth carrying into the article; the Commission’s live register currently says 82.

That wider participation changes the competitive problem. One provider acting alone could make itself less attractive to customers who dislike machine-detectable provenance attached to their output. Comparable obligations across several frontier providers narrow that escape route.

The familiar Brussels Effect is operating here alongside a quieter coordination effect: a European transparency rule is helping push rival systems toward a common technical norm. Anthropic has also said that the watermark is being applied globally at launch because the company does not yet have a durable way to scope it regionally.

Eventually the legal language has to turn into code. With statistical text watermarking, that translation reaches all the way into the moment when a model chooses what comes next.

---

How the Mark Hides in the Choice

So, how does the watermark actually work?

Imagine a jazz player improvising over a familiar progression. At any moment, several notes may fit perfectly well. Give the musician a private rule that quietly favors certain acceptable notes whenever several choices are available. The audience still hears an ordinary solo; someone who knows the rule can later examine the sequence and ask whether those apparently natural choices followed the hidden preference unusually often.

That is the useful intuition behind SynthID-Text. The mathematics makes the mechanism more precise.

An autoregressive language model repeatedly computes a probability distribution over its possible next token,

$$ pLM(xt∣x<t), $$

where $xt$ is the token about to be generated and $x<t$ is the preceding context. In the jazz analogy, the preceding context is the music already played, while the probability distribution is the set of notes that could plausibly come next.

Google DeepMind’s SynthID-Text5 intervenes during selection from those possibilities. The underlying model does not need to be retrained. Candidate tokens are drawn from distributions the model already considers plausible, while pseudorandom watermark scoring influences which candidate survives the selection process.

A simplified picture is:

$$ x(1),x(2),…,x(2m)∼pLM(⋅∣x<t). $$

This equation is not the watermark itself. It describes the pool of plausible next-token candidates from which the watermarking process can make its choice. In the jazz analogy, the musician has not yet played the next note; several notes still fit the harmony. SynthID-Text works inside that remaining freedom.

The musical mapping is straightforward:

• Music already played → preceding context
• Notes that could fit next → next-token distribution
• Private preference rule → pseudorandom watermark scoring
• Competition among plausible notes → Tournament sampling
• Note actually played → selected token
• Pattern across the solo → statistical evidence available to the detector

One token carries very little evidence. The signal emerges across many choices, much as one ordinary note tells you almost nothing about a musician’s hidden preference. The practical question, then, is whether that accumulated signal can remain detectable at scale without making the output noticeably worse.

DeepMind tested SynthID-Text at production scale across nearly 20 million watermarked and unwatermarked Gemini responses and reported no statistically significant degradation in user feedback attributable to the watermark.5

The same structure also exposes the weakness. Give the same piece to another musician and ask for a fresh improvisation. The musical idea can survive while the original sequence of note choices disappears. Heavy paraphrasing can do something similar to text: preserve much of the meaning while replacing the token history that carried the statistical signal.

---

💡Deep Dive Recommendation

For a complete breakdown of how statistical text watermarking works under the hood (including SynthID-Text, tournament sampling, and detection mechanics), check out

Claude Text Watermark - The Science behind it

by Code Bear.

Claude Enters an Older Argument

Anthropic’s August disclosure placed Claude inside an existing research lineage rather than introducing a new species of watermark. The company says its implementation is a version of SynthID-Text and traces the broader idea back through earlier statistical watermarking work, including ideas discussed by Scott Aaronson in 2022.1

Claude’s production keys, detector thresholds and model-specific adaptations remain private. The public Google implementation is therefore useful as a technical reference, but it should not be treated as a replica of Anthropic’s deployed detector. That boundary matters once claims of a “break” begin to circulate.

The robustness question predates Claude anyway. Researchers have spent years asking what happens when a statistical signal is attached to a sequence of token choices and somebody deliberately replaces those choices while preserving the content.

---

Entropy Makes the Story Less Neat

The jazz metaphor helps here, but only up to a point.

Think of entropy as roughly the size of the improvisational space. Over an open progression, a player may have dozens of musically acceptable notes or phrases available. At a tightly specified cue, the space narrows sharply. A sampling-based watermark needs some freedom of choice because there has to be more than one plausible continuation for the selection mechanism to influence.

That does not mean detectability simply rises as entropy rises. DeepMind’s own results are more awkward than that. SynthID-Text’s improvement over Gumbel sampling was generally strongest in lower-entropy settings, including lower temperatures and larger models.5

The metaphor is useful for understanding why some choice space is necessary; it stops being reliable if we try to turn it into a complete theory of detector strength.

Code makes the constraint concrete. Natural-language prose often tolerates several acceptable formulations. Executable code can be much less forgiving. return x + 1 cannot become return x + 2 because the second choice happens to be convenient for a watermark. Types, APIs, syntax and behavioral requirements constrain the available alternatives.

Comments, docstrings, local identifiers and some equivalent implementations leave more room, although those are also easy targets for later refactoring.

This is where the technical discussion begins to look like an ordinary developer workflow rather than a watermark paper.

---

What It Looks Like in Real Work

• Long-form drafting: If Claude writes most of an article, memo or report, the watermarking mechanism gets repeated opportunities to influence token selection. This is the closest real-world case to the jazz-solo intuition.
• Proofreading: A human can write the argument and the original draft, then ask Claude to improve grammar or tone. The final text may still carry evidence that Claude processed it, even though Claude did not originate the research or ideas.
• Translation: Claude may regenerate almost all of the surface language while preserving meaning from a human source. A positive detection result identifies model involvement in the transformation, not ownership of the underlying ideas.
• Claude Code: Program semantics constrain many choices. Comments, documentation, names and some implementation details leave more room. Formatting, refactoring or later model edits can replace part of that original choice history.

These cases are not edge conditions. They are ordinary ways people already use frontier models, which is why the meaning of a positive watermark result becomes complicated long before any university or employer gets involved.

---

Rewriting the Carrier

Return to the jazz solo one last time.

Give the same chord progression to another musician and ask for a fresh improvisation. The tune may remain recognizably the same, but the original sequence of choices—the preferred intervals, tiny rhythmic habits, the exact order of decisions—has disappeared. A strong paraphrase can do something similar to text.

Let the original marked output be

$$ T=(x1,x2,…,xn). $$

A second generative system produces $T′$ that preserves enough semantic content to remain useful while replacing a substantial portion of the original wording. Paraphrasing, back-translation, sentence restructuring and full regeneration all work in this general direction.

Every changed token can also change the context used to evaluate later tokens, so the disruption propagates through the sequence. The attacker does not need Anthropic’s secret key. The attack works directly on the statistical history carried by the text.

DeepMind’s own paper evaluates edits and robustness, and a 2024 Nature editorial warned that determined users could still weaken or remove generative-AI watermarks.6 The attack surface was visible before Claude adopted SynthID-Text. Claude simply gave it a widely used commercial target.

The jazz metaphor ends here. From this point forward the issue is no longer how a model improvises. It is what developers and institutions do with the trace after generation.

---

GitHub Turns the Attack into Ordinary Tooling

On August 17, 2026, guillaumemeyer/watermarks-remover displayed 12.6k stars and 1.4k forks. Those numbers belong to the timestamp; they were changing too quickly to function as a timeless statistic. 2

GitHub stars are a noisy social measure. They mix curiosity, bookmarking, practical use, research interest and frustration with the policy itself. Treating the total as a referendum on EU regulation would be indefensible.

The growth curve is more informative: provenance-removal tooling moved from a specialist security question to a highly visible open-source project within days.

The repository itself keeps several technical layers separate. Hidden Unicode and file metadata are handled differently from statistical text marks. Its text-watermark workflows use paraphrasing, “humanizing,” back-translation and structural rewriting.

The project’s MarkLLM adapter also states the evidentiary limit directly: a test performed against a known watermark scheme, known configuration and known key cannot certify that Anthropic’s private detector will fail.2

So the available evidence supports a narrower claim. Developers have operationalized the known attack surface of statistical text watermarking. There is still no public end-to-end demonstration that Anthropic’s production detector has been defeated.

That distinction matters more than the repo headline.

---

The Defender’s Burden

A production watermark has to survive several constraints at once. It must preserve output quality, remain detectable after ordinary editing, avoid an unacceptable false-positive rate and add little enough overhead to be deployed at scale. DeepMind’s paper also distinguishes non-distortionary and distortionary configurations, making some of the trade-offs explicit.5

The attacker has a narrower objective. A single transformation that preserves enough utility while reducing the detector score below a practical threshold may be sufficient.

Whether any current public method reliably achieves that against Claude remains unknown. The asymmetry nevertheless explains why watermarking is unlikely to end in a clean engineering victory. Better watermarking schemes will appear; removal tools will adapt; providers may combine statistical marks with signed metadata or external records.

A more difficult question appears once we assume the defender succeeds.

---

Part II — What Happens After Detection Succeeds?

Suppose Anthropic eventually returns a highly reliable result showing that Claude participated in a document. The watermark survived, and the detector did exactly what it was designed to do.

The technical problem has not vanished. It has changed owners.

A university, employer, client, publisher or platform now has to decide what the result means. Those institutions care about authorship, permitted assistance, disclosure rules and responsibility, none of which are encoded directly in a watermark score.

---

The Backlash Has Already Started

Business Insider spoke with four Claude users who said they had cancelled subscriptions amid the watermark controversy. Anthropic said it had not observed a broader increase in cancellations, so the evidence supports a modest conclusion: some users are genuinely angry, while there is no basis yet for describing a mass exodus.7

The individual cases matter because their objections were not all the same. Stevan Bogosavljević, a senior software engineer in Montenegro, had already cancelled Claude Max in July over service quality, access to top models and competing alternatives.

The watermark strengthened that decision because professionally delivered code carrying a Claude-attribution signal could raise questions involving authorship, compliance or client policy.7

Other users worried about work they had created themselves before using Claude only for editing, translation, citation checks or review. Their concern was less about provenance existing than about what somebody else might infer from it.

That distinction carries directly into the authorship problem.

---

AI Involvement Leaves Authorship Open

A researcher can formulate an argument, gather evidence and write the first draft before asking Claude to improve the English. A detector may later identify Claude participation in the final wording. That result says little about who originated the argument, how extensive the editing was or whether any rule was violated.

The inverse is equally weak. Absence of a Claude watermark cannot establish human authorship. The text may have been heavily rewritten, translated, combined with unmarked material or produced by another model.

Three boundaries deserve to remain explicit:

• Claude involvement does not prove Claude authorship.
• No Claude watermark does not prove human authorship.
• A correct provenance result can still support a bad institutional decision.

The third boundary becomes the difficult one once the detector output enters a real workflow.

---

A Narrow Signal Can Accumulate Authority Downstream

A malicious detector is unnecessary. The surrounding process can create the error by stripping away context.

A probabilistic provenance result enters an LMS, hiring system or publishing workflow. Somewhere between detection and consequence, the qualified claim can collapse into an “AI-written” label. The person affected may encounter only a rejection, a misconduct flag or an unexplained ranking penalty.

The institution usually needs a richer history: what existed before the AI interaction, which parts were changed, what the applicable policy allowed, whether substantive claims were checked and who ultimately accepted responsibility. A watermark provides one fragment of that record.

Whenever serious consequences follow, the governance system needs corroboration, meaningful human review and a realistic route to challenge the inference. None of those safeguards arrives automatically with a better detector.

---

The Provider Becomes a Certifier

Proprietary watermarking also concentrates knowledge. Anthropic controls Claude’s generation system and the private deployment details needed for authoritative detection. A third-party API can broaden access to the result without making the underlying production secret public.

That gives the provider an unusual structural role. Anthropic becomes a privileged certifier of one narrow historical fact: whether Claude probably participated in an artifact.

The problem begins when downstream institutions enlarge that certification. A technically reliable provenance result may still be poor evidence for a disciplinary, contractual or hiring decision. Questions about independent audit, threshold changes, evidence disclosure and appeal become unavoidable once provider-issued signals acquire consequences outside the provider’s own system.

---

Transparency Meets Human Interpretation

Even accurate provenance does not determine how people will interpret it.

Gallegos and colleagues studied 1,601 Americans exposed to AI-generated public-policy messages under different authorship labels. The messages moved participants’ policy attitudes, while the labeling condition produced no statistically significant differences in attitude change, perceived accuracy or intention to share.8

A different PNAS Nexus study found another failure mode: participants became less willing to believe or share headlines carrying an “AI-generated” label even when those headlines were true or human-produced. Part of the effect came from respondents assuming that “AI-generated” meant complete machine authorship with no meaningful human involvement.11

That finding sits uncomfortably close to the Claude controversy. A technically precise provenance signal can acquire a much cruder social meaning once it becomes a label.

The problem extends into politics. Goldstein and Lohn’s Brennan Center analysis credits Bobby Chesney and Danielle Citron with the liar’s dividend concept and examines how realistic synthetic media can make authentic evidence easier to dismiss.9

Transparency helps with provenance. Human interpretation remains a separate source of failure.

---

The Signal Has to Survive the Journey

Before any interpretation happens, the signal has to survive distribution.

Generated content is copied into documents, translated, uploaded, compressed, screenshotted, summarized and passed through other models. Metadata can disappear. Statistical text marks can weaken. A provenance mechanism that worked at generation time may arrive downstream with gaps.

C2PA Content Credentials attack this problem from another direction by attaching cryptographically verifiable claims, signatures and content bindings to an asset’s provenance. The specification allows manifests to reference earlier manifests as an asset changes, creating a richer history than a binary AI label can provide.10

C2PA does not turn provenance into a truth oracle. It gives later systems more evidence about the history of the artifact. Those systems still have to decide what that evidence means.

---

Provenance Is Only One Axis

Suppose Claude involvement has been established correctly. The factual claim can still be wrong. A citation can still be invented. Code can still fail its tests. A human reviewer may have performed badly, and the person deploying the output may never have had authority to act.

For compactness:

This is a taxonomy, not a quantitative model. It exists to keep several questions from quietly collapsing into one another.

Once those distinctions are taken seriously, generation becomes only the opening event in a longer record.

---

From a Mark to a Custody Record

A more mature system would preserve events around an artifact as it changes rather than forcing one detector to reconstruct the entire process from the final text.

One conceptual sequence is

$$ G0→E1→V2→A3→P4, $$

where $G0$ records generation, $E1$ a later human or machine edit, $V2$ an independent verification event, $A3$ an accountable authorization, and $P4$ publication or execution.

Real systems will contain branches, missing evidence, conflicting records and several model transformations before a human sees the final artifact. That mess is precisely what a custody system should preserve.

A useful record might show that Claude drafted a paragraph, a human rewrote most of it, another model translated the remaining text, an editor checked the sources and an organization accepted responsibility before publication. Compressing all of that into “AI-generated” destroys most of the information downstream institutions actually need.

C2PA already embodies part of this broader philosophy for digital assets. Statistical text watermarking can become another signal inside that history rather than carrying the entire burden by itself.

---

What Remains Unsettled

Several parts of the story are still moving:

• GitHub: star and fork counts are changing rapidly. The 12.6k/1.4k figures belong to the August 17, 17:34 ICT snapshot.
• Anthropic: its production detector remains private and can evolve. Attacks on public SynthID implementations are relevant without constituting demonstrated Claude bypasses.
• EU implementation: Article 50 has only just entered its application period. Enforcement practice and institutional interpretation are still immature.
• User reaction: individual cancellations are documented, while Anthropic says it sees no wider cancellation increase.

Those uncertainties should remain unresolved for now.

The harder case survives even if the engineering improves dramatically. A university can misunderstand a correct provenance result. A publisher can enforce categories that no longer resemble real writing workflows. An employer can use provenance in a ranking system without ever showing why provenance should matter to the decision.

The infrastructure is arriving before institutions have developed a stable language for the gap between model involvement and human responsibility.

A detector may be statistically right and the decision built around it still wrong.

---

References

1 Anthropic. (2026). How Claude’s text watermark works. Official Anthropic explanation describing Claude’s watermark as a version of SynthID-Text and outlining its interpretation limits.

2 Meyer, G. et al. (2026). guillaumemeyer/watermarks-remover, GitHub. Snapshot used in this article: 17 August 2026, 17:34 ICT — 12.6k stars / 1.4k forks. Counts are dynamic.

3 European Commission. (2026). Code of Practice on Transparency of AI-generated Content; Strong backing for the Code of Practice on Transparency of AI-generated Content. The Commission’s current register lists 82 Section 1 and 152 Section 2 signatories and reports about 190 organizations in total by the end of July.

4 European Union. (2024). Regulation (EU) 2024/1689 — Artificial Intelligence Act, Article 50. Official Journal of the European Union. Primary legal anchor for the transparency obligations discussed here.

5 Dathathri, S., See, A., Ghaisas, S., Huang, P.-S., McAdam, R., Welbl, J., Bachani, V., et al. (2024). Scalable watermarking for identifying large language model outputs. Nature, 634, 818–823. DOI: 10.1038/s41586-024-08025-4. Describes SynthID-Text, Tournament sampling, detection methodology, entropy-related results and the large-scale Gemini evaluation.

6 Nature Editorial. (2024). AI watermarking must be watertight to be effective. Nature, 23 October 2024. Discusses robustness and deliberate removal as practical limits for watermarking.

7 Business Insider. (2026). Claude users are canceling their subscriptions, citing Anthropic’s new AI watermark. Reports four user interviews and Anthropic’s statement that it had not observed a broader cancellation increase.

8 Gallegos, I. O., Shani, C., Shi, W., Bianchi, F., Gainsburg, I., Jurafsky, D., & Willer, R. (2026). Labeling messages as AI-generated does not reduce their persuasive effects. PNAS Nexus, 5(2), pgag008. DOI: 10.1093/pnasnexus/pgag008. The experiment reports no significant labeling-condition effects on attitude change, message-accuracy judgments or sharing intention.

9 Goldstein, J. A., & Lohn, A. (2024). Deepfakes, Elections, and Shrinking the Liar’s Dividend. Brennan Center for Justice, 23 January 2024. Credits Bobby Chesney and Danielle Citron with the liar’s-dividend concept and extends the discussion to elections and potential countermeasures.

10 Coalition for Content Provenance and Authenticity. (2026). C2PA Content Credentials Specification 2.4. Defines provenance, manifests, claims, signatures and hard/soft content bindings for cryptographically verifiable content history.

11 Altay, S., & Gilardi, F. (2024). People are skeptical of headlines labeled as AI-generated, even if true or human-made, because they assume full AI automation. PNAS Nexus, 3(10), pgae403. DOI: 10.1093/pnasnexus/pgae403. University of Zurich. Reports that labeling headlines as AI-generated lowered perceived accuracy and sharing intention regardless of whether the headline was true or false, or human- or AI-authored; the effect stems from participants assuming full AI automation with no human involvement.