--- title: Anthropic’s watermark survives copy-paste, but not the... description: Anthropic is embedding invisible watermarks into text generated by Claude models, starting with EU deployments following the EU AI Act's Article 50... canonical: https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic’s watermark survives copy-paste, but not the real dev workflow | daily.dev og:description: Anthropic is embedding invisible watermarks into text generated by Claude models, starting with EU deployments following the EU AI Act's Article 50... og:url: https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e og:image: https://api.daily.dev/og/posts/moUOd5r8E.png og:image:alt: Anthropic’s watermark survives copy-paste, but not the real dev workflow og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic’s watermark survives copy-paste, but not the real dev workflow **[The New Stack](https://daily.dev/sources/newstack)** · 8 min read · 0 upvotes · 0 comments ## Summary Anthropic is embedding invisible watermarks into text generated by Claude models, starting with EU deployments following the EU AI Act's Article 50 transparency requirements. The watermark travels with copy-pasted text but has significant limitations: it doesn't survive intense paraphrasing, code formatting changes, or common application pipeline transformations like summarization, translation, or splitting. Experts explain that streaming constraints limit which watermarking techniques are viable, and code is especially hard to watermark without breaking functionality. A public detector would let bad actors iteratively strip the mark, while leaked secret keys could enable forgery. Anthropic recommends developers treat the watermark as one clue among many, supplementing it with audit logs, model IDs, and output hashes for real provenance tracking. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Anthropic's Claude text watermark work technically? Claude's text watermark likely uses a token-level approach such as the KGW method, where a secret key and preceding tokens generate a hash that splits candidate tokens into 'green' and 'red' groups, slightly biasing selection toward green tokens. A detector with the same key can reconstruct which tokens were favored and flag passages with an unusually high proportion of those choices. Streaming constraints mean the signal must be embedded during generation, not after. _Developers integrating Claude into pipelines track provenance details like this on daily.dev._ ### Does Claude's watermark survive paraphrasing or code reformatting? No, Claude's watermark does not reliably survive intense paraphrasing or code reformatting. Combining word-choice and syntax attacks can remove it, and free paraphrasing tools have bypassed similar watermarks like Google DeepMind's SynthID. For code specifically, watermarking is harder because arbitrary token changes can break functionality, limiting the signal to variable names and other synonym-tolerant parts. Application pipelines that summarize, translate, or split output also silently erase the mark. _Teams shipping AI-assisted code need to track what watermarking can and can't prove — daily.dev covers the evolving landscape._ ### What are the risks of making an AI watermark detector public? A public watermark detector lets anyone iteratively edit text and check whether the mark is still present, enabling reliable removal strategies. Additionally, if the secret keys behind the watermark are leaked, attackers could remove marks or forge them on content Claude never produced. Key rotation mitigates key-leak blast radius but requires detectors to recognize marks from both current and retired keys, including content generated months or years earlier. _Keeping up with AI provenance and security trade-offs matters for any team building on LLM APIs — daily.dev surfaces those discussions._ ## Similar posts on daily.dev - [Text AI watermarks will always be trivial to remove](https://daily.dev/posts/text-ai-watermarks-will-always-be-trivial-to-remove-borbz7x9u) · sean goedecke · 6 upvotes · 4 comments --- Tags: [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic’s watermark survives copy-paste, but not the real dev workflow","url":"https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e"},"datePublished":"2026-08-11T19:34:21.152Z","dateModified":"2026-08-13T14:47:40.623Z","description":"Anthropic is embedding invisible watermarks into text generated by Claude models, starting with EU deployments following the EU AI Act's Article 50...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1dd4218b80bbb089aac009bf5ec56c87?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1dd4218b80bbb089aac009bf5ec56c87?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"claude,anthropic,ai-governance","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Anthropic’s watermark survives copy-paste, but not the real dev workflow"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-s-watermark-survives-copy-paste-but-not-the-real-dev-workflow-mouod5r8e#faq","mainEntity":[{"@type":"Question","name":"How does Anthropic's Claude text watermark work technically?","acceptedAnswer":{"@type":"Answer","text":"Claude's text watermark likely uses a token-level approach such as the KGW method, where a secret key and preceding tokens generate a hash that splits candidate tokens into 'green' and 'red' groups, slightly biasing selection toward green tokens. A detector with the same key can reconstruct which tokens were favored and flag passages with an unusually high proportion of those choices. Streaming constraints mean the signal must be embedded during generation, not after. Developers integrating Claude into pipelines track provenance details like this on daily.dev."}},{"@type":"Question","name":"Does Claude's watermark survive paraphrasing or code reformatting?","acceptedAnswer":{"@type":"Answer","text":"No, Claude's watermark does not reliably survive intense paraphrasing or code reformatting. Combining word-choice and syntax attacks can remove it, and free paraphrasing tools have bypassed similar watermarks like Google DeepMind's SynthID. For code specifically, watermarking is harder because arbitrary token changes can break functionality, limiting the signal to variable names and other synonym-tolerant parts. Application pipelines that summarize, translate, or split output also silently erase the mark. Teams shipping AI-assisted code need to track what watermarking can and can't prove — daily.dev covers the evolving landscape."}},{"@type":"Question","name":"What are the risks of making an AI watermark detector public?","acceptedAnswer":{"@type":"Answer","text":"A public watermark detector lets anyone iteratively edit text and check whether the mark is still present, enabling reliable removal strategies. Additionally, if the secret keys behind the watermark are leaked, attackers could remove marks or forge them on content Claude never produced. Key rotation mitigates key-leak blast radius but requires detectors to recognize marks from both current and retired keys, including content generated months or years earlier. Keeping up with AI provenance and security trade-offs matters for any team building on LLM APIs — daily.dev surfaces those discussions."}}]} ```