The Watermark Chooses the Word

When Claude writes a sentence and reaches a point where several words would work equally well, it no longer picks freely. It picks the one that fits a pattern. Anthropic confirmed the mechanism on August 11, 2026, describing an imperceptible watermark woven into generated text at the model level, worldwide, to satisfy European transparency rules that took effect nine days earlier. Within two days an open-source project had added support for stripping it. Within a week paying customers were posting cancellation screenshots.

The technical dispute and the emotional one are usually reported separately. They are the same dispute. Both come down to what happens at the moment the model chooses a word.

How it works, in the company's own description

Anthropic published a follow-up explanation on August 14 after the first wave of criticism. The mechanism operates on what the company calls low-stakes choices, points where the model faces several equally valid options and the watermark nudges the selection toward one of them.^[1] Aggregated across a passage, those nudges form a statistical pattern a verifier with the key can read. Anthropic states the mark carries no identifying information and cannot be traced to a person, organisation or conversation.^[2]

The company's own documentation is candid about the limits. A detected mark provides a signal that content was processed by Claude, but is not fully conclusive, and heavy editing, paraphrasing, translation, short passages or format conversion can each remove it.^[3] Anthropic further notes that where Claude has only lightly edited a human's writing, most of the words are the author's and there is very little for a watermark to attach to.

One detail in that follow-up is more revealing than the rest. Anthropic said code carries less watermarking than prose because working code constrains the model, leaving fewer equally valid options to choose between.^[1] That is a direct statement of the tradeoff. The strength of the mark is a function of how much freedom the model has to pick something other than its first choice. Where there is no freedom, there is no mark.

Which raises the question the critics went straight to. In prose, where the freedom exists, what is being given up when the model uses it?

The quality objection, which is not speculative

The intuitive version of the complaint is that a watermarked model no longer selects the best word, it selects a word that fits its signature. Proponents answer that the choices being altered are arbitrary by construction, so nothing of value is lost. The research literature does not support that answer as cleanly as the framing suggests.

Watermarking schemes divide into two families. Distortionary methods, including the original green-list approach from Kirchenbauer and colleagues, apply a bias to the model's output and shift the distribution. Distortion-free methods, including SynthID-Text and the Gumbel approach from Aaronson's OpenAI work, preserve the original probability of each token in expectation over the key.^[4] The distinction matters, and it is frequently collapsed in coverage. Preserved in expectation is not the same as preserved in the sentence in front of you. Averaged across many possible keys, nothing shifts. In any single generation, the selection still moved.

What that costs has now been measured. A 2025 study evaluating watermarking against the TruthfulQA benchmark across four alignment-tuned models found that unwatermarked outputs consistently scored higher on truthfulness than watermarked ones, with degradation more pronounced under the green-list method than under Gumbel.^[5] The authors are explicit that the effect is not confined to the low-entropy cases everyone anticipated. Questions permitting substantial linguistic flexibility still produced lower truthfulness scores when watermarked, which the paper reads as evidence that the impact goes beyond answer formatting.^[5]

A separate 2025 evaluation focused on medical text found watermarking introduced meaningful factuality degradation, with the worst-performing method dropping by as much as 37%, and traced part of the effect to shifts in the entropy distribution around specialised terminology.^[6] The general finding across this literature is consistent: applying a mark at points where the model is confident produces unnatural word choices, which is why a wave of newer schemes exists specifically to detect and skip those positions.^[7]

None of this establishes that Anthropic's implementation degrades Claude's writing. The algorithm has not been published, the deployment is days old, and the strength parameter is unknown. What it establishes is that the objection is a documented research finding rather than a user's imagination, and that a company invoking the arbitrary-choice framing is making a claim that requires evidence rather than one that is true by definition.

Google's counter-evidence is the strongest available and deserves equal billing. Its Nature paper reports a live comparison across nearly 20 million Gemini responses in which the thumbs-up rate differed by 0.01% and the thumbs-down rate by 0.02% between watermarked and unwatermarked models.^[8] That is a real result at enormous scale. It is also a measure of user satisfaction with chat responses, which is not the same instrument as a truthfulness benchmark, and the two findings can both be correct.

What users actually said

The reaction was not a murmur. Business Insider reported that dozens of users posted on X that they had cancelled Claude subscriptions over the change, including a freelance developer in the Czech Republic who cancelled a Max subscription and cited concerns about an AI label attached to code review and translation work.^[9] Forbes described users objecting to AI use becoming detectable in their work and characterised the response as a firestorm.^[10]

The recurring metaphor was permanence. Users described the mark as a scarlet letter and as a digital tattoo, with one widely quoted post arguing the people who get caught will be the student who asked for a paragraph to be reorganised, the journalist who summarised a transcript, and the writer who asked for synonyms.^[11] Another framed it as policing that arrests the user and leaves the dealer alone.^[11] On r/ClaudeAI, one commenter predicted the mark would make written work unsellable.^[11]

The community was not unanimous, and the counter-arguments were sharp. Replies to the most-quoted complaint pointed out that objecting to a provenance signal implies wanting to deceive someone, and the post itself was heavily downvoted.^[12] On Hacker News, commenters welcomed a detectable signal for identifying generated text sent to them by others.^[13] TechCrunch noted that some critics were making the more measured argument rather than the victimhood one.^[12]

Two objections in the discussion are more substantial than the outrage and got less attention. The first is that verification requires sending text to a provider's detection service, which means universities, editors and lawyers checking documents would be transmitting unpublished research, manuscripts and internal material to AI companies.^[13] The second, raised in analysis of the rollout, is that Anthropic documented the probabilistic nature of the signal clearly, and almost nobody downstream at a school, an employer or a platform will read that documentation before treating a detection as proof.^[14]

There is also the attribution complaint, which cuts differently for developers than for writers. A poster who had supplied the instructions, context and repeated refinements asked what the tool was claiming credit for.^[12] Anthropic's position is that the mark indicates Claude processed the text, not that Claude authored it, a distinction the company states plainly and one that a downstream detector cannot express.^[9]

The removal tools already exist

Treating removal as a hypothetical future problem misreads where things stand. An open-source project supporting removal of Claude, OpenAI and Gemini provenance marks added that support on August 13, two days after the announcement.^[14] Decrypt reported the emergence of bypass projects in the same week.^[15]

The image side of this ecosystem is considerably more developed. The most prominent removal library on GitHub carries over 4,500 stars under a permissive licence, and a separate project bypassing image watermarks passed 1,600 stars earlier in 2026 after publishing its methodology and dataset in full.^[16][17] Academic work is arriving at the same target from the other direction: a 2026 theoretical analysis of SynthID-Text proves a vulnerability in one of its detection scores and constructs an attack against it.^[18]

What the honest projects say about themselves is more useful than the marketing. The leading image library documents that it does not decode and erase a payload, it regenerates the file with a diffusion model, and that faces, text, colours and detail can change in the process.^[16] It also notes it cannot verify its own success, because no public detector exists.

For text the constraint is sharper still. A tool that strips invisible Unicode characters does not touch a statistical watermark at all, because that mark lives in word choice; without a rewrite stage such a tool is solving a different problem.^[19] And a rewrite stage is a paraphraser, which returns to the finding that paraphrasing already defeats these systems. The DIPPER model reduced one detector's accuracy from 70.3% to 4.6% at a fixed 1% false positive rate without meaningfully altering meaning.^[20]

Which produces the shape critics point at. The mark is defeated by anyone willing to run the text through a second model, and survives for everyone who is not. Anthropic's documentation concedes the first half of that directly.

The case for doing it anyway

The strongest arguments in favour do not depend on catching anyone, which is why they survive most of the criticism above.

The first is that provenance is infrastructure rather than enforcement. The European Commission's framing treats machine-readable marking the way food labelling is treated, on the reasoning that a market where nothing can be traced is worse for its honest participants than for its dishonest ones. Success under this view is measured by whether a default trail exists, not by conviction rates.

The second is the corpus argument. Detection strength grows with passage length, and individually weak signals become actionable when aggregated across millions of documents. A platform assessing a distribution is doing something different from a teacher assessing an essay, and most public criticism attacks the second case while the technology is pointed at the first.

The third rarely gets said out loud by the labs but runs through the literature. Training models on the previous generation's output degrades them, a failure documented in Nature and generally called model collapse.^[21] Identifying synthetic text well enough to keep it out of training data is a problem every lab has regardless of policy, and a watermark solves it whether or not it ever catches a single spammer.

The fourth is simply that the alternative on offer was worse. The previous generation of detection tools were statistical classifiers with documented false-positive problems, including repeated findings of bias against non-native English speakers. A keyed signal with a controllable false-positive rate is a better instrument than a guess about writing style, whatever else is true about it.

Where this leaves Google, and publishers

Among people who publish for a living the durable worry is not Anthropic. It is that a reliable AI flag eventually gives Google a lever for demoting AI-assisted content wholesale.

The case that this happens rests on trajectory. Google has fought mass-produced content for three years, introduced a scaled content abuse policy in March 2024 aimed at pages produced in volume with little added value, and reportedly hit that category hard in the March 2026 core update.^[22] A company already committed to the fight, with the detection technology in house, is not obviously going to leave it unused.

The case against is mechanical. The signal is absent exactly where enforcement would matter most, since volume operations run open-weight models or paraphrase pipelines. Forgery research means it can potentially be planted on a third party's pages, which makes it an attack vector rather than a ranking input. And Google's published guidance since February 2023 has held that the relevant question is content quality rather than production method, with spam policies written to be method-agnostic.^[23]

No search engine or answer engine has stated that it uses watermark or provenance detection as a ranking, indexing or citation signal. Absent that, the middle reading, in which the mark becomes one weak input among many at domain level, remains speculation with no source behind it.

The regulatory position for publishers is clearer than the search position. Marking obligations fall on model providers and very large platforms. California's statute defines covered providers as systems with over a million monthly users, and its latent watermark requirement does not extend to text-only output.^[24] Canada has no AI statute following the January 2025 prorogation, so a Canadian company's exposure comes from serving European, Californian or Chinese users.^[25] The European provision reaching publishers covers text published to inform the public on matters of public interest and exempts content a human reviewed and took editorial responsibility for.^[26] Analysis of the Code also notes that free-form text under 200 tokens is not required to be watermarked at all.^[27]

On the question of editing your own drafts, the rules addressing removal are written against tools built to strip provenance and against platforms that knowingly remove it from hosted content. Revising your own work is neither, and Anthropic's own documentation treats editing as something that naturally weakens the mark rather than as evasion. Exposure arises from asserting human authorship to a party that required disclosure, which is a problem of the claim rather than the missing signal.

What is not settled

The positions are less incompatible than the argument suggests. Watermarking can be simultaneously useful as training-data hygiene, workable at corpus scale, trivially defeated by anyone who cares to, unevenly borne by people using the tools as intended, and a measurable cost to output quality under some configurations. The evidence supports all five. Most of the public debate treats them as competing claims because each side has picked the two that suit it.

The numbers