Coders Say They Already Found Workarounds to Claude’s Invisible Watermarks

Comment
LoaderSave StorySave this story
Comment
LoaderSave StorySave this story

Within four hours of Anthropic confirming that Claude models would globally embed invisible, machine-readable watermarks into any AI-generated content, developer Guillaume Meyer had published his override.

His code to remove watermarks from Claude-generated text has since gone viral on GitHub, has been bookmarked more than 20,000 times on X, and has drawn more than 100 contributors, with many more incorporating the technology into their own projects. “Anthropic is embedding watermarks in its Claude texts … the issue is practically history just one day later,” wrote one AI specialist, accompanied by an image of Meyer breaking out of chains and standing on crumpled EU and Anthropic flags.

Meyer and others started investigating how watermarking works after Anthropic announced last week that Claude would adopt it in order to comply with the European Union’s AI Act.

Some are trying to evade the watermarking because they disagree with the idea that all AI-generated content should be labeled as such, Meyer told WIRED, while others, including himself, say they simply relish the technical challenge. Freelance content writers and social media creators have also contacted Meyer asking for assistance using the code, he says.

The new rules, which came in earlier this month, stipulate that model providers like Anthropic and OpenAI must label synthetic audio, image, video, or text so that this material can be detected by a machine as AI-generated—or face fines of up to 3 percent of annual turnover. While the rules say providers cannot market circumvention tools, there is no legal restriction on independent tools.

“I'm not against transparency, and I'm all for content attribution,” says Meyer. “I just think watermarking in itself is a really bad solution, because it has major drawbacks and risks.” He is concerned about the risk of false positives and that the watermarking might not distinguish between light or heavy AI use, especially since, as a native French speaker, he often uses Claude and other AI tools like Grammarly to edit his writing. Using the watermark as evidence–when even Anthropic admits it can only generate a probability that the text has been touched by Claude–could lead to employers unfairly rejecting candidates or overblown accusations of researchers using artificial intelligence just because the detector flags it, he says.

Anthropic watermarks text invisibly by leaving a pattern in Claude’s choice of words and phrases that is indiscernible to a human reader but would be detectable by a machine that knows how to look for it. Because this influences Claude’s output, some users are concerned this will degrade the quality of Claude’s responses, though Anthtropic insists this won’t be the case. The technique, called SynthID, was developed by Google, which has been using it to watermark its AI-generated content since 2023. Computer scientist Scott Aaronson proposed a similar method when working at OpenAI but says the firm never deployed it because the company was worried that watermarks would put customers off its product.

Meyer’s removal method uses a non-watermarking large language model to generate multiple rewrites, swapping in synonyms and slightly reorganizing content. Of course, this relies on using other large language models which do not insert watermarks—possibly not a safe bet since 190 organizations—providers OpenAI, Microsoft, and Meta among them—have signed the EU’s transparency code of practice. It remains to be seen how many of these laboratories are going to implement their watermarks, which must be included in all new models released from August and must be integrated into existing models by December.

While there’s no certainty this tool works until Anthropic releases the software it uses to detect a watermark, understanding the basic SynthID-text approach underpinning Claude’s watermarking makes them fairly sure the method works, says Wayne Pan, chief technology and cofounder at Silicon Valley–based sovereign AI startup Haimaker. He incorporated Meyer’s open-source tool into his platform because he similarly disliked the idea of Claude watermarking content even when it’s only been lightly edited and disagreed with the watermark being invisible to the user.

Other coders have developed their own removal tools: Software engineer Erik Hughes took 15 minutes to knock up a tool with Claude that removes invisible and look-alike characters, reorders sentences within paragraphs, and swaps several words for synonyms. Leon Chlon, a Visiting Fellow at the University of Oxford, says the watermarks can be removed by condensing Claude’s response, translating it into a dialect like Arabic, which has very different semantics compared to English, and then translating it back. Anthropic itself acknowledged that heavily edited, paraphrased, or translated content might not carry a watermark.

In a statement to WIRED, a spokesperson for Anthropic said: "We're adding marking to Claude's output to comply with the EU AI Act, and other labs are taking similar steps. It’s hard to identify AI-generated text, and this gives people better tools for identification. Text from supported Claude models, including output from Claude Code, will carry an invisible watermark, and it doesn't change the meaning, quality, or readability of Claude's responses. We also plan to ship a text-detection API so users can do more of this themselves.”

Anthropic says it’s working out how to implement watermark detection for text and plans to release a tool to do so soon—at which point developers will finally be able to see whether their methods are foolproof. It’s also continuing to work on improving the watermarking system. “I think they wanted to show that they're in good faith doing it,” says Pan, “but I don't think you can ever have a watermark that will withstand everything.”