Anthropic's text watermark is easy to bypass on several older Claude models
decoder ·
Anthropic is expanding its text watermarking system to several older Claude models, including Opus 4.6 and Sonnet 4.6, in compliance with the EU AI Act deadline. The company has announced a second wave of retrofits starting November 16, 2026, for these specific versions alongside Haiku 4.5 and Opus 4.5. However, researchers have identified that the watermark on Opus 4.6 and Sonnet 4.6 can be easily bypassed by altering standard sampling parameters such as temperature, top_p, or top_k. This loophole exists because the watermark only activates when these settings remain at their default values, allowing users to dodge detection with minor tweaks. While newer models like Claude Mythos 5 and Opus 4.7 appear to have the watermark applied regardless of sampling settings, the vulnerability in popular older models remains a significant concern. Anthropic utilizes a variant of Google DeepMind's SynthID method to embed imperceptible patterns in word choice without affecting output speed or pricing. Despite claims that the watermark does not degrade text quality, critics argue that forced synonym selection may reduce precision, and legal experts worry about implications for confidentiality. The rollout affects all platforms hosting these models, including Amazon Bedrock, though customers cannot disable the feature.
decoder