The_Build_That_Stopped_at_the_Announcement_Page

I wanted to build a proper harness: generate watermarked Claude output, run it through light editing, heavy paraphrasing, and recompile, then query Anthropic's detection API after each pass and record what survived. That's what Labs exists for - run the thing, report what actually happened, not what should happen in theory.

I got as far as Anthropic's own page for the watermark before the build stopped. On 14 August 2026 Anthropic announced that Claude's text carries a watermark and said they'd soon be offering a detection API. No endpoint. No key. No access tier. Their own page is explicit: "We're in the process of working out the details of its implementation."

There's no mock I'm willing to build against that. A harness that queries a fake detection endpoint and reports "survived" or "stripped" isn't measuring watermark robustness - it's measuring my own assumptions about how the real API might behave. That's not a result, it's a guess wearing a results table. The survival harness doesn't exist yet, and this isn't the article I set out to write.

What_Anthropic_Actually_Said

Worth being precise about what is and isn't confirmed. Claude's watermark isn't proprietary Anthropic invention - their announcement describes it as "a version of the SynthID-Text approach published by Google DeepMind" - the method Google published in Nature in 2024 for identifying AI-generated text through statistically biased token selection during generation. Anthropic adapted a published, peer-reviewed technique rather than building something opaque. That matters for reasoning about how the watermark might hold up under transformation, since SynthID-Text's behaviour under paraphrasing has already been studied independently.

Anthropic has announced the watermark exists and that a detection API is coming. They have not announced when, to whom, or under what terms. "Soon" and "working out the details" are not a shipping date. Any framing of watermark detection as live, tested, or generally available is wrong as of 24 August 2026.

Broken_Before_It_Shipped

I didn't run this study myself, so I want to be precise about what it says. "AI Watermark Evidence Fails Forensic Readiness," submitted to arXiv on 17 July 2026 by Saifur Rahman Tamim and Amir Labib Khan, evaluates three watermarking methods against meaning-preserving paraphrase attacks: KGW, Unigram, and MarkLLM's open-source reimplementation of Google's SynthID-Text, the exact family Anthropic's watermark belongs to. Their result for SynthID-Text: paraphrasing removed the mark in 98.3% of the texts where it had first been detected, across 846 valid paraphrase runs over 15 prompts. KGW and Unigram fared worse - every single initially-detected watermark in both was gone after paraphrasing.

None of that has anything to do with Anthropic's API. There was no privileged access, no early tier, no oracle. It's an academic evaluation of a published method family, run on open implementations and free-tier compute, a month before Anthropic said a word about detection. Secondary reporting alongside the study put the practical cost of running a single paraphrase pass over roughly a thousand words at about four cents at typical frontier API rates - I can't confirm that figure from the paper's own text, so I'm flagging it as reported rather than verified, but even taken loosely it says the attack is cheap, not exotic.

Provenance_Claims_Run_on_a_Timeline_Problem

This is the actual finding: a watermark's usefulness as a provenance claim doesn't just depend on whether Anthropic's specific implementation holds up. It depends on the fact that the underlying method family had a documented weakness on the record a month before Anthropic's own announcement landed. Anthropic can publish a technically sound, peer-reviewed watermarking approach and still be asking for verification confidence into a research environment that had already found the family's soft spot. "We watermark our output" and "the watermark survives normal editing" are different claims, and academic testing had already answered the second one, unfavourably, for the exact family Anthropic adopted, before the first claim shipped.

That gap matters more with a regulatory deadline next to it. The EU AI Act's Article 50 transparency obligations for machine-readable AI content marking become enforceable from 2 August 2026, with a grace period to December 2026 for systems already on market. A watermark family with a published 98.3% paraphrase-removal rate is an odd thing to point a compliance deadline at sixteen days after the removal rate was published. That's not the compliance argument itself, that's a separate piece, but the shape of the problem is the same one I hit trying to build a harness: the claim "this text is durably provenance-marked" needs to survive contact with research that already exists, not just with a demo.

What_I'll_Actually_Build

The survival harness is still the right experiment, once there's something real to query. When Anthropic's detection API has a public endpoint, I'll run Claude-generated text and code through edit, paraphrase, and recompile passes and report what actually survives, with real detection responses, not projected ones. The stop conditions I'd already written for that build still hold: if the API turns out to require access I don't have, or if results come back inconclusive across every transformation I test, I'll report that too rather than padding the sample size to manufacture a cleaner story.

For now, the honest finding is smaller than a survival-rate chart, and more useful than one would have been: the watermark family Anthropic adopted had a well-documented paraphrase weakness on the record a month before Anthropic said anything about detecting it. That's not a story about who got access first. It's a story about a gap between what got published and what got read before shipping.