Developers Claim They've Already Found Ways Around Claude's Hidden Watermarks

Just hours after Anthropic confirmed that Claude models would embed invisible, machine-readable watermarks in all AI-generated content, developer Guillaume Meyer published a tool to strip them. His code has since gone viral on GitHub, been bookmarked over 20,000 times on X, and attracted more than 100 contributors. One AI specialist wrote that the issue was "practically history just one day later," sharing an image of Meyer breaking free from chains atop crumpled EU and Anthropic flags.

Meyer and others began investigating the watermarking after Anthropic announced it would adopt the feature to comply with the European Union's AI Act. Some developers oppose labeling all AI content, while Meyer says he simply enjoys the technical challenge. Freelance writers and social media creators have also reached out for help using the code.

The EU rules, effective this month, require providers like Anthropic and OpenAI to label synthetic text, audio, image, or video so machines can detect AI generation, with fines up to 3 percent of annual turnover. While providers cannot market circumvention tools, independent tools face no legal restriction. Meyer says he supports transparency and content attribution but believes watermarking is "a really bad solution" due to risks like false positives and failing to distinguish between light and heavy AI use. He worries employers might unfairly reject candidates or accuse researchers of misconduct based on probability-based detection.

Anthropic embeds watermarks by leaving a pattern in Claude's word choices, invisible to humans but detectable by machines. Some users fear this will degrade response quality, though Anthropic insists it won't. The technique, called SynthID, was developed by Google and used since 2023. Computer scientist Scott Aaronson proposed a similar method at OpenAI, but the firm never deployed it, fearing it would deter customers.

Meyer's removal method uses a non-watermarking large language model to rewrite text, swapping synonyms and reorganizing content. This depends on other models that don't add watermarks, which may not be a safe bet since 190 organizations, including OpenAI, Microsoft, and Meta, have signed the EU's transparency code. New models must include watermarks from August, with existing models updated by December.

There's no certainty the tool works until Anthropic releases its detection software, but understanding SynthID-text makes developers fairly confident, says Wayne Pan, CTO of AI startup Haimaker. He integrated Meyer's tool into his platform, disliking invisible watermarks on lightly edited content. Other coders have also built removal tools: Erik Hughes created one in 15 minutes using Claude to strip invisible characters and reorder sentences, while Oxford Visiting Fellow Leon Chlon suggests translating text into a dialect like Arabic and back to break the watermark. Anthropic itself admitted that heavily edited, paraphrased, or translated content might not retain the mark.

Anthropic told WIRED that marking Claude's output complies with the EU AI Act and helps with identification, adding that the watermark doesn't change meaning, quality, or readability. The company plans to ship a text-detection API and is working on improving the system. Pan noted, "I think they wanted to show that they're in good faith doing it, but I don't think you can ever have a watermark that will withstand everything."

Source: Wired