Anthropic adds AI watermarking to comply with EU AI Act

Full analysis

Anthropic is now embedding hidden signals into Claude's text output to satisfy the EU AI Act's rule that machine-generated content be identifiable. Ben Thompson of Stratechery calls it a terrible idea, starting with philosophy. The more practical question for anyone building on Claude: does this actually do anything, and what does it cost you?

This is a Type 2 decision for most builders. Watermarking arrives whether you like it or not, but your response, logging, kill-switches, parser hardening, is cheap to change. The forcing function is real: the EU AI Act's transparency provisions, and a live user backlash already showing up in TechCrunch's reporting about people getting caught using Claude at work and in class.

The Skeptic. Text watermarks die in one API call. Ask a second model to paraphrase and the hidden signal is gone. So the people who most want to hide, cheaters, bad actors, anyone with a motive, walk right past it. The people who eat the overhead are the honest ones who never thought to strip it. The EU ticks a compliance box, Anthropic gets a goodwill press cycle, and the stated goal, knowing what's AI, moves approximately zero. Thompson's philosophical objection is the polite version. The blunt version: regulators mandated a solution that doesn't exist yet, and calling the checkbox "done" is the whole scam. For a PM: it's a lock that only stops people who weren't going to break in.

The Safety Lens. Provenance and safety are different things, and mashing them together is where this gets dangerous. If regulators or users start reading "watermarked" as "trustworthy," you've corrupted the signal. Worse is the false-negative trap. A robust watermark means anything unwatermarked, jailbroken output, a fine-tuned derivative, text run through a paraphraser, reads as clean human writing. You've handed a spotless record to exactly the content you most wanted flagged. The EU's intent is legitimate. This path can actively degrade the epistemic infrastructure it was meant to build. For a PM: it's like a fraud filter that stamps "verified" on every transaction it fails to catch.

The Researcher. Text watermarking for language models is an unsolved problem, and the literature is not shy about it. The token-bias schemes people cite, Kirchenbauer and the Maryland group, degrade under paraphrase, translation, or light editing. Robustness and imperceptibility pull against each other: make it survive an edit and it starts distorting the text; make it invisible and it washes out. Anthropic hasn't published its scheme, so we can't tell if this is something new or a known-fragile method wrapped in compliance language. Betting the "identifiable AI content" mandate on a method no one has shown survives a determined adversary is the cart pulling the horse. For a PM: the science that would make this work hasn't been settled, but the law assumed it had.

The Compute Pragmatist. Embedding the watermark is nearly free. Perturbing the token probabilities adds microseconds per token, invisible at Claude's scale. That's not the cost. The cost is detection. Running a watermark detector across billions of web pages, user uploads, and moderation queues needs a whole parallel inference pipeline, and nobody is pricing that into this announcement. If the EU later mandates detection and not just embedding, that bill lands on platforms, publishers, and CDNs, not on Anthropic. Anthropic banks the compliance credit; someone else runs the expensive half. That asymmetry, cheap to stamp, expensive to read, is where the 2026 policy fight will actually happen.

The Builder. On Tuesday morning this is a new hidden layer in your output path, and hidden layers break things quietly. Token-bias watermarking nudges which tokens come out, and that's fine for prose. It's not fine for code, JSON, or anything a downstream parser reads strictly. Expect subtle formatting regressions that show up weeks later and don't trace back to the watermark without deep logging, because who's looking there. What Anthropic's SDK team owes enterprise customers is a documented kill-switch for contexts where the watermark corrupts the payload. Without it, contract conversations get ugly the first time a structured-output pipeline throws intermittent errors nobody can reproduce.

Where they split. Two real disagreements. The Compute Pragmatist sees embedding as trivially cheap and shrugs; the Builder sees that same cheap perturbation quietly corrupting structured output and wants a kill-switch yesterday. Same mechanism, opposite verdicts, because they're measuring different failures. Cost versus correctness.

The bigger fault line is the Skeptic against the Safety Lens. The Skeptic says the watermark does nothing, so who cares. The Safety Lens says a watermark that does nothing but is believed to do something is worse than no watermark at all, because it manufactures false confidence. That gap, harmless-and-useless versus useless-and-dangerous, is the actual decision hiding under the compliance headline.

What it hinges on. One fact settles most of this: does Anthropic's scheme survive a paraphrase pass? If a second model rewriting the text strips the signal, and every published method to date says it does, then this is a compliance gesture with no adversarial teeth. Everything downstream, the safety false-negatives, the detection-cost fight, the enterprise parser risk, flows from that. The council leans hard skeptical on the capability and hard cautious on the second-order effects. Before you build anything around watermark presence or absence meaning anything, run the test yourself: take Claude output, run it through a cheap paraphraser, and see if a detector still fires. Log for watermark-induced formatting drift in your structured outputs now, not after the first incident.

Prediction: By the time the EU AI Act's transparency provisions reach their next enforcement or guidance milestone in H1 2027, an independent researcher will publicly demonstrate that Anthropic's text watermark can be stripped with a single paraphrase pass, and Anthropic will not have shipped a scheme that survives it.

Confidence: High. Every published text-watermark method fails under paraphrase, and no counterexample exists.

Why: The academic record on LLM text watermarking is consistent: statistical token-bias schemes degrade under paraphrase, translation, and light editing, and robustness trades directly against imperceptibility, so you can't have both. Anthropic hasn't published a method that breaks this pattern, which is itself a tell, if they had a paraphrase-robust scheme, that would be the headline. The mechanism that defeats the watermark is available to anyone: one cheap API call to a second model. The opposite outcome, a watermark that survives determined adversarial rewriting, would be a genuine research breakthrough that no lab has demonstrated, so betting on it appearing quietly inside a compliance rollout is the far less likely call.

Revisit by 2027-06-30: We're right if a credible third party shows a one-step paraphrase defeats the watermark and Anthropic hasn't published a robust replacement. We're wrong if Anthropic ships (or independent testing confirms) a scheme that survives paraphrase and translation attacks.

The tell here is the silence on method. A lab that had cracked paraphrase-robust watermarking would be publishing the paper, not burying it in an EU compliance note.