Coders Say They Already Found Workarounds to Claude’s Invisible Watermarks

A developer has already released an open-source tool designed to strip the invisible watermarks that Anthropic now embeds in text generated by its Claude models. The tool, published by developer Guillaume Meyer within four hours of the company’s global rollout of the system, has drawn more than 100 contributors and has been bookmarked over 20,000 times on social media. Meyer told WIRED that some freelancers and social media creators have contacted him for help using the code, which has also been folded into other projects. The move comes as Anthropic says it is watermarking Claude output to comply with the European Union’s AI Act, a regulation that took effect this month and applies to model providers like Anthropic and OpenAI.

The EU rules require providers to label synthetic audio, image, video, or text so machines can detect AI-generated material, with fines of up to 3 percent of annual turnover for noncompliance. While the regulation bars providers from marketing circumvention tools, it places no legal restriction on independent developers building them. Meyer said he is not against transparency or content attribution, but he argued that watermarking is a flawed solution because of risks such as false positives. He noted that, as a native French speaker, he uses Claude and tools like Grammarly to edit his writing, and he fears the watermark could lead employers to wrongly reject candidates or accuse researchers of overusing AI, especially since Anthropic itself only offers a probability that text was touched by Claude.

Anthropic’s watermark works by leaving a pattern in Claude’s word choices that is invisible to humans but detectable by a machine, a technique called SynthID that was developed by Google and has been in use there since 2023. Some users worry the process could degrade response quality, though Anthropic insists it will not change meaning, quality, or readability. Computer scientist Scott Aaronson proposed a similar method while at OpenAI, but the company never deployed it over concerns it would drive customers away, the source article said.

Meyer’s removal method uses a different, non-watermarking large language model to rewrite the text multiple times, swapping synonyms and slightly reorganizing content. That reliance could be risky, since 190 organizations, including OpenAI, Microsoft, and Meta, have signed the EU’s transparency code of practice, though it is unclear how many will actually implement watermarks. Other developers have offered their own approaches: software engineer Erik Hughes built a tool with Claude that removes invisible characters and reorders sentences, while Oxford visiting fellow Leon Chlon said watermarks can be removed by condensing a response and translating it through a dialect with very different semantics, like Arabic. Anthropic has acknowledged that heavily edited, paraphrased, or translated content may not carry a watermark.

Wayne Pan, chief technology officer and cofounder of the Silicon Valley AI startup Haimaker, incorporated Meyer’s tool into his platform. He said he disliked the idea of Claude watermarking lightly edited content and opposed the watermark being invisible to the user. Anthropic told WIRED that it is adding the marking to comply with the EU act and plans to release a text-detection API so users can do the identification themselves. The company also says it continues to improve the system, but Pan noted that no watermark will ever withstand every method of removal.