Join my next live AI workshop
I’ll show you how I turn fast-moving AI news (ahem chaos!) into workshops businesses actually pay for.
People REALLY care about this whole Claude watermarking issue eh?
My first Claude watermark video hit 43,000 views and 932 comments. Big for my relatively small Youtube channel!
Almost 1000 comments. Asking a LOT of questions. Some smart. Some…not so much…
Apparently Anthropic now owns your code. The EU controls America. And the entire system can be beaten with Notepad, a printer or a quick trip through Kimi.
Nonsense. Like, a lot of nonsense. Sorry!
But buried in those ~1000 comments were a few fair concerns!
So...round two!
No, Anthropic does not own your work
This was one of the most popular claims. If Claude touches your code, Anthropic can claim co-ownership and get ready to pay.
No.
The watermark is a provenance signal. It can show that supported output was processed by Claude. Nothing in that mechanism transfers copyright or gives Anthropic a slice of your business.
One commenter had the best analogy: a hammer does not own the house it helped build. Or think about Photoshop. Photoshop can leave metadata without Adobe owning your photo. A mark can record which tool touched a file without handing the tool ownership of the result.
Now there is a completely fair fight about AI companies training on copyrighted work. 100% that’s an issue. BUT that is a separate copyright fight. It’s not related. Model training, ownership and output provenance are three different things. Mixing them together just makes an already messy subject worse.
Notepad does nothing
The most common removal advice assumes Anthropic is hiding special characters, odd spaces or invisible formatting inside the document.
Give the engineers a little more credit than that please! There are some fairly smart people working on this. It’s not 1997.
Anthropic describes two systems. Supported image files can carry C2PA provenance metadata. That metadata can disappear when you screenshot, convert or export the file through an unsupported route.
Text is different. Anthropic says the mark is applied at model level, survives copy and paste and may survive some editing.
Anthropic has not disclosed the exact method. BUT it’s probably like SynthID. Google's public SynthID system shows how a statistical version can work: the model slightly nudges which plausible token it chooses, then a detector looks for the pattern across enough text.
The ordinary words carry the signal. It’s not in special characters or whitespace or unicode. That’s far too crude.
So…you could ask Claude for a paragraph, carve it into a stone tablet, have a friend discover it, photograph it, OCR the photograph and manually type it back into a computer. If the words stay the same, the sequence stays the same. The watermark persists.
You have just put a bunch of random BS in the middle.
What about getting a second model to rewrite the passage. Enough paraphrasing or translation may weaken the original signal! This works. It works on SynthID if you rewrite enough. Basically the watermark signal degrades with each rewrite until the detector falls below a certain confidence level.
But it can also flatten your voice, introduce errors and absolutely murder code. So…if the plan is to garble Claude's answer with a cheaper model anyway...why not use the cheaper model in the first place? Why go through all that hassle to remove the watermark when what you end up is unusable?
The BANANA attack might actually work
One commenter asked if we could just get the model to add junk words every second word to scramble the watermark. And then simply remove the junk words to get a clean unwatermarked result.
Ie . we could place the word BANANA between every meaningful word, then remove every BANANA afterwards.
It sounds ridiculous. I initially thought “nah…there’s no way right?” Then I checked.
This resembles a real class of attack called a scrubbing attack. In a statistical watermark, each token choice depends partly on the context around it. Deliberately filling that context with predictable nonsense could change the pattern. Strip the filler afterwards and the detector may have less of the expected signal left.
It could work! Maybe. Remember we still do not have Claude's detector or technical specification, so nobody can test the actual threshold yet.
A detector cannot prove who wrote it
You can write an entire document yourself, ask Claude to fix the punctuation and receive a marked version back. The same can happen with translation, restructuring or rewriting in your own voice.
Anthropic's phrase is processed by Claude. That covers far more than authorship.
A positive result cannot recover who had the idea, who wrote the first draft, whether the claims are true or whether somebody broke a workplace or university policy. The work just says “yup AI was used here”. It’s a broad blanket yay/nay.
That’s a huge problem and is going to ruin lives.
Equally a negative result proves very little! When a negative result is returned this does NOT mean AI has not been used. We can get false negatives. The passage could be too short to watermark, heavily edited, translated, generated by an unsupported older model or made with another AI entirely. Just because it flags with the Claude detector doesn’t mean it wasn’t generated or processed with AI.
These false positives AND false negatives will do a lot of damage over the next couple of years because an awful lot of people don’t understand the technology.
Yes, the EU can change your Claude
Lots of people telling me in comments that THEY aren’t affected because they aren’t in the EU.
Sorry…you are. Whether you like it or not and regardless of your opinions of the EU.
I covered the four actual Article 50 rules in full earlier this week, so I will not make you read the whole thing again.
Short version: Anthropic sells into EU countries, the EU rules can apply to providers outside Europe if they sell to EU citizens.
Anthropic (and the other AI companies) therefore have a choice.
i) lost access to EU markets and/or get sued for 3% of your global turnover
ii) play ball and get access to the market but make some concessions.
Anthropic (and indeed every western lab except xAI) are playing ball.
And the simplest way to do so is one worldwide rollout rather than maintaining separate EU and non-EU models. That’s too onerous and (more importantly) expensive to Anthropic.
And remember that US companies have already paid billions in GDPR fines - about €5bn since 2019. The EU can 1000% fine outside of its “jurisdiction” and it has successfully done so. Being based in California does not make the European market or its regulators disappear.
You do not have to like it. Anthropic still has very expensive reasons to play ball.
The fair concerns are still unanswered
Watermarking needs some freedom to choose between plausible tokens. What happens when there is very little freedom?
Poetry, acrostics, technical standards and code can be highly constrained. A tiny change can break the output. Google reports no detectable quality loss for SynthID. Useful evidence for SynthID. If we believe it. But I find that hard to accept especially with code which requires precision.
We still have no public test for Claude's system. It could absolutely be mangling code for all we know. Once we have the technical spec and the detector we’ll know more.
Right now we don’t know that much. We know there’s a model level text mark, being rolled out worldwide on all new models since August 2nd and older models working backwards. We are now awaiting the technical specs and the detector so we can know what technology Anthropic are using.
But there’s also a lot we don’t know. Lots of missing information.
We also need model-by-model coverage, minimum reliable passage length, false-positive and false-negative rates, and proper testing against paraphrasing, translation and attacks like BANANA.
SO: remember.
Until Anthropic release more details, anybody selling a guaranteed removal trick is guessing. Or lying.
Quick aside: if you want to learn how I turn fast-moving AI news (chaos!) like this into workshops businesses actually pay for, join my next live AI workshop.
To the Task,
Kyle