Claude Rolls Out Watermarking Across the Board: Paid Users Can't Opt Out, But Only a Select Few Can Detect It

Anthropic's text watermarking strategy has taken another step forward. According to a summary circulating in the Reddit community, starting November 3, Claude's invisible text watermark will cover Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 — and all models released since August already have this mechanism built in. Two points matter most: it applies globally (not just in the EU), and paid users cannot opt out.

What makes this controversial isn't the watermark itself, but the power asymmetry behind it — the marking is applied quietly, while the ability to verify it is locked away with a select few organizations.

What the Watermark Actually Marks: From "Generation" to "Touch"

According to the post, the watermark is embedded in the text's word choices as a statistical, invisible marker that can't be seen by human readers. This differs from the common approach of "AI detectors": the latter are guesses based on text features, whereas the official watermark is theoretically verifiable.

Proofreading and Translation Also Count as Marked

The tricky part is the trigger condition. Anthropic's own help page admits that detecting a mark doesn't mean the content was written by Claude — only that Claude processed it. This means that if you merely use Claude to polish a resume, proofread grammar, or translate a passage, the original content gets watermarked too.

The post specifically notes that non-native English speakers and people with dyslexia bear a disproportionate burden — they're the most frequent users of AI-assisted polishing, yet they receive the same mark as someone who "had the model generate an entire paper from scratch."

The Awkwardness of Not Being Able to Check Yourself

After receiving watermarked text, ordinary users have no means to confirm whether it carries a mark. Detection capability is currently in private preview, available only to regulators, media, researchers, educational institutions, and "enterprises with compliance obligations."

In the original author's words: the people being judged are precisely the only ones without access.

Text watermarking is a form of statistical watermarking: when generating each token, the model uses a key known only to the vendor to make a pseudo-random partition of the candidate vocabulary and slightly boosts the sampling probability of one subset (often called the "green list"). A single sentence is nearly impossible to detect, but in a sufficiently long text, the proportion of green-list words will consistently exceed the random baseline, and the detector can calculate statistical significance to determine the presence of a watermark. This is fundamentally different from "AI detectors" that rely on heuristic signals like perplexity and sentence structure — the latter are probabilistic guesses, while the former can provide statistical confidence as long as the key remains secret. This is also why watermark robustness and detectability are always in tension: the larger the perturbation, the easier it is to detect, but the weaker its resistance to rewriting, translation, and synonym substitution.

"Private preview" is a restricted release mechanism commonly used by AI vendors: the feature is functional but only opens interfaces or whitelists to a few partners, allowing them to collect feedback in real-world scenarios, control abuse risk, and retain the flexibility to adjust policy at any time. In the context of watermark detection, this arrangement means detection authority becomes a kind of access qualification — who can verify, and how verification results are trusted, depends on partnerships between vendors and institutions rather than publicly reviewable technical standards. This contrasts with open detection solutions promoted by academia (such as open-source watermark detection libraries), whose approach is to let anyone with the key verify, thereby avoiding "centralizing judgment power in a single entity." There is currently no indication that Anthropic will take this path.

The Watermark's Actual Protective Effect Is Questionable

If this mechanism could accurately distinguish AI-generated content, the cost might be acceptable. But community discussion points out several structural loopholes.

"Only We Have the Key" Won't Last

The post mentions that research on watermark stealing has already demonstrated that such statistical patterns can be learned from enough samples. In other words, the key's exclusivity is only a matter of time. Third-party "AI detectors" will eventually catch up — and everyone knows the reputation of such services when it comes to accuracy.

"Watermark stealing" is a category of targeted research since 2024: attackers, without access to the key, train a substitute detector by querying a watermarked model extensively, approximating the original watermark's decision boundary, thereby reproducing detection capability externally and even partially reverse-engineering the key. Such work shows that watermark security relies on the dual assumptions of "key + limited queries"; once a model is called at massive public scale, the second line of defense weakens. A more realistic concern is false positives: third-party detectors often lack vendor calibration, their false-positive rates are uncontrollable, and they are precisely the ones most likely to be procured by high-risk scenarios like recruitment systems and online education platforms.

It Only Stops the Honest

The watermark exists at the level of word choice, so feeding the text into another model and asking it to "rewrite everything" can effectively remove the mark. Malicious users will do this, and so will spammers and propaganda infiltrators.

The people who won't do this are students, job seekers, and ESL writers who don't know they need to.

This is the core grievance of the post's author: using Claude to make a resume more presentable, only to be rejected by an "AI detector," while still paying for the service — and the spammers the watermark was meant to stop slip right past it.

From an information-hiding perspective, watermark robustness depends on how much rewriting cost an attacker is willing to bear. Simple synonym substitution and sentence reordering are usually insufficient to remove statistical signals, but "having another model fully paraphrase it" constitutes a paraphrase attack, resampling nearly every token and completely invalidating the original bias. This is also a classic conclusion of watermark research: statistical watermarking for open text struggles to be simultaneously robust to benign editing and immune to malicious rewriting. What can truly raise the bar is stacking multiple signals (such as generation logs, C2PA content credentials, and other provenance metadata), but those schemes require platform-side cooperation rather than relying on the text alone.

An Industry Signal Worth Watching

Setting aside this specific policy, Anthropic's approach reflects a broader trend: content provenance is shifting from an "optional technical feature" to a "platform default," and the beneficiaries and bearers of that default are not symmetric.

For content platforms, educational institutions, and employers, watermarks provide a seemingly authoritative basis for judgment; but for individual creators and ordinary users, they add the risk of being unable to prove one's innocence — you can neither see the mark nor appeal or remove it.

The post ends with an intriguing footnote: the author claims the post itself was written by Claude Opus 5.5 and therefore carries a watermark. Whether this is a joke or a fact, it points to a paradox — when watermark coverage becomes broad enough, the mark's discriminating power declines, and eventually everyone may be "a suspect."

For users who rely on AI-assisted writing, a feasible short-term approach is: retain a manual rewriting step for important texts (resumes, application materials, formally published content) and don't let the model directly output the final version; also pay attention to whether AI involvement is explicitly prohibited in the usage scenario. As for when and in what form watermark verification will open to the public, there is currently no timetable.