Anthropic watermarks Claude for the AI Act, but one sampling parameter defeats the mark

October 31, 2026. Anthropic tells its API customers it is extending its text watermark to four models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6. December 2026. The EU AI Act deadline approaches. One detail changes everything: on two of those models, changing a single sampling parameter erases the mark.

A watermark that lives in word choice

Anthropic’s watermark does not look like an image watermark. The company describes it as an “imperceptible pattern in word choice”: the model subtly biases synonym selection according to a statistical key, adding no characters or tokens, changing no pricing or response formats, and barely slowing output.

It is a variant of Google DeepMind’s SynthID method, which tweaks the probability distribution behind generation to produce a detectable pattern. The watermark is embedded at the model level, not the interface: it works on every platform hosting these models — Amazon Web Services, Google Cloud, Microsoft Foundry — and customers cannot turn it off.

The motivation is regulatory. The EU AI Act imposes a December 2026 deadline for labeling generated content. Every model released after August 2, 2026 has shipped with the mark from day one; older models get it in stages. Newer Opus 5.5 already carries it, and the Amazon Bedrock rollout may take a few extra days.

The loophole: three knobs that cancel everything

This is where the announcement gets interesting for a compliance officer. On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark only activates when the three sampling parameters stay at their default values. These parameters — temperature, top_p and top_k — control the randomness of word selection. A minor tweak to any one of them is enough to dodge the mark.

Anthropic’s email states it plainly: “If you rely on the watermark for your own compliance, keep these settings at their defaults.” The loophole is not a hidden vulnerability: it is an accepted consequence of the design, documented by the vendor itself.

The nuance carries real weight, because Opus 4.6 remains — by several accounts — Anthropic’s best writing model, ahead of even Opus 5.5. It is exactly the model used to produce long, polished text, the kind of output where detecting generated content matters most. The email does not mention this caveat for Mythos 5 or Opus 4.7, suggesting the mark applies there regardless of sampling settings.

Why dodging via temperature is not a footnote

To grasp the stakes, look at what those three knobs do. temperature spreads or tightens the probability distribution; top_p restricts choice to tokens whose cumulative probability reaches a threshold; top_k bounds the choice to the k most likely tokens. The SynthID watermark encodes its key in the decoder’s low-level decisions. When a developer touches any of these parameters, they disturb the signal to the point of statistical invisibility.

Yet touching temperature is exactly what any developer does to get a more creative or more deterministic style. The default value is a setting, not a universal usage. A marketing-writing assistant uses a high temperature; an extraction pipeline uses a temperature near zero. In both cases the watermark vanishes — and with it the traceability guarantee the AI Act is supposed to provide.

The regulatory consequence is direct: an organization documenting compliance by invoking Anthropic’s watermark must also prove it never touched the parameters. That is a fragile burden of proof, because nothing stops an employee or a subcontractor from changing a parameter without flagging it.

Detection, the other half of the problem

A watermark is only worth what you can verify. Anthropic offers a detection API in private preview, but it is not open to everyone. OpenAI launched its own system, textGrain, in October 2026, on by default for ChatGPT and Codex in the European Union, but left off by default for API customers elsewhere, who can flip it on or off. Google DeepMind, for its part, open-sourced SynthID for text and built it into Gemini.

The emerging landscape is a multi-speed watermark: mandatory for some actors in the European Union, optional for APIs, dodged by anyone who touches the parameters. A verifier receiving an unmarked text cannot conclude whether it was written by a human, generated by an unmarked model, or generated by Claude with a changed temperature. Binary detection — “marked or not” — does not answer the question “generated or not.”

Technical critics go further. Blogger John Gruber notes that no two synonyms mean exactly the same thing, so picking a word by a statistical key rather than by semantic fit degrades precision by construction. Legal outlet Artificial Lawyer adds a concern specific to law firms: a client who banned AI use could discover the mark, and multiple watermarks layered in one document complicate attribution.

Step back and the loophole looks less like a bug and more like a design choice that reveals the watermark’s true purpose. Statistical watermarking works best at population scale — counting how much synthetic text is in circulation, flagging coordinated influence campaigns — not at the level of a single document. For an individual output, anyone who wants to strip the mark only needs a different sampling setting, and no detection API will tell the difference between a dodged mark and a text that was never marked. That is the gap the AI Act’s labeling rules will have to bridge, and it is not a gap Anthropic alone can close.

What to do about it, concretely

Anthropic’s watermark is real progress for traceability, but read it for what it is: a detection layer, not a compliance guarantee. Three practical rules follow.

Never base regulatory compliance on the watermark alone. The AI Act requires labeling; the watermark is one means, not the only one, and certainly not a watertight one. Document the sampling parameters of every integration if you claim to rely on the mark — and forbid untracked changes. Do not infer the absence of generation from the absence of a mark: an unmarked text is not a human text.

The most important signal may lie elsewhere. When a vendor itself documents that one parameter cancels its compliance mechanism, it reveals that the watermark is designed for massive, statistical detection — not individual attribution. That is the difference between counting how many texts are generated and knowing whether this text was.

Verdict

If you use the Claude API and your AI Act compliance rests on the watermark, keep temperature, top_p and top_k at their defaults on Opus 4.6 and Sonnet 4.6, and pin them through configuration: an untracked change loses the mark with no warning. If you need a tuned style, accept the loss of the watermark and compensate with explicit downstream labeling. And if you are a verifier or a law firm, treat the mark as one clue among many — never as proof of authenticity, in either direction. Claude’s watermark resists reverse-engineering, but not a simple temperature=0.8.

References

• The Decoder — Anthropic’s watermark rollout leaves a loophole on two older Claude models (October 31, 2026)
• The Decoder — Anthropic announces watermark detection API
• The Decoder — Google DeepMind open sources AI text watermarking for Gemini
• The Decoder — OpenAI will watermark ChatGPT text in the EU, optional for API users worldwide