The Watermark Is Sparsest Where You Would Audit

The development

On 14 August, Anthropic said future Claude models will ship with text watermarking enabled globally at launch, using a version of SynthID-Text, the scheme Google DeepMind published in Nature in October 2024. Rollout is described as happening over the coming months, and a detection API is described as coming, with implementation details still being settled.

Two dates sit behind that one. The European Commission published its Code of Practice on Transparency of AI-Generated Content on 31 July 2026, and the AI Act marking obligations took force on 2 August 2026. About 190 organisations had signed by the end of July, 82 on Section 1 and 152 on Section 2, with Anthropic, Google, Meta, Microsoft and OpenAI among the Section 1 names. Anthropic notes that EU law grants a transition period for models launched before 2 August, and describes the change as reaching models not yet released rather than as a switch thrown today.

So the capability is coming. The useful question is narrower than whether to welcome it: which of the things you wanted to detect will it actually detect?

The assumption this invalidates

Drop the assumption that watermarking gives you an AI-content gate.

The announcement and the paper behind it say, independently of each other, that the signal is not spread evenly through the text. Anthropic describes the watermark as sparser on factual passages, where fewer word choices are available that do not cost accuracy, and says code generally carries less watermarking because code has to be exact. The Nature paper states the same property in terms of the sampling method: tournament sampling performs better when there is more entropy in the model distribution and is less effective when there is less, and it names the lower-entropy cases as code generation, factual retrieval, and short responses.

Read those two lists again and notice what is on them. Code. Short factual answers. For most teams those are not edge cases in a detection programme, they are the programme. The policy saying contributors may not submit model-written code, the review step asking whether a support macro was generated, the audit of one-line claims in a generated report: each one points at the low-entropy end, and the low-entropy end is where the mark thins out.

This is not a defect awaiting a patch. The watermark rides on choices among tokens the model treated as roughly interchangeable. Where the model has no such choice, because a variable name must match its declaration or a date is either right or wrong, there is nothing to encode into.

You will not be running the detector

The paper is precise about what detection requires: the tokenized text, the watermarking key, and the random seed generator, with no access to the model needed. That reads as permissive until you notice the key is on the list. Detection is a function of a secret you do not hold.

That fixes the shape of the thing. Each vendor that watermarks exposes a detector for its own key, and a result from it answers one question, which is whether that vendor produced the text. It does not answer whether the text was machine-generated. The paper lists the boundary among its own limitations: the scheme cannot detect output from organisations that do not watermark, it needs coordination among the services running generation, and it is hard to enforce on open-weight models deployed in a decentralised way.

Anyone tempted to skip the vendor and self-host should open the reference implementation first. The google-deepmind/synthid-text repository is Apache 2.0, sits at 981 stars and 12 open issues, and ships three scoring functions: Mean, Weighted Mean, and Bayesian, where the Weighted Mean detector needs no training and the Bayesian one does. Its README also states that the code exists for reference and research reproducibility, that the subclasses are not designed for production systems, and that the hash accumulator used to compute its G values carries no cryptographic security guarantee. That is a research artifact, and its authors say so plainly.

What to do this quarter

Take the detection requirement you have already written down and sort it into two piles by entropy rather than by importance.

1. Long-form prose from a known vendor. Keep it here. This is the case the method was measured on, and the cost side is settled: the paper reports a 0.57 percent latency increase for 30-layer tournament sampling, and a live comparison across about 20 million responses in which thumbs-up and thumbs-down rates differed by 0.01 and 0.02 percent, both statistically insignificant.
2. Code, short answers, single facts. Move these off detection and onto provenance. If the requirement is that no model-written code lands without review, the control is attested commits, agent identity, and a reviewable trail, which is what you would have needed had watermarking never shipped. Detection was never going to satisfy that requirement, and now there is a citable reason why.

Then count your text generation vendors and write the number down. That is how many detection integrations a general content gate would take, and each returns a verdict only about its own output. A negative from all of them means unknown, not human. If your policy language currently treats a negative as clearance, it asserts something no detector of this design can support.

What would have to be true for this to be wrong

One check settles most of it. When the detection API arrives, look for a true-positive rate at a fixed false-positive rate, reported separately for short inputs and for code. Should those land near the long-prose figures, the entropy argument is weaker than the two sources make it sound and the second pile can move back. Should they go unpublished, treat the split above as the working assumption.

A narrower way to be wrong is worth naming. Anthropic describes its implementation as a version of SynthID-Text, while the Nature measurements are DeepMind's own, taken on DeepMind's deployment, with Gemma 7B-IT behind the 3,000-question human evaluation. A modified scheme can behave differently. What carries across is the mechanism rather than the arithmetic, and on the mechanism both parties say the same thing: no entropy, no watermark.

The distance between a shipped capability and an enforceable control is the ordinary shape of this work, and it is what why enterprise AI doesn't ship describes. The model side is arriving. The governance side still needs someone to decide which questions it is allowed to answer.