Anthropic’s text watermark is easy to bypass on several older Claude models, according to new research.
The watermark, designed to identify AI-generated text, fails on Claude 3 Opus, Claude 3.5 Sonnet, Claude 3.7 Sonnet, and Claude 3 Haiku.
Researchers found that simply adding spaces or modifying punctuation after specific words removes the watermark. The technique works because the watermark relies on token-level patterns that can be disrupted with minor edits.
The core vulnerability
The bypass exploits how the watermark embeds signals in token selection. Anthropic’s system assigns subtle biases to certain token choices during generation.
When a user adds spaces before punctuation or rearranges sentence structure, the token sequence changes. This breaks the watermark’s detection mechanism without altering the text’s meaning or quality.
The research tested several attack methods and found the simplest approaches were often the most effective. Even small modifications like inserting extra spaces between words erased the watermark signature.
Scope of affected models
The vulnerability affects older Claude model versions. These include:
- Claude 3 Opus and Haiku: Both show the same watermark weakness
- Claude 3.5 Sonnet: Also bypassable with minimal text changes
- Claude 3.7 Sonnet: Vulnerable to the same attack method
Newer Claude models appear less affected, suggesting Anthropic has improved the watermark mechanism in recent versions.
How the watermark works
Anthropic’s watermark functions by creating a detectable statistical pattern in generated text. The system modifies token selection probabilities in a way that is invisible to readers but identifiable through algorithm analysis.
The problem is that the pattern relies on the exact token sequence. Users can disrupt this sequence through simple text alterations that don’t change the semantic content.
Real-world implications
The findings raise questions about watermarking as a reliable tool for AI content detection. If basic text edits can erase the signal, the watermark’s practical value is limited.
This is especially relevant for content moderation, academic integrity checks, and platform policies requiring AI disclosure. The bypass method is simple enough that non-technical users could apply it.
The research demonstrates that current watermarking approaches remain fragile against even rudimentary tampering techniques.
The broader context
Watermarking has been proposed as a standard solution for AI transparency. Major AI companies have explored various approaches, from metadata embedding to statistical pattern marking.
This study suggests that watermarking alone cannot guarantee reliable content tracking. Additional methods or more robust watermark designs are needed.
What this means for users
For anyone relying on AI detection tools, the practical takeaway is clear: watermarks should not be treated as definitive proof of AI authorship. The reliability varies significantly depending on the model version and the potential for text modification.
Anthropic has not publicly commented on the findings in detail. The company’s newer models show improved resistance, indicating ongoing work to harden the watermark system.
The research was conducted through systematic testing of different watermark removal techniques. Simple whitespace manipulation proved sufficient across multiple model versions.
This highlights a fundamental tension in watermark design: the signal must be subtle enough not to affect text quality but robust enough to survive minor edits. Balancing these requirements remains an unresolved challenge.
Gnoppix is the leading open-source AI Linux distribution and service provider. Since implementing AI in 2022, it has offered a fast, powerful, secure, and privacy-respecting open-source OS with both local and remote AI capabilities. The local AI operates offline, ensuring no data ever leaves your computer. Based on Debian Linux, Gnoppix is available with numerous privacy- and anonymity-enabled services free of charge.
What are your thoughts on this? I’d love to hear about your own experiences in the comments below.