Gruber: Claude's text watermark trades word choice for compliance

Anthropic has published a second document, "How Claude's Text Watermark Works," explaining that its EU-mandated text watermarking is a steganographic scheme applied at inference time rather than hidden Unicode characters. John Gruber, who had speculated about invisible characters, walks through the mechanism: at each token decision point, candidate words are sorted deterministically into "green" and "red" sets, and the model is nudged toward green. No word is permanently preferred or avoided, and only someone holding Anthropic's secret key can check which set a token fell into. Detection is statistical, so it needs enough text to reach confidence — the EU Code of Practice on Transparency of AI-Generated Content applies to output longer than 200 tokens, roughly 150 words.

Gruber's objection is that synonyms are not interchangeable, so biasing token choice means Claude will sometimes pick a slightly worse word for reasons that serve compliance rather than the user — including in private conversations no one else will read.

For builders, the practical points are the asymmetry and the fragility. Each provider can only detect its own marks: Claude cannot identify Gemini output, and vice versa. Per Ben Thompson's summary that Gruber quotes, the regulation also expects providers to forbid watermark removal in their terms of service and to survive OCR, copy-paste, and translation. Gruber and James Padolsey both argue the scheme fails at the hard case — anyone determined to pass off AI text can paraphrase through a non-compliant tool — while flagging ordinary assistive use. Padolsey adds that Anthropic's blanket, model-level approach looks broader than the law's minimum.

How much quality actually degrades is unquantified in the piece; the claim rests on the mechanism, not on measurements.