Anthropic Adds Watermarks to Older Claude Models with Sampling Loophole
Anthropic is expanding text watermarking to older Claude models ahead of EU AI Act rules, but developers can bypass the tag on Opus 4.6 and Sonnet 4.6 via sampling settings.
Anthropic has notified its API customers that it is retrofitting its text watermarking system into four additional AI models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. The move expands detection mechanisms already present on newer models such as Claude Opus 5.5. However, the rollout includes an unexpected technical loophole: developers using Claude Opus 4.6 and Claude Sonnet 4.6 can unintentionally or deliberately bypass the watermark simply by altering basic sampling configurations.
How the watermark works and the sampling loophole
Anthropic describes its watermarking technique as an "imperceptible pattern in word choice" designed not to compromise text quality, readability, or core meaning. Technically, the method does not append extra tokens or characters, does not alter input and output formats, leaves API pricing untouched, and barely affects generation speeds. Anthropic also stated that the embedded signal "contains no information about the user, their organization, or their conversations with Claude."
The implementation relies on a modified version of Google DeepMind's SynthID text technology, which gently shapes the statistical probability of word selections to produce a verifiable signature. Because the watermark is applied directly at the model level, it functions universally across hosting infrastructure, including Microsoft Foundry, Google Cloud, and Amazon Web Services (AWS), though deployment across Amazon Bedrock may take several additional days.
Despite this infrastructure-wide integration, the behavior on Claude Opus 4.6 and Claude Sonnet 4.6 differs from newer models. On these two versions, the watermark activates exclusively when developers maintain default values for three standard sampling parameters: temperature, top_p, and top_k. Altering any one of these settings removes the watermark from the generated text. Anthropic addressed this directly in an email to customers, noting, "If you rely on the watermark for your own compliance, keep these settings at their defaults."
In contrast, Claude Mythos 5 and Claude Opus 4.7 do not share this parameter caveat, indicating their watermarks persist regardless of configuration choices.
Regulatory drivers and competing industry methods
The primary driver behind Anthropic's retroactive implementation is the regulatory timeline imposed by the European Union's AI Act, which features a compliance deadline in December. All Anthropic models released after August 2, 2026, shipped with native watermarking from day one, while older models are receiving the capability incrementally.
Other AI providers have taken divergent paths to comply with watermarking standards. OpenAI rolled out its textGrain mechanism in October 2026, enabling it by default only for ChatGPT and Codex users within the European Union, while providing global API customers an optional toggle that remains off by default. Meanwhile, Google DeepMind made its SynthID text approach open-source and integrated it across the Gemini model ecosystem.
The wider deployment of text watermarking has also generated debate over its technical efficacy and legal implications. Tech commentator John Gruber has argued that because genuine synonyms rarely carry identical nuance, altering token selection to fit a watermarking algorithm inherently degrades semantic precision. Furthermore, legal publication Artificial Lawyer highlighted concerns within professional industries like law, where clients prohibiting AI usage could audit documents for hidden patterns, or where layered AI tools might embed conflicting watermarks into collaborative drafts.
What it means for developers
For engineering and product teams, this rollout creates distinct operational considerations depending on the Claude version deployed. Because Claude Opus 4.6 remains Anthropic's highest-performing model for writing tasks—ranking above Opus 5.5—teams relying on it for long-form content must decide whether to retain default sampling settings for audit compliance or alter parameters to optimize output variance.
Developers who require watermarking verification can access Anthropic's detection API, which is currently operating in private preview, alongside documentation on the company's content labeling information page. Because watermarking cannot be turned off manually on newer systems, teams evaluating cross-provider behavior can test top AI models cheaply through one API at https://apixoai.online to observe differences across Anthropic, OpenAI, and Gemini architectures.
Ultimately, teams operating in regulated sectors must verify their parameter pipelines. Any routine adjustment to temperature or top_p could silently disable compliance markers on Opus 4.6 and Sonnet 4.6, exposing organizations to potential compliance oversights under the EU AI Act framework.
Source: Anthropic's watermark rollout leaves a loophole on two older Claude models — The Decoder. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
