Both dispatches were sourced from Anthropic’s support documentation of August 11, 2026. On August 14 — the same day the dispatches published — Anthropic issued a longer treatment of the text watermark specifically.
We did not have it. It names the method, and it describes a limit on watermark strength that neither dispatch accounts for. Two statements would now be written differently. Several things are worth adding. The argument of both dispatches is unchanged, and we say below why.
What we would correct
Detection status. Both dispatches state that Anthropic’s detection documentation had not been published as of writing. Anthropic has since said it will offer a watermark detection API, with implementation details still being worked out. The accurate formulation is that detection is committed but not available.
This matters most to The Signature Is Not the Duty, whose argument runs on the gap between a deployer’s evidentiary obligations and its route to verifying a mark. That gap narrows on a schedule rather than closing on announcement, and the Code’s permission for providers to restrict free-form-text detection to verified expert users is unaffected by a commitment to ship. The argument holds. The flat statement about documentation does not.
Watermark strength as a function of length. Marked Is Not Detectable treats the 200-token threshold as the floor below which a watermark becomes unreliable, and reasons from passage length. Length is one constraint. It is not the only one, and it is not the more consequential one for enterprise work.
What we would add
The method has a name. Claude’s text watermark is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, from the family of approaches originating in a 2022 proposal by Scott Aaronson. The design principle is narrow: watermarking changes only the source of the randomness used to choose among candidate words. Instead of an arbitrary random number settling a low-stakes choice, a secret key and the preceding words settle it. The words remain random; the sequence becomes checkable against the key.
The Nature paper describes SynthID-Text as production-ready, modifying only the sampling procedure rather than model training, with detection that runs without access to the underlying model. It reports the first deployment of a generative text watermark at scale.
Entropy, not only length. This is the substantive addition, and it is a stronger version of the argument the original dispatch was making.
The watermark can only act where there is a genuine choice between candidate words that are equally good. Where an exact output is required, there is no choice, and the watermark is not applied. Anthropic gives the examples directly: after “2 + 2 =” there is one right answer, and the nudge does not apply. Watermarking is sparser on factual passages for the same reason. Code carries less than other text, surviving mainly in comments, where an arbitrary choice between terms still exists.
So watermark strength is a function of the entropy available in the content, not only the length of the passage. A long technical specification, a table of figures, a code file, a compliance record — each can run well past 200 tokens and still carry a weak signal, because the content itself leaves the watermark little to work with.
For an architect this is the better control fact. Chunk size is a pipeline parameter and can be tuned. Content class usually cannot. An enterprise whose generated output is predominantly factual, numerical, or technical is operating in the weak-signal regime by the nature of its work, and no pipeline change alters that.
Proofreading, stated precisely. Marked Is Not Detectable observes that a mark indicates processing rather than authorship. Anthropic states the mechanism behind it: the watermark applies only to words Claude chooses, so lightly edited human text may carry too little for detection. The asymmetry is worth holding — a translation produced by Claude carries a watermark, because every word is Claude’s; a grammar pass over a person’s writing may carry almost nothing.
Applied globally at launch. Anthropic states it is applying watermarking globally because it does not yet have a durable way to scope by region. Neither dispatch says this. The consequence is that enterprises outside the EU are inside the mechanism without being inside the obligation that prompted it.
The watermark carries no identifying information. It cannot be traced to a person, organization, or chat, and nothing in the watermark or its key recovers user information. Neither dispatch addressed this, and it belongs in any enterprise assessment of the marking layer.
Ownership and legal responsibility are unchanged. Anthropic states plainly that a watermark says nothing about ownership or authorship and does not change a user’s rights under its terms. This sits alongside rather than against the reading in The Signature Is Not the Duty: the Article 50(4) duty attaches to the deployer’s own use, and neither the presence of a mark nor its absence moves it.
What the research adds
Two papers bear directly on the method Anthropic has adopted, and they point in opposite directions.
Han and colleagues assess SynthID-Text robustness and report vulnerability to meaning-preserving attacks — paraphrasing, copy-paste modification, and back-translation — which they find significantly degrade watermark detectability. Read against Marked Is Not Detectable, this is independent support for the transform ladder: paraphrase and translation cycles are where the intrinsic mark is weakest, and that weakness is a property of the method rather than of any one vendor’s implementation.
SWAN takes the opposite approach to the same problem. It embeds the signature in a sentence’s semantic structure using Abstract Meaning Representation rather than in token-selection preferences, so that a paraphrase preserving meaning also preserves the signature. The authors report detection AUC improvements of up to 13.9 percentage points over prior methods under paraphrase, on the RealNews benchmark.
Neither changes what an enterprise should do today. Together they establish that the weakest cell in the transform ladder is a known, actively contested research problem — and that the marking layer an enterprise builds controls around is not settled.
What does not change
The write-path reading holds. Marking is discharged at generation; whether a mark survives to the point of delivery, archive, or evidence is decided by the transforms in between. Naming the method does not change that, and the entropy limit strengthens it — there are now two independent reasons a mark may be weak before any transform touches it.
The two-boundary reading holds. A provider’s Section 1 signature covers the provider’s boundary; Article 50(4) creates an obligation at the deployer’s, addressed by a separate signature. A committed detection API does not transfer a duty.
Watermark strength is a function of the entropy available in the content, not only the length of the passage. Where an exact output is required, there is no choice for the watermark to act on.
Chunk size is a pipeline parameter and can be tuned. Content class usually cannot. An enterprise whose output is predominantly factual, numerical, or technical is in the weak-signal regime by the nature of its work.
One note on timing. Both dispatches were sourced from the record as it stood and published the same day Anthropic issued its longer treatment. The statements corrected here were accurate against their source and have since been overtaken. We publish this note rather than revise the originals in place, so the reader can see what changed and when.
