Watermarking is now default in shipped models, and your paraphrase step is a detection dial

Anthropic says Claude models launched in the EU on or after Aug. 2, 2026 include machine-readable marking in generated text from release, and it is working to add support to older models ^[1]. The marks apply worldwide across the Claude API, Claude Code, Claude Cowork and Claude Tag, and to text generated through AWS, Google Cloud or Microsoft Foundry when those platforms use a supported model ^[2], which means detectability is now a property of the model you called rather than a step you chose.

The mark is not hidden Unicode or appended file metadata. It is the text: a statistical bias in which tokens the model picked ^[28]. Anthropic has not explained its mechanism, nor published any figures on whether watermarking affects latency or inference cost ^[7]. Alex Cui, CTO and co-founder of GPTZero, wrote in a technical explainer that watermarking systems fast enough to run on a streaming frontier model often follow the same general approach, commonly the KGW method ^[13]. KGW, from a 2023 ICML paper by Kirchenbauer, Geiping and Wen, hashes the preceding token with a secret key to split the vocabulary into a green list and a red list, then adds a small constant to the logits of green tokens before sampling ^[8]. Detection needs only the text and the same key: reconstruct the split at each position, count green draws, run a one-proportion z-test ^[9]. Cui was describing the industry method, not a confirmed Claude implementation ^[13]. One confirmed detail: the model is not aware it is being watermarked, because the signal is injected at the sampling layer ^[16].

The number that matters for pipeline design is that the z-score grows with the square root of document length, so short texts rarely reach significance ^[10]. Over 300 tokens, a 62% green rate against a 50% baseline is a statistically significant event ^[11]; that works out to a z of roughly 4.2 ^[12]. Now apply an attack. The WaterPark benchmark from J. Liang and colleagues, in EMNLP Findings 2025, tested ten watermarking methods against twelve attack types and found that a single ChatGPT paraphrase pass dropped every method below 30% true positive rate ^[17]. For SynthID specifically, TPR fell from 0.998 on clean text to 0.498 under moderate paraphrasing ^[18]. Because the statistic scales with the square root of length, halving the per-token green excess means you need about four times as much text to hit the same z ^[26]. Re-composition is worse than rewriting: when a model regenerates from a summary or outline, the original token choices are gone and so is the fingerprint ^[19].

Two asymmetries follow. Files get a different treatment, with SVG, PNG and JPG receiving a C2PA digital signature rather than a token-level signal ^[4]. Code resists invisible marking because the model has fewer valid choices to bias ^[23]. Anthropic's own framing is appropriately hedged: the watermark "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing" ^[3]. "May persist" is doing real work in that sentence.

Watch the December date: older Clan models are slated to be covered before the EU grace period ends Dec. 2, 2026 ^[6], four months after the initial cutover ^[25]. Watch for the promised system that lets watermarks follow copy-and-paste ^[24]. Watch whether Anthropic publishes latency or cost numbers ^[7]. And note the shape of Google's version for contrast: SynthID-Text, published in Nature in 2024, uses tournament sampling ^[20] and has run on Gemini app and web output since 2024, with the API a documented exception ^[21]. OpenAI has still not shipped text watermarking ^[22].