Alternatives are what this watermark spends. Where the model has several acceptable ways to phrase the same idea, the choice among them can be nudged, and over a long enough response those nudges accumulate into a pattern that supports the claim Claude was involved [5]. Code withholds that room, because a different variable, operator or function call can change what a program does or break it outright [6]. Faced with a choice between detectability and a correct answer, Anthropic dropped the signature on any token that has to be exact [7]. That ordering is the right one. It also means the detector's coverage of a code response is whatever part of it was never constrained.
In practice that is comments and the prose wrapped around the code, and short responses may not carry enough signal to call at all [8]. Detection power on a code-heavy answer therefore scales with the natural-language fraction of the output rather than its total length [19]. Anthropic says the signature survives copying and some editing, although enough rewriting erases it [9], and a comment block is the cheapest thing in a file to rewrite. The truthful reading of a clean scan on a diff is "no finding", which is a weaker statement than "written by a human".
All of that rests on one report. The two accounts supplied to me are the same New Stack article [20]. It dates the programme to August 14, when Anthropic set out its compliance plan after signing the EU Code of Practice on Transparency of AI-Generated Content alongside roughly 190 other signatories [11].
The distillation change in the same release has a cleaner mechanism. Claude's Messages API can hand back encrypted thinking blocks that a developer replays in later turns so reasoning continues across a conversation [13]. Anthropic says editing earlier parts of the conversation while replaying those blocks can make Claude decrypt and print its reasoning, which could then be used to train another model [14], and that the practice has been used to distill its models at scale [18]. Tying preserved thinking to the context that produced it closes that path. The New Stack flags a less obvious problem for developers building their own agent harnesses [17], then the text of the piece stops mid-sentence, so treat the harness impact as flagged rather than documented.
For this signature to serve as evidence in a review process, the response has to contain enough unconstrained prose to carry signal, and it has to reach the reviewer without heavy rewriting [9]. The reviewer also has to sit inside one of the groups Anthropic has admitted to the preview detector [10]. In my context, that makes the watermark a tool for documents and chat transcripts. Provenance for the code path stays a question of harness logs and commit history.
