Anthropic的文字水印很容易绕过几个较老的Claude模型
最新消息，2026年11月4日：
Anthropic再次发电子邮件给API 客户，涉及第二轮水印改装。 从2026年11月16日开始，Claude Opus 4.6,Claude Opus 4.5,Claude Sonnet 4.5,Claude Haiku 4.5将全部获得文字水印。 在Amazon Bedrock上，推出可能需要多花几天时间。
Claude Opus 4.6原本是第一波的一部分，应该在11月3日获得水印。 Anthropic明确确认延迟至11月16日，但没有给出任何理由。 Claude Mythos 5,Claude Opus 4.7，以及Claude Sonnet 4.6这三种首波型号在新邮件中并未出现，因此其推出很可能按计划在11月3日进行。
Claude Opus 4.5,Claude Sonnet 4.5，以及Claude Haiku 4.5是前期公告中未包括的三种型号。 此波中的所有四个模型都具有相同的采样限制：水印只在温度，顶 p，顶 k设置到默认值时才适用。 在第一波中，这个限制只击中了四个模型中的两个(Opus 4.6和Sonnet 4.6.
原载2026年10月31日：
Anthropic正在将其文本水印扩展为另外四个Claude模型，但API用户可以通过对其中两个样本参数进行微调来躲避标记。
在一封给API 客户，Anthropic 称的电子邮件中，它将水印为Claude神话5,Claude Opus 4.7,Claude Opus 4.6，以及Claude Sonnet 4.6. Claude Opus 5.5等更新型号已经搭载了标记，Amazon Bedrock上的推出可能需要多花几天时间。
Anthropic称水印为"字选择中无法识别的图案"，不会改变意义，质量，或可读性。 公司称它新增没有额外的字符或符号，不影响定价或请求和响应格式，几乎不会减慢输出速度。 Anthropic同样是称的水印"没有包含用户，他们的组织，或他们与Claude的对话的信息".
Anthropic 只在两个旧模型的默认设置中应用水印
在 Claude Opus 4.6 和 Claude Sonnet 4.6, Anthropic 称上，水印只有在开发者以默认值离开三个采样参数时才会踢入。 这些参数，温度，顶 p，和顶 k，控制模型在选择单词时使用的随机性。 任何一只小鱼都足以躲避水印 Anthropic 警告在它的电子邮件中写着"如果你依赖水印来达到自己的达标，就保持这些设置的默认值".
电子邮件没有提及Claude神话5或Claude Opus 4.7的提醒，它暗示水印适用于这些模型，无论采样设置如何。 但旧型号上的漏洞仍然显著，因为Opus 4.6仍然是Anthropic最好的写作模式，甚至比Opus 5.5还早。
Anthropic在私人预览中有一个检测API用于验证水印，并在其内容标签信息页面上提供更多信息。
Anthropic改装老旧的Claude型号，以符合欧盟AI法案的最后期限
Anthropic指出欧盟AI法案的12月最后期限是它现在对旧型号进行水印的原因。 2026年8月2日之后的每个型号发布，在第一天随水印一起发运，而较老的型号正在分阶段得到。 由于水印嵌入了模型层面，因此它在每个托管这些模型的平台上工作，包括Amazon Web Services,Google Cloud，和Microsoft Foundary. 客户无法关闭。
Anthropic使用Google DeepMind合成器文本方法的变体，该变体对字词选择后的随机性进行了调整，以产生统计上可探测的模式。 OpenAI 发布于2026年10月自有水印系统文本Grain，但仅默认为欧盟的ChatGPT和Codex用户激活。 API 客户环球可以翻转或关闭，它飞船失效。 Google Deepmind 开源 SynthID用于文本，并建入Gemini模型。
水标记是否真正使文本质量未受影响有争议。 博客John Gruber认为，没有两个同义词的意思是完全相同的，所以用水印键而不是语义适应来挑词势必会降低精度。 合法贸易出口人工律师融资是律师事务所的单独关切，禁止使用AI的客户可以发现标记，在一份文件中分层的多个水印可能会造成并发症。
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic's text watermark is easy to bypass on several older Claude models
Update, November 4, 2026:
Anthropic emailed API customers again about a second round of watermark retrofits. Starting November 16, 2026, Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Haiku 4.5 will all get text watermarking. On Amazon Bedrock, the rollout may take a few extra days.
Claude Opus 4.6 was originally part of the first wave and should have gotten the watermark on November 3. Anthropic explicitly confirms the delay to November 16 but gives no reason. The other three first-wave models, Claude Mythos 5, Claude Opus 4.7, and Claude Sonnet 4.6, don't show up in the new email so their rollout likely went ahead on November 3 as planned.
Claude Opus 4.5, Claude Sonnet 4.5, and Claude Haiku 4.5 are three models that weren't part of the previous announcement. All four models in this wave share the same sampling restriction: the watermark only applies when temperature, top_p, and top_k are set to their defaults. In the first wave, that limit only hit two of four models (Opus 4.6 and Sonnet 4.6).
Original article, October 31, 2026:
Anthropic is expanding its text watermark to four more Claude models, but API users can dodge the mark on two of them by tweaking a single sampling parameter.
In an email to API customers, Anthropic said it will watermark Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models like Claude Opus 5.5 already carry the mark, and the rollout on Amazon Bedrock may take a few extra days.
Anthropic calls the watermark an "imperceptible pattern in word choice" that doesn't change meaning, quality, or readability. The company says it adds no extra characters or tokens, doesn't affect pricing or request and response formats, and barely slows output speed. Anthropic also says the watermark "contains no information about the user, their organization, or their conversations with Claude."
Anthropic applies the watermark only at default settings on two older models
On Claude Opus 4.6 and Claude Sonnet 4.6, Anthropic says the watermark kicks in only when developers leave the three sampling parameters at their default values. Those parameters, temperature, top_p, and top_k, control how much randomness the model uses when picking words. A minor tweak to any one of them is enough to dodge the watermark. Anthropic warns in its email that "If you rely on the watermark for your own compliance, keep these settings at their defaults."
The email doesn't mention that caveat for Claude Mythos 5 or Claude Opus 4.7, which suggests the watermark applies to those models regardless of sampling settings. But the loophole on the older models is still notable, since Opus 4.6 remains Anthropic's best writing model, ahead of even Opus 5.5.
Anthropic has a detection API in private preview for verifying the watermark and offers more details on its content labeling information page.
Anthropic retrofits older Claude models to meet the EU AI Act deadline
Anthropic points to the EU AI Act's December deadline as the reason it's watermarking older models now. Every model released after Aug. 2, 2026, shipped with the watermark on day one, while older models are getting it in stages. Since the watermark is embedded at the model level, it works on every platform that hosts these models, including Amazon Web Services, Google Cloud, and Microsoft Foundry. Customers can't turn it off.
Anthropic uses a variant of Google DeepMind's SynthID text method, which tweaks the randomness behind word selection to produce a statistically detectable pattern. OpenAI launched its own watermarking system textGrain in October 2026, but it only activates by default for ChatGPT and Codex users in the EU. API customers worldwide can flip it on or off, and it ships disabled. Google Deepmind open-sourced SynthID for text and built it into the Gemini models.
Whether watermarking truly leaves text quality untouched is disputed. Blogger John Gruber argues that no two synonyms mean exactly the same thing, so picking words by a watermark key instead of semantic fit inevitably degrades precision. The legal trade outlet Artificial Lawyer raises a separate concern for law firms, where clients who've banned AI use could discover the mark, and multiple watermarks layered inside one document could create complications.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Atlas. All rights belong to the original author.