Sources

Kirchenbauer and others

Introduces the green-list test used here and recommends counting repeated n-grams once, so repetition cannot drive the score.

SynthID-Text

The paper describes the sampling method and reports a live experiment covering nearly 20 million responses. Anthropic says Claude uses a version of the method, but the paper does not describe Claude’s production key, configuration or detector.

Open the worked public fixture

Zhang and others

Tests character edits against spell correction, OCR, Unicode normalisation and deletion of unusual characters. Adaptive attacks still worked after each defence.

Tamim and Khan

A versioned preprint. It reports watermark removal under stated conditions, plus detector errors, in the KGW, Unigram and MarkLLM SynthID-Text configurations it tested. Declawd has not reproduced the experiments.

Checked 13 August 2026.

Watermark stealing

The authors report learning approximate rules for tested watermark schemes and using them for removal and spoofing. Declawd has not reproduced the experiments.

Checked 13 August 2026.

Two oracles

Zhang and others report an impossibility result under the quality-oracle and perturbation-oracle assumptions the paper sets out. Declawd has not reproduced the analysis.

Checked 13 August 2026.

SynthID-Text mean score

A theoretical and empirical analysis reports that SynthID-Text’s mean detection score is inherently vulnerable to added tournament layers, and demonstrates a layer-inflation attack that breaks it while a Bayesian score holds up better. This concerns the published scoring mechanism, not Anthropic’s production configuration; Declawd has not reproduced it.

Low-entropy output

A COLM 2026 paper reports that existing token-level watermarking is inadequate on constrained output such as translation, summarisation and code, where there are few word choices to carry a mark, and proposes a sequence-level method it says recovers up to 28 per cent in detection F1. It tests open schemes, not Claude.

Cross-lingual fairness

A preprint audits six open watermarking schemes on three open-weight generators across eleven languages, four scripts and eight typological families, and reports detection and quality gaps that fall mainly between language families rather than within them. It tests open schemes, not Claude’s production one, and it is a reason not to read any vendor’s quality or robustness claim as holding across languages. Declawd has not reproduced it.

Checked 21 August 2026.

Edit placement

A preprint shows that the share of a text that is edited is an incomplete robustness measure: at one and the same retention rate, the surviving detector statistic can be half the original, a quarter of it, or nothing, according to where the edits fall. Its experiments use schemes the author re-implemented with his own keys and a 0.5B open model, and it measures no production scheme. Declawd has not reproduced it.

Checked 21 August 2026.

Detector base rates

An amendment to an open SynthID-Text evaluation reports a same-model Bayesian detector at 73.58 per cent sensitivity and 2.78 per cent false positives on texts of 200 tokens or more, and works through what that means at an illustrative 1 per cent prevalence: a positive predictive value of 21.1 per cent. The 1 per cent figure is an illustration, not a deployment estimate. The detector, key and Qwen model are the authors’ own, not Google’s production system. Declawd has not reproduced it.

Checked 8 September 2026.

Public-reference attacks

unsynth-id reports bit-for-bit conformance against the public SynthID-Text reference, key recovery for all nine reference layers in 1.8 seconds, and rewrite results under its documented conditions. It calls itself a research testbed, not a product. Dependencies, model files and every result input are not all frozen in this capture. Declawd has not rerun it, and it does not test a production vendor system.

Checked 24 September 2026.

Many-user attribution

TrellisMark publishes an experimental watermark that encodes a 30-bit user address and uses exact Viterbi decoding across the full address space. The repository warns that it demonstrates a surveillance capability and says no lab has announced deployment. It is an independent Qwen research system, not evidence about Claude.

Checked 24 September 2026.

Character scan

John Wang reports finding no anomalous hidden Unicode or whitespace encoding in a 7.2-million-character corpus. The post does not document a class-for-class comparison with this site’s registry or publish the underlying response corpus.

Statistical probes

The same report describes negative green/red-list constrained-choice permutation tests. Its separate SynthID-style probes found prompt effects without identifying a watermark, which is not a finding that the tested models are unmarked.

Black-box presence test

A later study builds on the same Red-Green test and shows the test number as spaced digits. It reports a keyed pattern in Fable 5.1 output tested on 2 September, with a corrected p-value of 0.006 for a 15-digit number and close to zero for a 40-digit one, and reports Sonnet 5 as null. It tests whether a model’s sampling carries a keyed bias across many answers, so it cannot say whether one passage is marked. Declawd has not rerun it.

Checked 24 September 2026.

Questions still unanswered

Ars Technica reported that Anthropic’s 13 August reply did not answer questions about detector timing, error-rate testing or editing exemptions. Anthropic now documents a private preview of its text-watermark API. Declawd has not accessed that detector or measured its errors.

API details

TechCrunch, on 15 August, reported Anthropic’s further detail that a detection API is planned with no date, a complete rewrite removes the mark, and code carries so little that only comments are likely to. It still records no error rate, threshold or minimum length. Its planned-API wording is superseded by Anthropic’s September private preview. Checked 24 September 2026.

Attack reproduction

An independent repository replicates SynthID-Text with the official Hugging Face implementation and its own key on Qwen2.5-7B, then attacks it with a second open model. It reports detection falling from 100 per cent on unedited English text to 5 per cent after paraphrase, 16 per cent after round-trip translation through Chinese and 4 per cent after a self-information rewrite. Its README says none of this is measured against Claude’s real watermark, and the authors did not test Anthropic’s private detector. The repository provides a way to run tests. Only dated runs such as these count as results, and Declawd has not rerun them.

Checked 8 September 2026.

Repository sweep

Three bounded GitHub searches for public repositories created from 15 August 2026 to 24 September 2026 returned 1163 distinct matches. The capture holds 1137 READMEs and records 26 gaps. Automated screening covered every captured README. The review records which documents and source files were read closely.

Some repositories claim Anthropic API integration or allow an operator to configure a detector URL. The inspected material did not demonstrate a working provider-backed integration or removal verified against one. Declawd has not accessed Anthropic’s private text detector.

Captured 24 September 2026. The next sweep starts again at the fixed 15 August discovery floor.

Review and limitations

V1 defects

Issue #17 reproduces two candidate slots that do not fit their sentence frames and a 120-pair result floor below the 200-pair minimum in the calibration and evaluation evidence. The public site now withholds scores and verdicts below 200 pairs. The registered v1 inputs remain unchanged. V2 corrects the candidate frames, registers a 200-pair minimum and checks both sides of that boundary with a fresh seed. The method reports its results separately from v1.

Reviewed 24 September 2026.