Does an AI watermark survive translation?

When Anthropic confirmed that Claude would begin invisibly marking everything it writes, the reaction was not gratitude. Users objected to the idea that their own work could carry a signal they never asked for and could not see, and the backlash intensified quickly enough that Anthropic followed up within days with a longer explanation of how the mark works and what it does and doesn't prove.

Buried inside that explanation was a narrower question that almost none of the coverage picked up: what does a watermark like this actually mean for translated text, and does it mean the same thing once the "AI" doing the translating isn't one model finishing its own sentence, but several models producing independent answers that get compared before anything reaches the reader. That second version of the question doesn't have a public answer yet. Not from Anthropic, not from the research the watermarking method is built on, and not from anyone in the translation industry either.

Why this is surfacing now

Machine translation is not new. Rule-based systems go back decades, statistical MT shipped in production translation tools years before anyone had heard of a transformer, and neural MT has been the default since the mid-2010s. So it's a fair question: if AI has been translating text for years, why is watermarking only becoming a live issue in AI translation now?

Two separate things changed, and they're worth keeping apart. First, the method itself is new. Token-level watermarking of the kind Anthropic and Google DeepMind use depends on steering word-by-word probability during generation, a technique that only exists in research from 2022 onward and only ships in general-purpose large language models being used as translators, Claude, GPT, Gemini, not in most dedicated machine translation engines built before that research existed. There was no watermark to discuss for older MT systems because the method hadn't been invented yet.

Second, and more directly, this is regulatory timing. The EU AI Act's Article 50 sets a machine-readable marking obligation for AI-generated content, and Anthropic's own rollout is tied to a specific date: models released on or after August 2, 2026, with older models being retrofitted afterward. Translation isn't becoming watermarked because the technology suddenly changed. It's becoming watermarked because a law with a real deadline is now forcing providers to say plainly what their models are already capable of doing.

What the watermark actually changes

The mechanism itself is simple to describe, even if the mathematics behind it isn't. A language model generates text by picking, one word at a time, from a set of reasonable next choices. Most of the time several of those choices are close enough in quality that picking one over another makes no real difference to the reader. Anthropic's watermark works by steering those near-ties in a consistent, hidden pattern: invisible to anyone reading the text, but detectable to anyone holding the key that defines the pattern.

This is a version of an approach Google DeepMind published as SynthID, part of a broader line of research into undetectable watermarking: schemes built so that without the secret key, there's no statistical test that can tell watermarked text apart from ordinary model output. The appeal is that it doesn't touch quality. A watermarked sentence and an unwatermarked one should read identically.

Independent robustness testing on SynthID-Text has already turned up a relevant weak point. A 2025 study from Queen's University found that paraphrasing, copy-paste edits, and back-translation all measurably degrade how detectable the watermark is. Back-translation is one hop removed from what a translation tool does by default: take a source sentence, run it through a model, and hand back the result in a different language. The research so far has tested that as an attack on an existing watermark, not as the normal, intended operation of a translation product. Nobody has yet studied it as the second case.

The premise underneath the whole method is that the model is choosing the words. For original writing, that's obviously true. For translation, Anthropic has already given a direct answer: a translation produced by Claude carries a watermark, because in that case every word is chosen by Claude too. One model, one generation, one clean answer.

What Anthropic admits the mark can't tell you

To Anthropic's credit, the public explanation is unusually candid about the method's limits. A detected watermark only establishes that a Claude model was likely involved in producing the text at some point. It cannot distinguish a model that wrote a passage from one that lightly proofread it. Anthropic has said light editing probably won't remove the pattern completely, while a full rewrite, where every word gets replaced, likely will, and at that point the company itself concedes it becomes fair to ask whether the result should still be called AI-generated at all. Notably absent from that explanation is any number. Anthropic hasn't published a percentage of words changed, a word count, or any other threshold that separates "edited enough to survive" from "edited enough to erase." Independent researchers haven't published one either. The line between the two cases is currently qualitative, not measured.

That's a reasonable place to draw the line for a single model doing single-pass work: write, edit, proofread, translate. Anthropic's own FAQ addresses all four cases directly, and translation gets the cleanest answer of the group, because the entire target-language text is new output, not a light touch-up of something that already existed.

Buried inside that explanation was a narrower question that almost none of the coverage picked up: what does a watermark like this actually mean for translated text, and does it mean the same thing once the "AI" doing the translating isn't one model finishing its own sentence, but several models producing independent answers that get compared before anything reaches the reader. That second version of the question doesn't have a public answer yet. Not from Anthropic, not from the research the watermarking method is built on, and not from anyone in the translation industry either.

What this settles, and what it doesn't

Anthropic's answer is complete for the case it was written for: one model, asked to translate a passage, generating every word of the result. It says nothing about what happens when several models each produce their own full translation and a system then has to decide which version, or which parts of which versions, the reader actually sees.

The question that answer doesn't settle

A meaningful share of AI translation today doesn't work the way the FAQ assumes. Rather than asking one model for an answer, a growing number of systems run the same source text through several independent models and then select, or in some cases merge, the result the group agrees on. The reasoning is straightforward: a single model can fail in ways a user has no way to catch, especially if they don't speak the target language, and cross-checking against other models is one of the more reliable ways to catch it before it reaches anyone.

That architecture runs directly into a watermarking method built and tested around a single model finishing its own generation. If model A, B, and C each independently translate a sentence and a system selects model B's version because it matches what the majority produced, does the watermark that was embedded in model B's original output survive that selection step unmodified? If the system instead builds a result that draws on agreement across several outputs rather than delivering any one model's answer untouched, whose token-level choices, if anyone's, is a watermark even reflecting at that point?

How different translation approaches map onto Anthropic's watermarking framework

The watermarking method was built, reasonably, around the case that covers the overwhelming majority of AI-generated text: one model, one response. Ensemble and consensus systems are a smaller, newer piece of the landscape, and the research base undetectable watermarking comes from, including the original cryptographic framing of the idea, was built and evaluated against single-model generation. Nobody has publicly tested what happens once selection or merging enters the picture.

Why translation is the sharpest version of this question