Why your code is barely watermarked

A detail in Anthropic's watermarking documentation deserves more attention than it has had, particularly from anyone who was quietly hoping this would solve a problem for them: the watermark is minimal in code, because code in very many cases has to be exact.

That is not a gap someone forgot to fill. It falls directly out of how the technique works, and it is not going to be fixed.

The signal lives in the choices

The watermark is carried in the model's tie-break decisions between candidate words that are near enough to equivalent. In prose there are many such moments: overcast or grey, said or noted, begins or starts. Each one carries a fragment of signal, and across a few hundred words those fragments add up to something detectable.

Now consider a function. After a closing parenthesis, in most languages, the next token is not a matter of taste. A semicolon is required or it is not. The variable is named what it was named eleven lines earlier or the program does not compile. There is no synonym for a return statement.

Where there is no choice there is nowhere to put the signal. Syntax is precisely the property that makes code compilable and precisely the property that leaves the watermark nothing to work with. The more correct the code, the less room it has.

The parts that do carry something

Not all of a source file is that constrained. Comments are prose. Commit messages, documentation, error strings and log lines are prose. Identifier names have some latitude, though far less than English does, and any project with a style guide has narrowed it further on purpose.

So the realistic picture is a file whose comments may carry a weak signal and whose logic carries almost none. Which means the strongest detection you could hope for tells you something about the writing around the code rather than the code itself.

What follows for anyone making rules about this

• Do not write a policy that depends on detecting AI-written source. The mechanism cannot support it, and a policy that cannot be enforced only teaches people that your policies are theatre.
• Absence of a watermark in a pull request is not evidence of anything at all.
• If provenance of code matters to you, use the tools built for it: signed commits, signed builds, a reviewed history, and a named human accountable for the merge.
• Ask contributors to disclose. Disclosure scales on trust, which is cheaper and more honest than surveillance that does not work.

The correctness that makes code worth shipping is the same correctness that makes it invisible to a watermark.

The part we find genuinely interesting

Text and code have swapped their usual positions here. Prose, the ambiguous and interpretive medium, turns out to be the one that can carry a hidden proof of origin. Code, the medium that prides itself on being unambiguous, cannot hold one at all.

Which is a reminder that provenance for software was never going to come from inspecting the artefact. It comes from the chain around it: who built it, on what machine, with which key, reviewed by whom. That was true before any of this and it is still the only answer that works.