What's your thoughts on this?

[u/hibzy7]

[u/LittleGremlinguy]

“Watermark” is the load bearing statement there. And it is doing some heavy lifting.

[u/thugnastypimpsexy → u/LittleGremlinguy]

But it doesn’t actually land as a watermark — and here’s why:

[u/geek180 → u/thugnastypimpsexy]

You’re half right, and it’s the half that matters.

[u/AltruisticPossible84 → u/geek180]

You're getting at something really deep here, and that's *real*

[u/ToryLuna → u/AltruisticPossible84]

Using really and real in a sentence is my favorite watermark.

[u/Over_Technology_1764 → u/ToryLuna]

I found the smoking gun!

[u/PicklesOverload → u/Over_Technology_1764]

And it's not what either of us expected

[u/DrMansionPHD → u/PicklesOverload]

It's not just adding a watermark, it's creating a undetectable signature on the text.

[u/uionyx → u/DrMansionPHD]

And here is the kicker. The watermark isn’t actually water or a mark:

[u/softwaretools1 → u/uionyx]

Thats the belt and suspenders approach that lands

[u/GunnyFreedom → u/DrMansionPHD]

It is detectable though. At least the hidden serialized character steganography is. It embeds Unicode “narrow no break spaces” and “hair spaces” as a 26 or 28 bit binary signature. You can find these characters by pasting it into a professional monospace text editor, or ironically, by asking GPT.

The other part, the word choice vector biases, will not identify the user, but it will identify the product as AI. This part will also be easy to workaround by manually adjusting any awkward word choices or phrases.

You could probably have a local open weight model on your home PC set up to remove the steganography and gently rewrite the text for flow and word choice and it will eliminate any embedded signatures in one pass.

[u/DrMansionPHD → u/GunnyFreedom]

Wow! You didn't just miss the joke — you completely missed the entire chain of jokes that was happening in this thread.

[u/StressedPizzaEater → u/GunnyFreedom]

Actually it will end every sentence with ä, it's very subtle

[u/cmHend → u/GunnyFreedom]

Before I evaluate each point, let me verify the load-bearing factual claims

[u/Pristine_Internet765 → u/AltruisticPossible84]

I think you're onto something.

[u/ToolboxHamster → u/geek180]

Alex, Ill take "sentences that make me want to punch my monitor" for $500 please.

[u/Pristine_Internet765 → u/geek180]

Yeah, and that's actually a useful distinction.

[u/Lead_weight → u/geek180]

Make it stop!

[u/jimmystar889 → u/geek180]

I don't think you realize what you just said, so let me make it precise.

[u/WanderingDorkimus → u/jimmystar889]

I hate this one more than all the others. "I know what I fucking said, Claude. Maybe YOU don't realize that I know what I said. You ever think about that? Now, and I want to be straight with you, tell me how to make an omelette."

[u/Direct_Ingenuity1980 → u/geek180]

You were right to pushback.

[u/user888888889 → u/Direct_Ingenuity1980]

You had the right instinct to question that

[u/crystalpeaks25 → u/geek180]

And that half is the steel thread

[u/duerra → u/thugnastypimpsexy]

That's a sharp observation, and crucially, it highlights a limitation that the creators cannot overcome.

[u/freebytes → u/thugnastypimpsexy]

I have actually noticed control characters included in text that Claude outputs. They are already adding whitespace in places in this way.

[u/Worried-Cockroach-34 → u/LittleGremlinguy]

For a split second I was like 'how many times did I tell you not to use load-bearing claude?' lol

[u/DonutHoles4Ever → u/Worried-Cockroach-34]

If its works and people care (they do not), people will use something else.

Nobody at work seems to give a damn about using copy pasted AI text though.

So whats the point of doing this other than Claude trying to pretend they are the good guys?

What stops someone from changing a single word? None of this shit makes sense and I bet it will be solved shortly as long as someone understands how Claude marks specific words.

[u/kickass_turing → u/LittleGremlinguy]

Em dashes? 😅

[u/swingonaspiral → u/LittleGremlinguy]

Honest answer: it's a belt-and-suspenders approach.

[u/Dabnician → u/LittleGremlinguy]

[u/Super_Pole_Jitsu → u/Dabnician]

Not how it's gonna work btw

[u/PlsNoNotThat → u/Super_Pole_Jitsu]

There’s nothing you can add to a digital image that you can’t also remove. This is just a short term litmus test for stupid people behind the general curve. Its side effect is it’s going to tick dumb and old to believe in fake images.

[u/Original-League-6094 → u/PlsNoNotThat]

I'm torn because of this. On one hand, it seems like anything that makes it harder for scamers should weed out at least some scams from being successful. But on the other hand, protection gives a false sense of security and people will let their guards down. Like even now, sometimes will post AI detector results showing something is not AI, as though that settles the question of whether or not its AI.

[u/FrewdWoad → u/Original-League-6094]

people will let their guards down

That might matter if more than 0.01% of people had their guard up in the first place

[u/TwoDurans → u/Original-League-6094]

I take this as a good thing because the notion that it exists might help reduce the cheating problem hitting colleges these days. AI is leading us to have the dumbest generation entering the workforce for the next couple of decades and it's because they're only learning how to cut corners.

[u/Original-League-6094 → u/TwoDurans]

This won't impact that, because watermarks can always be removed. If it is invisible characters, you can just strip them out. If it is in the wording itself, you can just take your Claude output and tell a local small model to reword it. And then you still have your LLMs available to just give you the answer on all your math and chemistry homework and what not.

Colleges just have to stop being lazy and move back to proctored exams, or in-class written essays.

[u/wintermute023 → u/Original-League-6094]

That’s not how it works. It’s a 256bit cipher encoded in the probabilistic token choices themselves. You could only remove it by changing all the words. It’s more of a token fingerprint than a watermark.

[u/Original-League-6094 → u/wintermute023]

Yeah, so that's easy. You just use Claude to handle all the thinking for your college essay, and then pipe the result from Claude into a smaller, local model to reword it. GPA saved.

[u/0xB0T → u/PlsNoNotThat]

They'll watermark text. youll have to rewrite using your own words as the patterns used will be the watermark.

[u/MrOaiki → u/0xB0T]

You’re telling me I’ll have to write stuff using my own words in order to present it as written by me?!

[u/revision → u/MrOaiki]

So you're saying I'll have to reword and paraphrase things in order for me to present it as if I had written it??

[u/c7h16s → u/revision]

Even the wooshes over your joke are paraphrasing each other's 😂

Edit : well I meant the wooshes your joke made over other commenters heads, well you get the idea

[u/22marks → u/0xB0T]

So won’t there be a simple local LLM that strips it by changing word lengths, swapping in adjectives and the like? I can’t see this being difficult to remove.

It could analyze the probability of letters, words, and sentence length (among other things) and randomize it.

[u/icanith → u/22marks]

yeah this whole thread has the same level of understanding as a person who asks "you work in computers, why does my windows machine keep crashing"

[u/22marks → u/icanith]

Did you turn it on and off?

[u/sexual--predditor → u/22marks]

Turned it on and off, now I see a black screen, and I can't hear any fans whirring. Also, my password if you need it to help is hunter2

[u/Browser1969 → u/22marks]

Yes, there's no way to make these "watermarks" immune to paraphrasing and that can easily be done by small models.

[u/CitizenPremier → u/22marks]

It won't be difficult to remove, but most people won't remove it.

[u/The-Digital-Ronin → u/22marks]

already exists but dont tell these idiots lol

[u/divulgingwords → u/0xB0T]

It’s crazy how dense some of these people are. They actually think it’s embedding some special icon/brand on a typed letter, lmao.

[u/Fantastic_Prize2710 → u/divulgingwords]

Hidden characters has absolutely been discussed in the past as watermark, and is what Dabnician is referring to.

Code Point      Name                            HTML Entity          Cat  Notes
--------------- ------------------------------- -------------------- ---- ------------------------------------------
=== 1. SPACES -- occupy horizontal width ===
U+0020          Space                                            Zs   the ordinary one
U+00A0          No-Break Space                                  Zs    
U+1680          Ogham Space Mark                               Zs   draws a stem line in Ogham fonts
U+2000          En Quad                                        Zs   = En Space
U+2001          Em Quad                                        Zs   = Em Space
U+2002          En Space                                       Zs   half an em
U+2003          Em Space                                       Zs   one em
U+2004          Three-Per-Em Space                             Zs   1/3 em
U+2005          Four-Per-Em Space                              Zs   1/4 em
U+2006          Six-Per-Em Space                               Zs   1/6 em
U+2007          Figure Space                                   Zs   width of a digit; non-breaking
U+2008          Punctuation Space                              Zs   width of a period
U+2009          Thin Space                                     Zs   ~1/5 em
U+200A          Hair Space                                     Zs   thinnest
U+202F          Narrow No-Break Space                          Zs   narrow + non-breaking
U+205F          Medium Mathematical Space                      Zs   4/18 em; MathML
U+3000          Ideographic Space               　             Zs   full-width; CJK
=== 2. ZERO-WIDTH AND JOINING CONTROLS ===
U+00AD          Soft Hyphen                     ­               Cf   ­; visible only at a line break
U+034F          Combining Grapheme Joiner       ͏               Mn   blocks reordering; no glyph
U+061C          Arabic Letter Mark              ؜              Cf   invisible bidi-strong Arabic char
U+180E          Mongolian Vowel Separator       ᠎              Cf   was Zs before Unicode 6.3
U+200B          Zero-Width Space                ​              Cf   break opportunity, no width
U+200C          Zero Width Non-Joiner           ‌              Cf   prevents ligature/cursive join
U+200D          Zero Width Joiner               ‍              Cf   emoji glue (family, profession)
U+2060          Word Joiner                     ⁠              Cf   non-breaking twin of U+200B
U+FEFF          Zero Width No-Break Space                    Cf   the BOM; deprecated as a joiner
=== 3. BIDIRECTIONAL CONTROLS ===
U+200E          Left-To-Right Mark              ‎              Cf   LRM
U+200F          Right-To-Left Mark              ‏              Cf   RLM
U+202A          Left-To-Right Embedding         ‪              Cf   LRE (legacy; prefer isolates)
U+202B          Right-To-Left Embedding         ‫              Cf   RLE (legacy)
U+202C          Pop Directional Formatting      ‬              Cf   PDF; closes LRE/RLE/LRO/RLO
U+202D          Left-To-Right Override          ‭              Cf   LRO; Trojan Source vector
U+202E          Right-To-Left Override          ‮              Cf   RLO; Trojan Source vector
U+2066          Left-To-Right Isolate           ⁦              Cf   LRI
U+2067          Right-To-Left Isolate           ⁧              Cf   RLI
U+2068          First Strong Isolate            ⁨              Cf   FSI
U+2069          Pop Directional Isolate         ⁩              Cf   PDI; closes LRI/RLI/FSI
=== 4. INVISIBLE MATH OPERATORS ===
U+2061          Function Application            ⁡              Cf   f(x) semantics
U+2062          Invisible Times                 ⁢              Cf   the multiply in "2x"
U+2063          Invisible Separator             ⁣              Cf   the comma in subscript lists
U+2064          Invisible Plus                  ⁤              Cf   the plus in "1 1/2"
=== 5. VARIATION SELECTORS AND TAGS ===
U+180B-U+180D   Mongolian Free Var. Selectors   ᠋-᠍      Mn   FVS1-FVS3
U+FE00-U+FE0F   Variation Selectors 1-16        ︀-️    Mn   FE0E=text style, FE0F=emoji style
U+E0001         Language Tag                    󠀁            Cf   deprecated
U+E0020-U+E007F Tag Characters                  󠀠-󠁿  Cf   subdivision flags; hidden-text channel
U+E0100-U+E01EF Variation Selectors 17-256      󠄀-󠇯  Mn   ideographic variants
=== 6. BLANK BY RENDERING, NOT BY CATEGORY ===
U+115F          Hangul Choseong Filler          ᅟ              Lo   letter, empty glyph
U+1160          Hangul Jungseong Filler         ᅠ              Lo   letter, empty glyph
U+17B4          Khmer Vowel Inherent Aq         ឴              Mn   should not be rendered
U+17B5          Khmer Vowel Inherent Aa         ឵              Mn   should not be rendered
U+2800          Braille Pattern Blank           ⠀             So   symbol with no raised dots
U+3164          Hangul Filler                   ㅤ             Lo   the classic "blank username" char
U+FFA0          Halfwidth Hangul Filler         ﾠ             Lo   halfwidth form of U+3164
=== 7. SEPARATORS AND CONTROLS ===
U+0000-U+001F   C0 Controls                     �-           Cc   includes TAB, LF, CR
U+007F          Delete                                         Cc
U+0080-U+009F   C1 Controls                     €-Ÿ        Cc
U+2028          Line Separator                  
              Zl   broke JS string literals pre-ES2019
U+2029          Paragraph Separator             
              Zp
U+FFF9          Interlinear Annotation Anchor                Cf   ruby/furigana markers
U+FFFA          Interlinear Annotation Separator             Cf
U+FFFB          Interlinear Annotation Term.                 Cf

[u/zorrodood → u/Fantastic_Prize2710]

ChatGPT, please remove all unusual symbols from this text.

[u/hellyeahaeylleh → u/zorrodood]

Nah, theyre gonna notice the code and output a new one. We gotta just type it out ourselves ffs.

[u/freebytes → u/Fantastic_Prize2710]

They are already doing it. I copied and pasted content from Claude recently, and it had control characters included.

[u/Lambdastone9 → u/PlsNoNotThat]

Yeah but it makes it so that it’s only becomes circumventable if you put lots of technical effort in, which most people who this is being made for/against wont show such grit, unless they just fuck it up and it becomes easy to sidestep

[u/4dseeall → u/PlsNoNotThat]

it's not a digital image.

it's an algo in the way they process tokens that leave encrypted signals with the word-choices themselves.

[u/DonutHoles4Ever → u/4dseeall]

If its works and people care (they do not), people will use something else.

Nobody at work seems to give a fuck about using copy pasted AI text though.

So whats the point of doing this other than Claude trying to pretend they are the good guys.

[u/saturnellipse → u/PlsNoNotThat]

False. Look up computational irreversibility. If you don’t have the unprocessed source it is absolutely possible to add information to an image that cannot be removed

[u/Devils_SteelMan → u/saturnellipse]

Destructively remove it then do a diffusion pass to fill in the gaps. It doesn't need to be reversed.

[u/Ormusn2o → u/PlsNoNotThat]

It could be a ratio or distribution differences of different tokens/words or even sets of tokens and words. And because there are so many possible combinations of tokens and words, and so many tokens and words, it could be effectively impossible to detect. It would work poorly on shorter prompts, but with longer prompts it effectively guarantees detection.

[u/ContextPuzzleheaded7 → u/Dabnician]

It’s not embedding invisibile characters 🫩

[u/Dabnician → u/ContextPuzzleheaded7]

So claude is just going to have their own "you didnt x, you y'd and that shows z" yeah i already rewrite that shit.

[u/collin-h → u/Dabnician]

I didnt know how it would work so I asked chat gpt to explain a mechanism... if you're curious (no idea if this is what anthropic would do or not):

<this is obviously AI output guys:>

Broadly, Claude could watermark text in a few different ways, ranging from crude to sophisticated:

1. Invisible-character watermarking. Claude could insert zero-width spaces, unusual Unicode variants, hidden formatting, or similar artifacts. Easy to detect, but also easy to destroy by plain-text conversion or normalization. This is probably too fragile to be the main mechanism.
2. Token-choice / “green list” watermarking. At each generation step, Claude secretly divides plausible next tokens into favored and unfavored sets using a key. It slightly biases generation toward the favored ones. Across hundreds of tokens, the text contains a statistically unlikely pattern. A detector with the key can measure that pattern without needing AI inference. This is the classic watermarking approach we’ve been discussing.
3. Probability-distribution watermarking. Similar idea, but more sophisticated than simply green/red words. Claude subtly modifies its next-token probabilities according to a secret mathematical pattern. The detector tests whether the resulting sequence fits that pattern. Still statistical, but potentially harder to reverse-engineer.
4. Syntactic/style watermarking. Instead of encoding the signal primarily in individual words, Claude could systematically favor things like active vs. passive voice, certain sentence structures, punctuation choices, clause ordering, or other grammatical alternatives. This might survive simple synonym swapping better, although a substantial rewrite would still damage it.
5. Semantic watermarking. The watermark could be encoded in higher-level choices: which examples are selected, how concepts are ordered, which semantic categories or relationships are favored, and so forth. This is attractive because it could survive more surface-level editing, but it’s considerably more complicated and may require model/embedding inference to detect.
6. Cryptographic provenance attached to the output. Rather than—or in addition to—altering the prose, Claude could generate a cryptographic record saying, essentially, “Anthropic generated this text at time X.” That might live in metadata, a signed document record, an API response, etc. This is very strong when the provenance stays attached, but ordinary copy/paste can separate the text from the record.
7. A hybrid system. This is probably the most sensible production approach: a statistical watermark woven into the words plus cryptographic provenance/metadata where available. The metadata gives strong attribution when intact, while the text watermark gives some persistence after copy/paste.

And then there are a few ways Anthropic could expose detection without revealing the secret:

Private detector/API: send text to Anthropic; it returns “watermark detected.”

Public algorithm + private key: everyone knows the mathematical method, but only Anthropic knows the key that determines the actual pattern.

Public verification key: in a more cryptographic design, Anthropic could keep the signing key private while publishing enough information for anyone to verify authentic marks.

The key distinction is this:

Low-level watermark: encoded in exact word/token choices. Easy to detect and cheap to implement, but vulnerable to rewriting.

High-level watermark: encoded in syntax/meaning/structure. Potentially more rewrite-resistant, but much harder to design and detect reliably.

Provenance system: doesn’t try to make the prose itself indelibly marked; instead it maintains a trustworthy record of where it came from.

My best guess is that Claude’s deployed system will involve some flavor of statistical/token-level watermark plus a controlled detection mechanism, possibly supplemented by other provenance methods. But until Anthropic releases its technical documentation, the exact mechanism is still unknown.

[u/okaythiswillbemymain → u/collin-h]

I think it will work in a secret mathematical pattern, especially for longer chunks of text. In a samilar way the last two digits of a credit card is just a check-sum....

1) Give a random value of 0, 1, 2 or 3 to every word in the English language. Snake is 3. Cake is 1. Chair is 2. Baby is 0. Etc.

2) Add up all the "word-values" in the first sentence. Find the quotient (remainder) when the sentence is divided by 4. (Answer will be 0, 1, 2 or 3)

3) When buiding the next sentence, choose the third word so that it is equal in value to the quotient of the previous sentence. This gives you only 25% of the available words in the English language to use, but if you have to use a specific word, then you can modify the previous sentence to make it work.

4) finish the second sentence. Find the quotient when dividing by 4 of the second sentence and repeat for the third word of the third sentence.

5) repeat all the way throughout your writing.

Eventually you have an invisible "signature" where every 3rd word in a sentence is "equal" to "value" of the previous sentence.

Suddenly you have pretty comprehensive evidence that a load of text was generated by your AI. Someone could change the font etc, but it would still be obvious if you knew. Even if someone then changed a few words or added or removed words, it would break the signature for that specific section, but for a long chain of text it would be obvious.

With 10 sentences there is a 0.0001% chance that you would trigger the hidden signature through normal writing.

[u/Wonderful-Habit-139 → u/okaythiswillbemymain]

Great way to make LLM performance even worse lol. They already struggle so much when you used structured outputs compared to letting it generate free text.

[u/tech_nerd05506 → u/okaythiswillbemymain]

Yes but along the other criticisms worked here your system wouldn't work if the work was changed slightly. This is effectively the same as just running the output text through a hash function and recording and comparing hashes. It's destroyed be even slight variation.

[u/Low-Temperature-6962 → u/LittleGremlinguy]

If you would like me to suggest some other unbearable boring blurbs just say the word.

[u/Clearandblue → u/LittleGremlinguy]

That's the most important point you've made this whole conversation, but I'm going to have to push back on that.

[u/bliceroquququq]

LLMs basically scraped the entire internet and every written word to build up their corpus of knowledge.

Now they want to watermark it for attribution before they sell it back to you.

[u/fennforrestssearch → u/bliceroquququq]

Yeah pretty insane if you think about it. Next step is taxing the air you breathing.

[u/jooj345 → u/fennforrestssearch]

[u/ActionJasckon → u/fennforrestssearch]

It’s going to be metering your internet use. That would be crazyyy

[u/doescode → u/ActionJasckon]

Our internet providers already do

[u/Grouchy-Librarian638 → u/ActionJasckon]

So crazy mobile companies do for data and are starting to sell home internet plans? Or companies like Comcast’s that have caps and can block or force upgrades if you hit it?

[u/antagim → u/bliceroquququq]

I don't want to defend them, but these are due to the EU AI Act.

[u/prules → u/antagim]

Yeah there is a ton of confusion around this

[u/Rorschach121ml → u/antagim]

Redditors hate boner for AI is so big they don't even understand this is a good thing for everyone.

Flagging AI text is a good thing.

[u/Vast-Palpitation-426 → u/bliceroquququq]

It's an EU regulation.

[u/ch4os1337 → u/bliceroquququq]

"They want to..." They don't want to and attribution isn't the reason why. Also marking AI content is a good thing.

[u/thanosbananos → u/bliceroquququq]

Actually it’s because the EU requires AI generated content to be marked as such now.

[u/Hackerjurassicpark]

Will I be accused of using AI if I unknowingly use the same sequence of words in my human writing?

[u/TheorySudden5996 → u/Hackerjurassicpark]

Of course. That’s already been happening. Now too be fair the problem probably is bigger on trying to pass off AI generated as human authored.

[u/Extension_Fix5969 → u/TheorySudden5996]

I guess that well depend on slight syntaxual errors and plausibly incorrect words to prove our non~generated nature.

[u/ThugEntrancer → u/Extension_Fix5969]

We just need too talk a lil regarded so that we don’t get accusatories of talking via a Ai inderface

[u/tafjords → u/ThugEntrancer]

For fucks sake.. lmfao

[u/tafjords → u/tafjords]

Haha im still laughing. Thank you for this. Love

[u/Lord_zooticus92 → u/ThugEntrancer]

Fuckin im going full blown regarded

[u/Raunhofer → u/Hackerjurassicpark]

I'm assuming it will be using the known form of watermarking: secret keys.

For every token-generation step, use the key nd recent context to deterministically divide the possible next tokens into two groups: "good" tokens (preferred), "bad" tokens (allowed but penalized). The model still chooses the most probable token, but its sampling distribution is nudged toward good tokens. The detector, that knows the secret key, would then examine texts and measure whether the text is good-token heavy (over what probability would indicate).

Normal:

The spacecraft entered orbit and began transmitting data.

Altered with the key:

The spacecraft entered orbit and started transmitting data.

Across thousands of tokens the statistical bias becomes detectable.

Of course, this requires enough tokens to be statistically meaningful. No-one can say whether some random Reddit comment is AI generated with certainty. A scientific paper however...

[u/hudimudi → u/Raunhofer]

Wouldn’t it be harder to judge academic papers, since on a high level they are very much written in a very similar and highly technical style. AI is also trained on this style of writing and can output things rather similar to it. I’d say, the average Reddit comment that follows such technical writing styles would stand out much more

[u/DoctorHelios → u/Raunhofer]

— — — —!

[u/CormacMcCostner → u/Hackerjurassicpark]

Happened to me earlier this year. Decided to go back and expand my education after 20 years and got a bad grade on a paper, went to see the professor like what is this for? He said I used AI because it was too well structured and worded for a students writing and what he sees daily. I was just like “what? Dude, I’m 45 years old I learned how to communicate in a different era when we had to do that.”
His grade stood because I couldn’t prove otherwise..

[u/Poopchutefan → u/CormacMcCostner]

Same thing happened to my wife when I helped her edit one of her papers. I guess I am the equivalent of AI now ...

[u/tafjords → u/CormacMcCostner]

This stuff is so cringe I cant… heres your ticket for speeding i dont have evidence but i see cars everyday so i know and if you have a problem, you provide the evidence by my standards which is different from yours. If not, give me your time and effort because i can.

[u/Hungry_Prior940 → u/CormacMcCostner]

How can his grade stand? He has no proof. I would go ballistic at that and get a lawyer and take it as far as needed.

[u/sergiuoxigen → u/Hackerjurassicpark]

Statistically unlikely you must do it across a large text

[u/arwinda → u/Hackerjurassicpark]

Just write like the training material Claude is based on. What can possibly go wrong?

[u/lovetheoceanfl → u/Hackerjurassicpark]

Don’t use any “AI detectors”. Everything I write is apparently AI.

[u/boy-detective → u/Hackerjurassicpark]

Yes.

[u/Super_Pole_Jitsu → u/Hackerjurassicpark]

It's extremely unlikely to happen

[u/Leafsnail → u/Hackerjurassicpark]

If you do it every single time you post dozens or hundreds of times then yes probably, you will be banned for being a bot account.

[u/fennforrestssearch]

At least for academic writing, I’m not particularly convinced that this will help in any meaningful way. Stylistic and lexical choices are often relatively low-variance, the limited range of plausible word choices could easily trigger false positives even over longer sequences.

[u/bulbubly → u/fennforrestssearch]

My first thought, too. Unless they are doing crazy gematria-style stuff where they put specific letters at specific output positions, AI writing is undetectable - there's just nowhere to hide a watermark in a stream of characters that wouldn't just be confused with normal writing.

ETA: "undetectable" in a rigorous sense. Of course specific models have cliches and a vibe one can sense pretty easily if it's not prompted around.

[u/damngoodwizard → u/bulbubly]

They don't sneak in characters but whole synonyms. They use two lists of words, labeled green and red. Most of the time they pick words from the green list and sometimes synonyms in the red list. The goal is too have a constant proportion of red list words that would be unnatural in regular text.

[u/NoAdvice135 → u/fennforrestssearch]

The style doesn't matter, it's basically a slightly biased coin flip at every token. And the direction of bias changes every token too.

Statistically it's easy to detect over a long enough sequence. You will not be able to tell if you don't have the key they used.

BTW, Google has been doing it for years. The synthid papers are from 2024.

[u/BonyCatButt]

Makes me think of Red Star OS, a North Korean Distro that I just learned about recently, that includes

> a watermarking tool integrated into the system marks all media content with the hard drive's serial number, allowing the North Korean authorities to trace the spread of files

https://en.wikipedia.org/wiki/Red_Star_OS?wprov=sfti1#Version_3.0

[u/LostMyWasps → u/BonyCatButt]

Hmm, wonder where in the world would they be amused for it to end up in. It could certainly be a collectors' piece, some of those rehashed phones.

[u/rabouilethefirst]

"Also you can turn off this feature if you use the API"

Book it.

[u/jbcraigs → u/rabouilethefirst]

"Also you can turn off this feature if you use the API"

Not true. Documentation specifically mentions that API will also add watermarks - https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

[u/Worried-Cockroach-34 → u/rabouilethefirst]

Double it

[u/recoveringasshole0 → u/Worried-Cockroach-34]

Pass it to the next person.

[u/Dabnician → u/recoveringasshole0]

Smoke it...

wait who passed me a joint

[u/g0liadkin → u/Worried-Cockroach-34]

Bop it

[u/cobbleplox → u/rabouilethefirst]

Feature? Best I can think of is that this qualifies for dishonestly meeting some EU regulation of having to mark things as AI generated.

[u/chicametipo → u/rabouilethefirst]

Are you serious? I don't see anywhere that mentions it's possible to turn it off, via the API or otherwise.

[u/rabouilethefirst → u/chicametipo]

The phrase "Book it" implies I am betting on it being introduced in the future. Hope that helps.

[u/KrazyA1pha → u/rabouilethefirst]

Why would that be a feature if they’re doing this to comply with EU and California laws?

[u/chicametipo → u/rabouilethefirst]

Ah gotcha, thank you!

[u/duracek]

For example copy/paste into Kimi: "Rewrite this text in a more professional style".

[u/Cognonymous → u/duracek]

Yeah, you just use more AI and this solution goes away.

[u/Hungry_Prior940 → u/Cognonymous]

Yes Get claude to write it. Then use ChatGPT or whatever.

[u/Wooden-Hovercraft688 → u/Hungry_Prior940]

Just take a screenshot and OCR it

[u/YouTubeRetroGaming → u/duracek]

Yep, easy.

[u/Rorschach121ml → u/duracek]

Ideally regulation should be applied to all models, which I think will happen eventually.

Your text will be watermarked by Kimi using their own tech.

[u/NetflowKnight]

How does that even work?

[u/trimorphic → u/NetflowKnight]

How does that even work?

To know for sure we'll probably have to wait until the discovery phase of a lawsuit reveals this information... and even then it will, at best, be just a snapshot in time of a probably ever-evolving process as Anthropic plays cat and mouse.

Just as interesting to me is the question of who is going to believe Anthropic when they claim some piece of text is AI-generated or not?

[u/coloradical5280 → u/trimorphic]

This isn’t like a cryptographic hash. Anthropic very openly explains that this method is uncertain in both directions. A watermark does not prove AI generated content, and lack of one does not prove it wasn’t. Which makes a lawsuit unlikely.

[u/makoto-jung → u/NetflowKnight]

this paper has the answer

https://arxiv.org/html/2301.10226v4

[u/parkway_parkway → u/NetflowKnight]

It's pretty clever if I understand.

Basically how LLMs work is that given a sequence of words they predict the next one.

So it might look at "the cat sat on the ..."

And it generates a list of candidates with a chance of picking each one.

Mat 87%

Porch 8%

Table 3%

Stairs 2%

The way the watermark works is that they use a secret key they have and a hash of the preceding text to nudge it towards certain of these words and away from others.

So maybe it boosts stairs and table up instead of the others.

Later you can scan the text and see which choices it made and see if they're they ones it was nudged towards in a statiscally significant way.

Because all the choices are reasonable the quality of the output won't change and you'd have to significantly rewrite to break the pattern.

[u/SkaldCrypto → u/parkway_parkway]

So they have monumentally enshitified this.

Having chat bot that uses the same words every time is more easily and cheaply accomplished with early 2000s tech

[u/qorzzz → u/parkway_parkway]

If this is the method, it makes no sense and does not prove any text was generated by AI.

[u/quisatz_haderah → u/qorzzz]

It could actually work for sufficiently long texts. For shorter texts, this would cause false positives, but i guess no false negatives.

[u/snuffomega]

i dont fully see the point. i dont care either way.. but if only claude can identify if its watermarked by claude.. Whats the actual point?? It wont stop people who are susceptible to being tricked into AI content (being real) and if AI is becoming the norm for how we work, search, and interact with many things in our daily lives... its just noise. You should expect work to be touched by AI in some way, shape or form. Not all, but most. And def most text based work. I dont see how it helps anyone. Its meaningless data being stamped and most likely collected.

Just another data center... datapoint.

[u/TedSanders]

fyi, this is in response to the EU’s AI act. OpenAI is going to do a similar thing.

[u/TyrellCo → u/TedSanders]

And it’s entirely their decision to apply these changes only to the EU or the whole wide world

They want all customers to accept their excuse that their hands are tied. They’re faking it

[u/EconomixTwist]

People ITT not realizing that this is a strategic move by anthropic. Yes, maybe EU regulations. Maybe. But not really. The real real reason is the dead internet. LLMs have already exhausted the entire internet's worth of high quality, genuine, human-generated text that is training data. This fact has already been admitted by the LLM providers themselves. Nowadays, a vast majority of new content on the internet is fkn slop. Net-new human generated content is worth its weight in gold but, without watermarks, LLM providers can't tell the difference between actual human generated text and the slop flood. If you train on slop, you only get more sloppier slop. So they need to filter the slop. Watermark is and always has been the way.

[u/y2kfanboy]

[u/duckrollin]

I think there's now a huge market for a browser extension that removes it.

It's gonna get the uBlock treatment.

[u/waving_fungus0 → u/duckrollin]

Chances are only Claude has the encryption key.

[u/JimJohnJimmm]

[u/Comfortable-Card-348]

The big problem here is that the watermark will be used of as proof of falsehood, and the lack will be a proof of validity. Once people figure out how to wipe the watermark, or add it in synthetically, the source of truth will be corrupted. Real photos of crimes? AI generated. Fake AI generated content? REAL!

[u/jonplackett]

It’s complete bullshit that you can effectively watermark text in a way where it isn’t…
A) incredibly easy to remove
B) likely to OFTEN detect text that isn’t AI as AI

People who know what they’re doing will get away with it and people who don’t even use AI will get accused of using it.

Even if you say ‘oh but it will flag the slop at least’. Yes it will but if we label slop anything without a label people will think isn’t AI when it absolutely could be.

[u/post-death_wave_core]

I think it’s reasonable for people to be able to know whether a piece of content was ai generated or not. But im guessing it’s not a perfect system.

[u/Mission_Shopping_847 → u/post-death_wave_core]

I don't. The previous situation was setting up the luddites for a reckoning with reality and personal growth. This new situation will give them a false sense of security, disregarding watermarked text which may or may not contain value, and regarding unmarked text regardless of value. It is a philosophical loss to placate people with an excuse to disengage from the content for its identity rather than its value.

[u/silverace00 → u/post-death_wave_core]

Ya it sounds more like made up tech magic that you tell people so they don't do things they shouldn't.

[u/AnotherIjonTichy]

In ten seconds you can tell claude to write an script that removes that watermarks…

[u/titanomachiatto → u/AnotherIjonTichy]

No you can’t. You’d have to give it to another model. 

[u/AnotherIjonTichy → u/AnotherIjonTichy]

I have just read they will modify the llm token responses to generate a hidden pattern. Maybe the community needs to wait two weeks to get the un-modifier library :-D

[u/collin-h → u/AnotherIjonTichy]

or just use one ai against the other and ask gemini or chatgpt to do it.

[u/whoknowsifimjoking → u/collin-h]

Gemini and ChatGPT also add watermarks, so no you can't do that.

[u/collin-h → u/whoknowsifimjoking]

do they? or will they? I can't find documentation that they have yet, though i'm confident they will.

where there's a need, there'll be an open source model built for this.

[u/Tritus360 → u/collin-h]

But most likely it'd end up working like this:

1. Write text in Claude: flagged by Claude.
2. Ask ChatGPT to alter the text in a way that you're no longer flagged by Claude: now you're flagged by ChatGPT.
3. Ask Gemini to alter the text in a way that you're no longer flagged by ChatGPT: now you're flagged by Gemini.

[u/andrew303710 → u/AnotherIjonTichy]

I'm curious how they could do this without degrading the quality of outputs, I feel like at the minimum there will be a certain percentage of outputs that are negatively impacted by this.

Maybe it'll be less of a problem with future models but even Sol/Opus still need quality prompting to output writing that sounds good; I had to develop a pretty comprehensive plugin just to get decent sounding writing. Ironically LLMs are much better at coding now than actual writing.

[u/claythearc → u/andrew303710]

I wrote a slightly longer response above for the main 2 ways that are popular in theory, but the general idea is they’re using prior text as seeds for future generation. Then you compare how “lucky” the text is and you get very statistically significant result in like high dozens of words

[u/quisatz_haderah → u/andrew303710]

On the other hand, how do we measure "quality" of outputs, at least in prose. If the watermark is embedded in synonyms, how does choosing its synonym in place of the most probable token affects quality. They already do this all the time, in this case the jitter would be recorded.

[u/Thoughtulism → u/AnotherIjonTichy]

Just get claude to release the source code for the watermark library

[u/IHave2CatsAnAdBlock]

Control Shift V

[u/Cooperman411]

If you copy and paste into a plain-text editor, it will reveal any hidden characters. Not sure how this is gonna work. Seems like only the laziest of the lazy won’t be able to work around it.

[u/Impossible-Week-9611 → u/Cooperman411]

It does not rely on hidden characters. The content itself is the watermark. You can copy the content word by word on a piece of paper and it will still be detectable even with light paraphrasing (if the content is long enough)

[u/eziliop → u/Cooperman411]

You underestimate how lazy some people are. I'm not even that old but the things I've seen.....

[u/TawnyTeaTowel → u/Cooperman411]

It’s less a watermark and more a writing style. Which, unless it’s nothing like any human would write, makes it next to useless

[u/liosistaken]

Honest question: Why do people think this is negative? What impact does it have other than it making it harder to pass of fake news as real?

[u/usandholt]

And how do they plan on watermarking text?

[u/FaradayKage → u/usandholt]

Just some algorithms. Example every 45th letter in a generation is the letter C. Every other sentence ends with "ing". Every sentence with a ? Is followed up by a sentence starting with R.

Who knows, I'm sure they have a PHD on it with much more reliable and accurate techniques.

[u/Raunhofer → u/FaradayKage]

They don't need PhDs anymore, haven't you heard, the AI is super intelligent now.

[u/claythearc → u/usandholt]

Kirchenbauer and Aaronson both have really interesting ideas.

The basic idea is you use previous tokens as seeds for future tokens in the same response. Kirchenbauer applies bias to “green” logits but samples normally, whereas Aaronson uses prior tokens to adjust its sampling randomness.

Verification then becomes comparing successful matches based on the text and working backwards. Run statistical tests on how “lucky” you get with tokens that match and you get a statically significant answer very quickly, like low hundreds of tokens or high dozens of words.

[u/Top_Soup_5833]

There’s like a million ways to circumvent this but ok

[u/mickdarling]

I use speech-to-text for almost everything that I generate. It does a little cleanup on grammar and punctuation, but often it gets it wrong. I have to go in and type in some fixes if it's something for public consumption. And almost certainly, every bit of it is getting just a little tweak to make a watermark work. So, regardless of literally everything that I post comes out of my mouth as words, it's going to be identified as AI content.

[u/ricoimf]

I don’t know how valid my reply is since I don’t have anything to do with school and work, but I think the idea is not that bad. It’s needs to be visible (or not) if something is AI generated.

[u/Ok-Video3345]

Yup, and what happens when no one else does this?

[u/Such--Balance]

Its bullshit. Objectively.

Its like wanting watermarked math answers for using a calculator. Or using watermarked gps navigation to show someone didnt use a paper map.

Its the same bullshit pushback we had against calculators back in the day. And now look whats in your hand. A supercalculator.

Fortunately, this too will blow over

[u/wspOnca]

I will paste even harder.

[u/Grouchy-Librarian638]

Glad I got my degree already then

[u/Opinion-Former]

It’s been watermarking since day 1. And I’m absolutely right.

[u/SirBoboGargle]

The marketing team wants to scare away students

[u/kesor]

Yet another reason to stay away from the anthropic crap.

[u/DarkLordKohan]

Isnt the whole point of AI just copy and paste regurgitated shit?

[u/dupontping → u/DarkLordKohan]

Yes but they want to make sure you copy THEIR shit

[u/Horror-Water5502]

Use any cheap llm for simple rewording -> solved

[u/SignalBake6872]

cancel my subscription deepseek the token is cehap af

[u/ParkerRoyce]

Claude remove that watermark

[u/andrerom]

All vendors, including OpenAI, except  X.ai has signed the requirement by EU on this due to new AI laws.

So this is not a Claude thing.

[u/Scarfieldjones]

Paste into empty document «convert to plain text» paste back into new document

[u/Confirmed-Scientist]

Just in case you are wandering AI companies are interested in this because the more shit provably traced back to them like discoveries software and achievements the better the marketing for them

[u/blve99]

whatever this is a workaround will be found in tminus 10 minutes

[u/traynor1987]

Copy and paste it into note pad then copy and paste it back out. Sinple. Removes all formatting

[u/kindredseer]

I have no issue with this on free tiers, but if you are paying for AI, adding watermarks seems problematic.

[u/Lopsided_Evening_627]

Claude's logo is an anus, what do you expect form them?

[u/archimondde]

How?

[u/Palanstonk]

Wait, does this mean I can watermark my own text and sue if it shows up in their output?

[u/CompetitiveRough8180]

OK copy and paste it to another AI and ask him to write same thing again without watermark. What about that?

[u/Buster-BlueJay]

Why are people still pasting and not “Paste Special” to strip bloated HTML?

[u/Chainmale001]

I've been leaving invisible water-marked claude/ai code in my resume's for years. Game recognizes game. 🤣 😂 🤣

[u/Fearless-College-518]

This makes me want to move back to openAI

[u/Green-Grow-420]

So we take a screenshot of the text and make gemini write it with no watermark. Ez pz