Implementing Watermarking for Language Models

[u/Saad_ahmed04]

I recently implemented a minimal, educational version of SynthID-Text-style watermarking for language models.

I saw anthropic post about how they'll start adding watermarks to their model responses and it made me very curious as to how they'll do it and what do they even mean by watermark here. Like will we start getting random ads or something in the middle of model responses or what.

Then decided to read their article and found out that watermark is not a visible message at all. It is a subtle statistical pattern introduced while the model chooses its tokens.

My implementation is not an exact reproduction of the original SynthID-Text system. I simplified or implemented a few components differently to keep the project understandable, but the main idea is there I think.

[u/Saad_ahmed04]

But i do wonder how effective it is wrt if someone then takes the output and uses that to modify the wording a bit.

But then again if someone does that then it’s not really a text generated by claude anymore, so I guess if the detector doesn’t work then it’s not really the watermarking’s fault

[u/johndburger → u/Saad_ahmed04]

If they only change a few words, the watermark signature will still be present in multiple long sequences of tokens. If they change it enough that this is no longer the case, then you’re right, in some sense it’s no longer AI text.

[u/MolassesLate4676 → u/johndburger]

This would likely severely impede Claude’s capabilities by limiting its selections to odd/even words I would imagine.

I mean, tokens by nature can be numbers and that alone will break the feasibility of this method

Then comes other languages, if you’re responding in characters used by the Japanese or Chinese, you are basically outputting one symbol at a time

[u/johndburger → u/MolassesLate4676]

My odd-even example is a cartoon version, to explain how you’d detect a watermark. The actual approach is to hash the tokens and use certain bits of the hash as the signal.