>I'd like to know a lot more about how that works.

My guess is that it works like Gemini's SynthID: by altering the logprobs of the next token.

Like, for every 10th token, instead of outputting the most probable, it outputs the 17th most probable, or something. (Obviously it's way more complicated but I think conceptually this is how it works.) No human will notice this, but a classifier trained on Claude's output will.

So it's not like the watermark is the words "le epic bacon" and Claude will output "le epic bacon" in everything. That would be extremely annoying (and easy to defeat).

It was quick :) … https://claudewatermarkremover.app/

Most likely this method https://arxiv.org/pdf/2301.10226 (EDIT: and Google's SynthID paper which builds on it https://www.nature.com/articles/s41586-024-08025-4)

> I'd like to know a lot more about how that works.

Count load-bearing words using two different algorithms in a belt-and-braces fashion

Maybe there is a reason why Opus 5 produces such word salad conversations

What happens if someone handwrites a Claude output, then someone uses that handwritten text as a reference. Now you've got a watermarked idea which may have no direct linkage to the usage of Claude.

It will just thread some load-bearing seams through the paragraphs.

> have some kind of weird pattern baked into their text to act as a watermark.

public abstract class BaseAnimalBeanFactoryGeneratedFromClaudeFactory

Most likely watermark will be proportional to the input/output ratio, i.e. if you input a long document and ask to make edits, it will not attempt to watermark it. On the other hand, if you provide a tweet and ask it to write an article, that will include watermark. Just a guess (and yes, it feels flawed)

Load-bearing==claude

I can tell you how: Claude produces a huge wall of text with jargon ridden bullshit and invented terms no human subject matter expert would seriously use and overuse.

There's a computerphile video (https://www.youtube.com/watch?v=XZJc1p6RE78) with Dr. Mark Pound explaining a paper by John Kirchenbauer, Jonas Geiping et al. (https://arxiv.org/abs/2301.10226) that described a method for watermarking LLM output like this. It's not directly stated anywhere in the Claude support article that this is what they're using, but the properties of the watermark described seem to point to this method.

Based on my understanding, it can only be applied to code in very limited ways: docstrings, variable names, string literals. The code itself can't really have tokens changed to another equally correct token (the foundation of the watermark) because then the code breaks! And the few places that you can do so are likely erased by formatters anyway.

> a defined RNG, seeded somehow predictably

So, an NG?

If it's based on position mod 2, wouldn't inserting or deleting (or splitting/merging) words every now and then trivially defeat it?

If it is based on position mod 2 then wouldn't inserting/deleting (or splitting and merging) words every now and then defeat it?

They aren't using greedy decoding, there's enough randomness in sampling to swap some with independent signal.

I had a similar thought but I assumed they leaned in because it improved performance on coding or something like that

It's pretty trivial to command it to not speak that way. That's one of the first things you should write into the prompt. What style you want it to write in. Make it use a very concise and dry academic style with no overt LLMisms, melodramatic or flowery language, or metacommentary.

Have a look around for token biasing, or green lists. It's based on a nudge to the choice of the next token (which can always be drawn from a set of possibilities which are all probable enough).

At first I thought this approach was just the "LLM flavour" of writing, but it's way more subtle, especially as the bias is applied uniquely for each token position.

it's a statistical way. like for example maybe in your above paragraph claude maybe writes "Thus, I don't see how this wouldn't be insanely <easy>(instead of trivial) to remove" and then also says like "And this is before we <analyze> things being put on the clipboard." or maybe the i just says the word "the" in a certain pattern or frequency.

you can then consistently like figure out if it was claude that wrote the sentence. it is easy as you noted if you just get another ai to read it and then rewrite it.

Scott Aaronson spoke about this in a colloquium where he said that this was mooted at OpenAI before the decision was made by Altman to not implement it for the reasons you describe.

https://youtu.be/9udWn1Hlj_s?si=VWOiK5-y4zcyDoHI

I’m more worried that this will degrade performance. I want the best results from a model, not the results that fit a constraint that’s not defined by me. Any increased cost or latency is also unacceptable.

There are already small models trained specifically to prevent statistical detection, e.g., https://huggingface.co/kalpeshk2011/dipper-paraphraser-xxl

I guess whoever is the policy maker is assuming that some protection is better than none and that most people will not reach for such tools.

Either that or they want to comply with the EU AI Act when it affects them.

I hope all models adopt it.

The moment Google announced SynthID, the first domain I bought was deSynthID.com

Several open-source projects have already proven SynthID to be ineffective.

Yes, I’m audhd and dyslexic.

I am cancelling my Claude max 5x subscription and moving to ChatGPT pro. I have difficulty enough trying to ensure my meaning comes through correctly, along with everything else; to now have to look out for/analyse watermarks too?

I feel shamed enough by society, thanks Anthropic.

How exactly does this impact proofreading? You can manually apply the suggestions (typo here, unnatural sounding sentence there, etc.) the LLM gives you to your own content, and it would stay watermark-free.

Unless with "proofreading" you actually mean having the LLM write your content for you.

People with executive dysfunction too. LLMs bring execution costs down to near zero and are therefore assistive technology.

As long as they’re in the EU.

> Unless everyone runs their artifacts through some watermark and metadata sanitizer?

It will happen if Claude tampers the text. Guaranteed.

Text is too low bandwidth to classify reliably without lots of false positives. Especially as people start talking like LLMs.

The amount of times ‘delve’ appeared in general conversation in the last couple of years shows the influence LLMs have on society.

I have no idea why you were down voted for this. Language is alive and people adopt it from sources they hear a lot.

The flip side of this is that if AI-generated content becomes reliably identifiable and carries a stigma, then people might deliberately change their styles to be more diverse and human.

One example I've seen are junior employees at my company deliberately adopting a lowercase/less punctuation writing style so as to stand apart from AI.

If it's that simple and obvious, you'll have 10 "Remove Claude Watermark" web-apps by the end of Day 1. Most of them coded by Claude.

Hell, it'll probably happen no matter how sophisticated their watermark is. There's no watermark in text that can't be detected and removed, and no text that can't be converted to generic keyboard ASCII.

Those invisible spaces get wiped by the first sanitizer in any normal ide. Worse it'll instantly break parsing for configs like yaml where spaces are critical for structure

https://unicode-explorer.com/articles/space-characters

U+2800 or U+3164 would be nice.

But as I remove unwanted characters with grep before layout in InDesign, someone will make a skill for removing such space characters.

Reactionary emotional advice does no good, it just makes people want to hold their positions more defensively. If you care enough to say something, care enough to say it with reasons that might shift someone’s perspective.

What's the problem, really? Given the direction the U.S. has been heading in recent years, I wonder what really sets it apart from China. Europe needs to maintain an equal distance from both the U.S. and China.

If the Chinese want to sell to EU customers, they probably have to do the same.

I would love to see what this looks like in practice. Especially in generated code. I assume this is more than insertion of non visible special unicode whitespace characters, but more in the pattern of the text content itself?

Article specifically says "worldwide"

Panagram is a scam.