The information being encoded (the watermark) is the _relative ranking of each token compared to other possibilities_. If our prompt was "Write a positive review for a restaurant" and the response began:

"The restaurant "

Our next set of predictions might be:

[was, had, offers]

So we append the rank/index of the next token (0, 1, or 2) onto the secret. Given a long enough response, that secret becomes unique enough to use as a watermark. This obviously relies on having full deterministic access to the LLM itself, i.e. I don't believe it will be possible for users to derive the fingerprint from text that they've generated, only Anthropic will be able to.

The immediate objection is that this runs the risk of degrading the quality of the response. I think that's totally valid and I'll be curious how Anthropic handles it.

That's my very rough understanding! If someone with more knowledge wants to expand, feel free.

Supposedly you can avoid degradation by using synonyms. But not all words have synonyms. The more concrete and factual the prose, the harder it is to watermark. "Cow" is not a synonym for "cat" and "dark matter" is not a synonym for "galaxy."

So the watermark words will be biased towards filler and fluff where invisible substitutions are easier, and the content is less (cough...) load-bearing.

The likely outcome is the development of AI watermark strippers which filter out all the twitches and tells that make default AI writing so annoying.

Google seem to have given up on SynthID for text for now, so this is likely a harder problem than it looks. My guess is Anthropic announced this to meet regulatory requirements. But they don't have a robust detector, and I seriously doubt they have a robust system that can survive trivial rewriting by a different model.

Do we need the original prompt to recover the watermark?