Text AI watermarks will always be trivial to remove

clemlesne 2 minutes ago | parent | next [-]

I done a C2PA implementation for raw text, if that can ease someone’s life: https://github.com/dualeai/c2patxt

andy_xor_andrew 24 minutes ago | parent | prev | next [-]

The article mentions you can always simply use a smaller, local, un-watermarked LLM to rephrase the original watermarked text. Which is true, sure.

But if we're talking about deterministically taking some watermarked LLM output and having a function removeWatermark(text), it won't necessarily be "trivial" to remove, because the watermark function itself need not be public. Only the API that tests for the watermark need be public, right?

Anthropic's magic watermark could be, like the article mentions, something like "every 7th semicolon has a N% chance to be a comma where N is the sum of the last X characters mod Y, and every character in the bit range q1...q2 has a Z% chance to..." etc etc etc. And if Anthropic controls those variables, it would be very difficult to determine the rule, even with some pretty advanced analysis (I would assume). And keep in mind, that example rule I mentioned is pretty naive, too. I expect the actual rule would be way more advanced and not so straightforward as "swap every <charX> for a <charY>"

	▲	johnjwang 13 minutes ago \| parent \| next [-]
		There exist methods to detect what kind of watermarking tool that someone is using, and most of the big tools have specific signatures that you can look for. For Anthropic, it’s highly likely that the watermark is a SynthID type mark similar to the one that Sean is talking about (I actually ran the analysis here https://johnjwang.com/post/2026/08/12/how-claude-watermarkin...). When we get confirmation of whether all models actually are watermarked, I think we’ll be even more confident. Of course it’s always possible that Anthropic has come up with a proprietary scheme, but I think it’s definitely harder to implement. I think the game will be a cat and mouse game similar to LinkedIn and other websites trying to block scrapers: each iteration makes it harder for someone to figure out the watermarking scheme, but likely not impossible
	▲	cayleyh 21 minutes ago \| parent \| prev [-]
		It could be, but common, we all know that Anthropic's watermark is the using "load bearing", "genuine", and "seam" 1000x more in the same paragraph than any human in history.

▲

firefoxd 29 minutes ago | parent | prev | next [-]

I feel like this is going to end up being like cookie laws. It sounds good, I don't know how any one benefits from it.

Currently I can recognize AI text because I read thousands of ai generated text. I know that 110% of yahoo finance news is generated. I don't want to read an AI generated personal blog, but if I do what's the problem really? Other than the companies distinguishing AI text for getting better training data, how do people benefit from watermarked text exactly?

▲

happytoexplain 31 minutes ago | parent | prev | next [-]

Yeah, but it's better than nothing.

People underestimate the value of rules that only take malice and a little knowledge to break.

	▲	JoshTriplett 10 minutes ago \| parent [-]
		Exactly. If this works on pull requests, for instance, it'd be really useful for projects trying to do a first-pass filter to close slop spam.

▲

ch_sm an hour ago | parent | prev | next [-]

here‘s what i don‘t get about this whole discussion. AI companies already store all prompts and responses for future training.

just make an API that returns the string distance between a previously generated paragraph and the query?

that would sidestep this whole problem class.

regulators could even specify how that has to work.

what am i missing?

▲

dpoloncsak 44 minutes ago | parent [-]

Local models?

▲

dTal 30 minutes ago | parent [-]

Local models enable:

- watermark-free generation

- the stripping of watermarking from the output of SAAS models

Any discussion of watermarking is dead in the water in a world where we are permitted to have these things. I fear for the future.

	▲	thisoneworks 17 minutes ago \| parent [-]
		Chill my dude. This is just a sane default which will catch normies copy pasting stuff from claude and chatgpt. It's good enough.

▲

ramesh31 38 minutes ago | parent | prev [-]

Yeah but it's like saying "Masterlocks will always be easy to pop off with a hammer". Of course, but by doing so you are actively engaging in fraud, which then puts the onus on you and whoever you are attempting to deceive.

▲

buf 37 minutes ago | parent [-]

Except this isn't like saying that at all. This isn't fraud, because it's legal in almost every circumstance.

▲

ramesh31 34 minutes ago | parent [-]

>almost every circumstance

Key phrase. And I'm not saying fraud in the legal liability sense. If you're not trying to hide the fact that something was LLM generated, then you have no reason to remove it. If you are trying to hide it, then there's probably a reason, i.e. you would face consequences for doing so, therefore it is fraud.

	▲	burnte 25 minutes ago \| parent [-]
		Or, you simply edit the text the LLM generated ruining the hidden message. That's not even remotely fraud. There are legitimate reasons to edit text. There are fewer legit reasons to bash off someone else's lock with a hammer.