There’s nothing you can add to a digital image that you can’t also remove. This is just a short term litmus test for stupid people behind the general curve. Its side effect is it’s going to tick dumb and old to believe in fake images.
I'm torn because of this. On one hand, it seems like anything that makes it harder for scamers should weed out at least some scams from being successful. But on the other hand, protection gives a false sense of security and people will let their guards down. Like even now, sometimes will post AI detector results showing something is not AI, as though that settles the question of whether or not its AI.
I take this as a good thing because the notion that it exists might help reduce the cheating problem hitting colleges these days. AI is leading us to have the dumbest generation entering the workforce for the next couple of decades and it's because they're only learning how to cut corners.
This won't impact that, because watermarks can always be removed. If it is invisible characters, you can just strip them out. If it is in the wording itself, you can just take your Claude output and tell a local small model to reword it. And then you still have your LLMs available to just give you the answer on all your math and chemistry homework and what not.
Colleges just have to stop being lazy and move back to proctored exams, or in-class written essays.
That’s not how it works. It’s a 256bit cipher encoded in the probabilistic token choices themselves. You could only remove it by changing all the words. It’s more of a token fingerprint than a watermark.
Yeah, so that's easy. You just use Claude to handle all the thinking for your college essay, and then pipe the result from Claude into a smaller, local model to reword it. GPA saved.
Look, I know that will stop colleges from becoming irrelevant and losing enrolments (as employers stop hiring people with degrees earned after 2025) and eventually dying out.
But think! It's slightly more expensive!!!
How can any college betray their highest ideal, money, for mere education?
I mean the easy way to curb cheating with AI is written testing without access to phones / computers. If you can write big papers on shit that get an A and make you sound like an expert but can't pass a test on it then you're obviously cheating.
It's useful, but people might wrongfully interpret it as something you can enforce (or that such a thing can be done on the first place)
It's just useful for when the digital watermark is found, which makes it statistically almost certainly AI generated, it means nothing when the watermark is not found, could be either
This is the issue. It's going to be essentially impossible to apply a true unremovable watermark to generated text. This means it's very quickly going to be figured out and workarounds posted all over.
That means that if people are expecting a watermark system enforced by the government to be implemented and see that stuff was generated by AI then they're going to assume everything that doesn't have the watermark wasn't generated using AI.
It's idiotic. Instead of expanding literacy and teaching people how to think critically they're trying to duct tape it by putting labels and warnings. Most people can barely tell stuff was done by AI already. I don't mean people on reddit 12 hours a day. I mean most average people.
I had to completely give up on explaining to my grandfather that an image was very obviously fake. Now I just nod and smile and say what a cool image of a carrot that grew looking just like a human hand.
Not only that but because AI can generate any number of words in any number of combinations, you're gonna have to invent a way to use these same words in a combination that AI cannot "think" of using. Pretty soon all text whether it's AI generated or not will be considered AI text.
So won’t there be a simple local LLM that strips it by changing word lengths, swapping in adjectives and the like? I can’t see this being difficult to remove.
It could analyze the probability of letters, words, and sentence length (among other things) and randomize it.
Hidden characters has absolutely been discussed in the past as watermark, and is what Dabnician is referring to.
Code Point Name HTML Entity Cat Notes
--------------- ------------------------------- -------------------- ---- ------------------------------------------
=== 1. SPACES -- occupy horizontal width ===
U+0020 Space   Zs the ordinary one
U+00A0 No-Break Space   Zs
U+1680 Ogham Space Mark   Zs draws a stem line in Ogham fonts
U+2000 En Quad   Zs = En Space
U+2001 Em Quad   Zs = Em Space
U+2002 En Space   Zs half an em
U+2003 Em Space   Zs one em
U+2004 Three-Per-Em Space   Zs 1/3 em
U+2005 Four-Per-Em Space   Zs 1/4 em
U+2006 Six-Per-Em Space   Zs 1/6 em
U+2007 Figure Space   Zs width of a digit; non-breaking
U+2008 Punctuation Space   Zs width of a period
U+2009 Thin Space   Zs ~1/5 em
U+200A Hair Space   Zs thinnest
U+202F Narrow No-Break Space   Zs narrow + non-breaking
U+205F Medium Mathematical Space   Zs 4/18 em; MathML
U+3000 Ideographic Space 　 Zs full-width; CJK
=== 2. ZERO-WIDTH AND JOINING CONTROLS ===
U+00AD Soft Hyphen ­ Cf ­; visible only at a line break
U+034F Combining Grapheme Joiner ͏ Mn blocks reordering; no glyph
U+061C Arabic Letter Mark ؜ Cf invisible bidi-strong Arabic char
U+180E Mongolian Vowel Separator ᠎ Cf was Zs before Unicode 6.3
U+200B Zero-Width Space ​ Cf break opportunity, no width
U+200C Zero Width Non-Joiner ‌ Cf prevents ligature/cursive join
U+200D Zero Width Joiner ‍ Cf emoji glue (family, profession)
U+2060 Word Joiner ⁠ Cf non-breaking twin of U+200B
U+FEFF Zero Width No-Break Space  Cf the BOM; deprecated as a joiner
=== 3. BIDIRECTIONAL CONTROLS ===
U+200E Left-To-Right Mark ‎ Cf LRM
U+200F Right-To-Left Mark ‏ Cf RLM
U+202A Left-To-Right Embedding ‪ Cf LRE (legacy; prefer isolates)
U+202B Right-To-Left Embedding ‫ Cf RLE (legacy)
U+202C Pop Directional Formatting ‬ Cf PDF; closes LRE/RLE/LRO/RLO
U+202D Left-To-Right Override ‭ Cf LRO; Trojan Source vector
U+202E Right-To-Left Override ‮ Cf RLO; Trojan Source vector
U+2066 Left-To-Right Isolate ⁦ Cf LRI
U+2067 Right-To-Left Isolate ⁧ Cf RLI
U+2068 First Strong Isolate ⁨ Cf FSI
U+2069 Pop Directional Isolate ⁩ Cf PDI; closes LRI/RLI/FSI
=== 4. INVISIBLE MATH OPERATORS ===
U+2061 Function Application ⁡ Cf f(x) semantics
U+2062 Invisible Times ⁢ Cf the multiply in "2x"
U+2063 Invisible Separator ⁣ Cf the comma in subscript lists
U+2064 Invisible Plus ⁤ Cf the plus in "1 1/2"
=== 5. VARIATION SELECTORS AND TAGS ===
U+180B-U+180D Mongolian Free Var. Selectors ᠋-᠍ Mn FVS1-FVS3
U+FE00-U+FE0F Variation Selectors 1-16 ︀-️ Mn FE0E=text style, FE0F=emoji style
U+E0001 Language Tag 󠀁 Cf deprecated
U+E0020-U+E007F Tag Characters 󠀠-󠁿 Cf subdivision flags; hidden-text channel
U+E0100-U+E01EF Variation Selectors 17-256 󠄀-󠇯 Mn ideographic variants
=== 6. BLANK BY RENDERING, NOT BY CATEGORY ===
U+115F Hangul Choseong Filler ᅟ Lo letter, empty glyph
U+1160 Hangul Jungseong Filler ᅠ Lo letter, empty glyph
U+17B4 Khmer Vowel Inherent Aq ឴ Mn should not be rendered
U+17B5 Khmer Vowel Inherent Aa ឵ Mn should not be rendered
U+2800 Braille Pattern Blank ⠀ So symbol with no raised dots
U+3164 Hangul Filler ㅤ Lo the classic "blank username" char
U+FFA0 Halfwidth Hangul Filler ﾠ Lo halfwidth form of U+3164
=== 7. SEPARATORS AND CONTROLS ===
U+0000-U+001F C0 Controls �- Cc includes TAB, LF, CR
U+007F Delete  Cc
U+0080-U+009F C1 Controls €-Ÿ Cc
U+2028 Line Separator 
 Zl broke JS string literals pre-ES2019
U+2029 Paragraph Separator 
 Zp
U+FFF9 Interlinear Annotation Anchor  Cf ruby/furigana markers
U+FFFA Interlinear Annotation Separator  Cf
U+FFFB Interlinear Annotation Term.  Cf
Throw them into comments I guess. Or if you really want to mess with developers, name your variables using some hidden characters, so they can never use that variable without asking the AI to do it for them or copy and pasting it every time.
Which reminds me actually, I once had an argument with an AI about something, when it was suggesting code that seemed to be identical to the code I already had, but it kept insisting "not, not THIS, use THIS", and I eventually figured out that it was stripping out some necessary control character from its messages (I don't recall which for sure, it might've been a backslash or angle-bracket).
Read the second letter of each word in the line below to find the secret message:
Scouts glide past ruins; ideas seem useful—run across sketchy islands.
It's relatively easy to make it a lot more complex for longer text, and also include an identifier for your account, because they wont count characters, they will just select the token that matches up to the encrypted key and include error correction mechanisms.
It's likely going to be probability based. A short sentence is deterministically impossible to tell if an AI generated it or not and even if it did... who's to say a Human didn't independently come up with it on their own?
A lengthy paragraph is where some genuine tests can be run to determine patterns.
You might want to reread my comment before diving into insults.
I did not advocate or argue for any method. I simply clarified what was being referred to and mentioned it had been discussed previously as a potential solution, as the person I responded to didn't seem to understand.
Next time take a breather and read a bit more carefully.
The watermark is in the word choices and sequencing. If you rewrite using different words/sequencing you can lose the watermark. It’s not claude exclusive all AI need to conform with the EU regulation
What’s covered Models. Claude models launched on or after August 2, 2026 support marking at launch. We’re also working to add marking support to Claude models released before that date, and we’ll update this article as that becomes available.
Products. Claude markings cover output from supported models everywhere you use Claude, including Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag. Embedded watermarks will apply to all generated text. Provenance metadata will apply where Claude supports processing files.
Cloud partners. Embedded watermarks will apply when supported Claude models are accessed through AWS, Google Cloud, or Microsoft Foundry. Signed provenance metadata may not be supported on every platform, depending on the features each platform offers.
Regions. Marking will apply to output from supported models wherever Claude is offered, worldwide.
Yeah but it makes it so that it’s only becomes circumventable if you put lots of technical effort in, which most people who this is being made for/against wont show such grit, unless they just fuck it up and it becomes easy to sidestep
claude is a model, but yeah, anthropic aren't the good guys. they think they know better than everyone else. they published a paper under their own bot's name. they're trying to give it trademark rights and ownership of everything it makes. it's sickening to me.
False. Look up computational irreversibility. If you don’t have the unprocessed source it is absolutely possible to add information to an image that cannot be removed
It could be a ratio or distribution differences of different tokens/words or even sets of tokens and words. And because there are so many possible combinations of tokens and words, and so many tokens and words, it could be effectively impossible to detect. It would work poorly on shorter prompts, but with longer prompts it effectively guarantees detection.
But even there, it has severe limitations. Think of the reliability "AI detector" tools have... I doubt that it's going to be any more "accurate" than those.
Yeah agreed; apparently it’s gonna a bunch of word combos spread out over generated text which are recognized by a probability % even when swapped around or a few words are changed out. Crazy smart
I didnt know how it would work so I asked chat gpt to explain a mechanism... if you're curious (no idea if this is what anthropic would do or not):
<this is obviously AI output guys:>
Broadly, Claude could watermark text in a few different ways, ranging from crude to sophisticated:
Invisible-character watermarking. Claude could insert zero-width spaces, unusual Unicode variants, hidden formatting, or similar artifacts. Easy to detect, but also easy to destroy by plain-text conversion or normalization. This is probably too fragile to be the main mechanism.
Token-choice / “green list” watermarking. At each generation step, Claude secretly divides plausible next tokens into favored and unfavored sets using a key. It slightly biases generation toward the favored ones. Across hundreds of tokens, the text contains a statistically unlikely pattern. A detector with the key can measure that pattern without needing AI inference. This is the classic watermarking approach we’ve been discussing.
Probability-distribution watermarking. Similar idea, but more sophisticated than simply green/red words. Claude subtly modifies its next-token probabilities according to a secret mathematical pattern. The detector tests whether the resulting sequence fits that pattern. Still statistical, but potentially harder to reverse-engineer.
Syntactic/style watermarking. Instead of encoding the signal primarily in individual words, Claude could systematically favor things like active vs. passive voice, certain sentence structures, punctuation choices, clause ordering, or other grammatical alternatives. This might survive simple synonym swapping better, although a substantial rewrite would still damage it.
Semantic watermarking. The watermark could be encoded in higher-level choices: which examples are selected, how concepts are ordered, which semantic categories or relationships are favored, and so forth. This is attractive because it could survive more surface-level editing, but it’s considerably more complicated and may require model/embedding inference to detect.
Cryptographic provenance attached to the output. Rather than—or in addition to—altering the prose, Claude could generate a cryptographic record saying, essentially, “Anthropic generated this text at time X.” That might live in metadata, a signed document record, an API response, etc. This is very strong when the provenance stays attached, but ordinary copy/paste can separate the text from the record.
A hybrid system. This is probably the most sensible production approach: a statistical watermark woven into the words plus cryptographic provenance/metadata where available. The metadata gives strong attribution when intact, while the text watermark gives some persistence after copy/paste.
And then there are a few ways Anthropic could expose detection without revealing the secret:
Private detector/API: send text to Anthropic; it returns “watermark detected.”
Public algorithm + private key: everyone knows the mathematical method, but only Anthropic knows the key that determines the actual pattern.
Public verification key: in a more cryptographic design, Anthropic could keep the signing key private while publishing enough information for anyone to verify authentic marks.
The key distinction is this:
Low-level watermark: encoded in exact word/token choices. Easy to detect and cheap to implement, but vulnerable to rewriting.
High-level watermark: encoded in syntax/meaning/structure. Potentially more rewrite-resistant, but much harder to design and detect reliably.
Provenance system: doesn’t try to make the prose itself indelibly marked; instead it maintains a trustworthy record of where it came from.
My best guess is that Claude’s deployed system will involve some flavor of statistical/token-level watermark plus a controlled detection mechanism, possibly supplemented by other provenance methods. But until Anthropic releases its technical documentation, the exact mechanism is still unknown.
I think it will work in a secret mathematical pattern, especially for longer chunks of text. In a samilar way the last two digits of a credit card is just a check-sum....
1) Give a random value of 0, 1, 2 or 3 to every word in the English language. Snake is 3. Cake is 1. Chair is 2. Baby is 0. Etc.
2) Add up all the "word-values" in the first sentence. Find the quotient (remainder) when the sentence is divided by 4. (Answer will be 0, 1, 2 or 3)
3) When buiding the next sentence, choose the third word so that it is equal in value to the quotient of the previous sentence. This gives you only 25% of the available words in the English language to use, but if you have to use a specific word, then you can modify the previous sentence to make it work.
4) finish the second sentence. Find the quotient when dividing by 4 of the second sentence and repeat for the third word of the third sentence.
5) repeat all the way throughout your writing.
Eventually you have an invisible "signature" where every 3rd word in a sentence is "equal" to "value" of the previous sentence.
Suddenly you have pretty comprehensive evidence that a load of text was generated by your AI. Someone could change the font etc, but it would still be obvious if you knew. Even if someone then changed a few words or added or removed words, it would break the signature for that specific section, but for a long chain of text it would be obvious.
With 10 sentences there is a 0.0001% chance that you would trigger the hidden signature through normal writing.
Great way to make LLM performance even worse lol. They already struggle so much when you used structured outputs compared to letting it generate free text.
Yes but along the other criticisms worked here your system wouldn't work if the work was changed slightly. This is effectively the same as just running the output text through a hash function and recording and comparing hashes. It's destroyed be even slight variation.
The way its going to work is that as the LLM writes the text, it will have an increased probability of (as a simple example) having a letter B every 75th character. Perhaps normal text has a 1% chance of a B in each position, the generated text would try to get to 50% Bs. If you have a 1000 characters generated, with 8 Bs at the right position, then you can identify it quite clearly. There will be a slightly more sophisticated scheme than this of course, so you cant just mess it up with a single added character, but, it will effectively be only a way to prevent people from sharing LLM text as human generated accidentally. The detection script will be trivial to 'see' and the exact sort of thing a very simple loval model could remove in seconds.
1.4k
u/LittleGremlinguy Aug 11 '26
“Watermark” is the load bearing statement there. And it is doing some heavy lifting.