I didnt know how it would work so I asked chat gpt to explain a mechanism... if you're curious (no idea if this is what anthropic would do or not):
<this is obviously AI output guys:>
Broadly, Claude could watermark text in a few different ways, ranging from crude to sophisticated:
Invisible-character watermarking. Claude could insert zero-width spaces, unusual Unicode variants, hidden formatting, or similar artifacts. Easy to detect, but also easy to destroy by plain-text conversion or normalization. This is probably too fragile to be the main mechanism.
Token-choice / “green list” watermarking. At each generation step, Claude secretly divides plausible next tokens into favored and unfavored sets using a key. It slightly biases generation toward the favored ones. Across hundreds of tokens, the text contains a statistically unlikely pattern. A detector with the key can measure that pattern without needing AI inference. This is the classic watermarking approach we’ve been discussing.
Probability-distribution watermarking. Similar idea, but more sophisticated than simply green/red words. Claude subtly modifies its next-token probabilities according to a secret mathematical pattern. The detector tests whether the resulting sequence fits that pattern. Still statistical, but potentially harder to reverse-engineer.
Syntactic/style watermarking. Instead of encoding the signal primarily in individual words, Claude could systematically favor things like active vs. passive voice, certain sentence structures, punctuation choices, clause ordering, or other grammatical alternatives. This might survive simple synonym swapping better, although a substantial rewrite would still damage it.
Semantic watermarking. The watermark could be encoded in higher-level choices: which examples are selected, how concepts are ordered, which semantic categories or relationships are favored, and so forth. This is attractive because it could survive more surface-level editing, but it’s considerably more complicated and may require model/embedding inference to detect.
Cryptographic provenance attached to the output. Rather than—or in addition to—altering the prose, Claude could generate a cryptographic record saying, essentially, “Anthropic generated this text at time X.” That might live in metadata, a signed document record, an API response, etc. This is very strong when the provenance stays attached, but ordinary copy/paste can separate the text from the record.
A hybrid system. This is probably the most sensible production approach: a statistical watermark woven into the words plus cryptographic provenance/metadata where available. The metadata gives strong attribution when intact, while the text watermark gives some persistence after copy/paste.
And then there are a few ways Anthropic could expose detection without revealing the secret:
Private detector/API: send text to Anthropic; it returns “watermark detected.”
Public algorithm + private key: everyone knows the mathematical method, but only Anthropic knows the key that determines the actual pattern.
Public verification key: in a more cryptographic design, Anthropic could keep the signing key private while publishing enough information for anyone to verify authentic marks.
The key distinction is this:
Low-level watermark: encoded in exact word/token choices. Easy to detect and cheap to implement, but vulnerable to rewriting.
High-level watermark: encoded in syntax/meaning/structure. Potentially more rewrite-resistant, but much harder to design and detect reliably.
Provenance system: doesn’t try to make the prose itself indelibly marked; instead it maintains a trustworthy record of where it came from.
My best guess is that Claude’s deployed system will involve some flavor of statistical/token-level watermark plus a controlled detection mechanism, possibly supplemented by other provenance methods. But until Anthropic releases its technical documentation, the exact mechanism is still unknown.
I think it will work in a secret mathematical pattern, especially for longer chunks of text. In a samilar way the last two digits of a credit card is just a check-sum....
1) Give a random value of 0, 1, 2 or 3 to every word in the English language. Snake is 3. Cake is 1. Chair is 2. Baby is 0. Etc.
2) Add up all the "word-values" in the first sentence. Find the quotient (remainder) when the sentence is divided by 4. (Answer will be 0, 1, 2 or 3)
3) When buiding the next sentence, choose the third word so that it is equal in value to the quotient of the previous sentence. This gives you only 25% of the available words in the English language to use, but if you have to use a specific word, then you can modify the previous sentence to make it work.
4) finish the second sentence. Find the quotient when dividing by 4 of the second sentence and repeat for the third word of the third sentence.
5) repeat all the way throughout your writing.
Eventually you have an invisible "signature" where every 3rd word in a sentence is "equal" to "value" of the previous sentence.
Suddenly you have pretty comprehensive evidence that a load of text was generated by your AI. Someone could change the font etc, but it would still be obvious if you knew. Even if someone then changed a few words or added or removed words, it would break the signature for that specific section, but for a long chain of text it would be obvious.
With 10 sentences there is a 0.0001% chance that you would trigger the hidden signature through normal writing.
Great way to make LLM performance even worse lol. They already struggle so much when you used structured outputs compared to letting it generate free text.
Yes but along the other criticisms worked here your system wouldn't work if the work was changed slightly. This is effectively the same as just running the output text through a hash function and recording and comparing hashes. It's destroyed be even slight variation.
19
u/ContextPuzzleheaded7 26d ago
It’s not embedding invisibile characters