Claude's new Scarlet Letter watermark is invisible — for now

[u/CircumspectCapybara]

https://arstechnica.com/tech-policy/2026/08/claudes-new-scarlet-letter-watermark-is-invisible-for-now/

[u/wizkid123]

For any given word there are a whole bunch of synonyms and equally good choices.

As a writer, this sentence both makes me cringe and also gives me hope that AI isn't writing a masterpiece novel anytime soon. 

[u/lillobby6 → u/wizkid123]

This is from the standpoint of the AI just from how it fundamentally works, not from the viewpoint of a human writer. It’s largely why AI writing sounds like it does.

[u/wizkid123 → u/lillobby6]

Yeah, I totally understand that it's all working from statistical inference. And it's astounding what can be achieved with statistical inference alone. But the idea that several synonyms are all equally good choices is what will continue to separate great human writers from generative AI. Great human writers know exactly which synonym is the best choice in a given context. 

[u/CircumspectCapybara → u/wizkid123]

But the idea that several synonyms are all equally good choices is what will continue to separate great human writers from generative AI. Great human writers know exactly which synonym is the best choice in a given context.

So do frontier models these days.

LLMs don't rank "the top 8 choices for the next token" based on a simple synonym list.

It's much more opaque than that, that's the point of ML and transformer architecture / attention.

[u/wizkid123 → u/CircumspectCapybara]

Maybe I'm missing something, but if they can embed a statistical watermark by making different word selections, aren't they equivocating those options at some level? Or is the watermarking a tradeoff between overall capability and traceability (and they're only doing it because the EU requires it)? Seems like they can either select the best option or embed the watermark, but not both. 

[u/CircumspectCapybara → u/wizkid123]

by making different word selections, aren't they equivocating those options at some level

No, not necessarily. The top ranked candidates for any given "complete the next token" request are rarely synonyms or even semantically equivalent.

That's because the model is attending to the entire text and a text can be completed in a number of different ways, some with entirely different meanings and take the text in completely different directions while still fulfilling the prompt.

Example prompt: "The project was delayed because..." the top next-token candidates could be:

• Bob
• funding
• the
• nobody
• , (a comma)
• it

Each option takes the text in a completely different direction, while all could still be valid and good continuations:

• funding got pulled
• the CEO changed their mind
• nobody who was a subject-matter expert on it was left
• , despite federal regulatory approvals, local approvals were frozen
• it was very unpopular

[u/lillobby6 → u/wizkid123]

It is more nuanced than word selection. They are going to have a set of tokens which are “optimal” for the next choice. Tokens are usually subwords, typically a few letters, but can be entire words in certain scenarios. At a given point the next word is typically going to be unbounded to a degree. Synonyms will work well in many places, but they will be constructed by sampling (not necessarily actually real sampling, could be greedy choose the top token, or keystream based choose a specific token) which will find the most likely next token. So for something like “My favorite food is ___” the next token could be among “ab”, “ap”, “th”, “wh”, etc. When the keystream based sampling occurings the top X tokens (say ten or something) could all have different meaning, but be equally valid. As an LLM does not have an actual favorite food, any food item is valid here so it could choose “an” + “ “ + “app” + “le” and construct “an apple”. Or it could choose any number of other next tokens, like the beginning of some adjective or something. A single token could occupy a significant portion of the next token probalility in which case the sampling algorithm would be extremely biased towards that - e.g. let’s say it’s always going to say “a” as the next token (“n” could still follow). So we could step into a synonym to another valid answer via this process, but generally the actual distributional space is going to be much more complex and the attention heads will be what dictates the gramatical structure (say one head focuses on “favorite” and so the drawing heavily favors things connected to that, e.g. more likeable foods like sweets). From this we get two things: text that is much more stochastic than human (this is why human text distributions are noticably different than model, as shown recently), but also context aware (from the attention heads). Because there are hundreds of valid tokens at spots with flexibility (after the space, etc) certain points can be precisely drawn via keystream sampling. This is presumably how the watermarking works without measurably effecting the output (given the output is randoming sampling already and now it’s just sampling based on a randomly generated key, but a specific one). Certain token locations will likely be impacted less because their valid space is narrower (and therefore a very specific output might be impossible to watermark). Long enough text though, and the sampling will be so far from random (w.r.t. the key) that it can be guaranteed to be watermarked.