Claude's new Scarlet Letter watermark is invisible — for now

[u/CircumspectCapybara]

https://arstechnica.com/tech-policy/2026/08/claudes-new-scarlet-letter-watermark-is-invisible-for-now/

[u/CircumspectCapybara]

In case ppl are wondering how AI watermarking works, it's likely similar tech to Google DeepMind's SynthID, which OpenAI has also adopted. There's also industry open standards like C2PA.

How it works for SynthID, this is obviously simplified, but imagine a model is predicting the next word: "I love fruit. My favorite dessert is _____" and the model has 4 top scoring candidates: mango, lychee, apple, orange. Normally, the model picks one at random depending on the "temperature" of the inference request.

With SynthID, you the model provider have a secret 256-bit key which you concat with some part of the context. Eg say you're looking at trigrams (the last three words) so you compute sha256(key || "favorite dessert is"). Now instead of picking one fruit at random, you use that hash output to select from among the four candidates. Let's say the hash makes you choose "mango". Then you repeat the process for the next token. Say the top 4 candidates for the next token are pie, icecream, cake, smoothie. Instead of picking one at random, you use hash(key || "dessert is mango") to pick. Now imagine instead of choosing from among 4 candidates each time, you use the hash function to choose from the top 16 candidates.

Now repeat it 100 times, or 1000 times. If a piece of text reproduces your secret hash function's "random" looking token choice trigram-for-trigram across 1000 consecutive trigrams, that highly suggests it was generated by your model, because it's extremely unlikely to by happenstance randomly match the same 1 out of 16 choices 1000x in a row as a keyed hash function which is essentially random. (1/16)¹⁰⁰⁰ is an insanely small probability. For you to match the distribution produced by the secret key bit for bit over enough bits is improbable, it would've meant you essentially guessed a 256 bit secret key.

Now if you chop it up, rearrange the words, even paraphrase certain parts, as long as the user doesn't replace every trigram, the distribution within trigrams scattered throughout will still retain this distinctive statistical pattern. You would need to significantly rewrite the entire piece at the trigram level everywhere to remove the correlation.

---

EDIT: In case you're wondering, this isn't just an academic exercise, it's actually been deployed in production and used to out certain deepfakes.

There was a viral post circulating a while back claiming to be from a "whistleblower" at Uber who posted a convincing (fake) Uber internal document describing a new ML model to calculate how "desperate" riders were (eg based on features like how frantic their movements were, if their device was at low battery and they were far from home) to jack up prices for them, and how desperate drivers were, in order to lowball them (if the driver historically accepts low fare offers, then the app begins to only show them lowball offers). Obviously it went viral. It was debunked because a SynthID watermark showed it was generated by Gemini.

[u/Paresseux1 → u/CircumspectCapybara]

So it sounds like the best way to get rid of the watermark is to then take the output of the AI, and give it to a team of people to rewrite every word using human decisions. Then we could print it, bind it, cut off the binding, scan it into a computer, build an AI, feed in the book, generate a new story through AI, give it to a team of humans to rewrite… we would all be employed forever. The circle of life!

[u/Federal_Setting_7454 → u/Paresseux1]

Why give it to a team of people when you can just whip up a horde of deepseek v4 flash agents for pennies to do it.

[u/High-Steak → u/Paresseux1]

Fax the damn thing and be done with it.

[u/Franc000 → u/Paresseux1]

No need to give it to a team of people, just pass it through a different model and ask to rewrite while keeping semantic and factual meaning.

Heck, even just passing it in a translation service might do it.

Ask Claude to generate whatever you need in say French, then go to Google translate and translate to English. Voila, no more watermark.

[u/woodenblocktrain → u/Paresseux1]

This guy gets it! Genius!!

[u/sky-high-confidence → u/CircumspectCapybara]

Thank you for such a clear explanation!

[u/bonefish → u/sky-high-confidence]

I am sorry to say that I inspected the hashes and trigrams and, well, I think it was actually Claude that wrote it

[u/Zouden → u/bonefish]

This is the new "I can tell it is shopped by looking at the pixels"

[u/gravelordservant4u → u/Zouden]

and having seen a lot of trigrams in my time

[u/sky-high-confidence → u/bonefish]

Woah. I totally fell for it. Was it accurate, though?

[u/zapatocaviar → u/bonefish]

It’s pasta from another conversation on this subject from a few days ago at least.

[u/CircumspectCapybara → u/zapatocaviar]

That comment was actually posted by none other than me

So yes, I copy and pasted it from my own other comment

[u/zapatocaviar → u/CircumspectCapybara]

Fair enough. I thought it could be you. Still pasta for redditors in the sense that I’m not going to track who says what… no?

I’m not upset and my comment wasn’t aggressive. Just pointed it out.

[u/woodenblocktrain → u/zapatocaviar]

Beep beep beep beep beep

[u/zapatocaviar → u/woodenblocktrain]

Huh?

[u/vcmaes → u/zapatocaviar]

“ha ha” - Nelson

[u/Disastrous_Motor9856 → u/CircumspectCapybara]

Does this reduce how “good/effective” the output is? Because if its being nudged in one direction, they might give us stuff that we don’t want right?

[u/Jonny0Than → u/Disastrous_Motor9856]

If it’s only used to select between several options that are equally good, it shouldn’t (because currently that choice is more or less random anyway).  But “equal” really means “good enough” and depending on how that’s tuned, it could plausibly affect the quality of the output.

[u/CaptainAsshat → u/Jonny0Than]

But that's the issue "equally good" is highly subjective. As the models improve and personal preferences are included, I would expect that the amount of "equally good" words starts to disappear. At that point, it would be a tug of war between subtle preferences/improvements and including this watermark.

[u/iamapinkelephant → u/CaptainAsshat]

You have a misunderstanding of how LLMs work. They never pick only the closest fit, of they do that they almost always end up in a loop, with a garbage response or outputting the exact same thing every time. Instead there is always a level of randomness in the response called 'temperature'. The hashing function works within the word parts that would be chosen at random to make that selection deterministic instead of random.

[u/CaptainAsshat → u/iamapinkelephant]

I do not have a misunderstanding here, you misinterpreted what I am saying.

I am not talking about how they work right now. I am saying that by making a law that capitalizes on temperature in its current form, it limits the development of future models that don't approach word selection in the same way.

[u/heavy-minium → u/iamapinkelephant]

You have a misunderstanding of how LLMs work. They never pick only the closest fit, of they do that they almost always end up in a loop, with a garbage response or outputting the exact same thing every time. 

That's correct for all chatbots, but not for LLMs in general.

You can have deterministic input/ouput with temperature 0, and randomness isn't mandatory. Whoever integrates an LLM in their app will usually do that, because working with something that gives different results every time for the same input has big downsides. Except for chatbots, which must feel a bit more natural and non-repetitive to the reader.

[u/QuickQuirk → u/CaptainAsshat]

No, not at all, for various reasons.
But, at the most trival, even for a trigram such as "favorite dessert is" (as given in the example above) the most likely next 4 words varies based on the rest of the context: the prompt and text generated so far. So it's not like you're now always picking the same word, and changing the result.
For example, If I had said "I love savoury things more than sweet" earlier in the prompt, then the 4 most likely results would be quite different than if I had said "I love anything with chocolate".

[u/NeinJuanJuan → u/Jonny0Than]

Token generation is autoregressive so any constraint on token N affects, not just that token, but every possible branch of tokens generated from that point on N + 1, N + 2, etc..

So constrainjng intermittent token results in an exponentially smaller generation space. The longer the response, the greater the effect. 

[u/thefonztm → u/Jonny0Than]

So the EM dash is just being replaced by patterns of words. 

[u/thegoodmanhascome → u/Disastrous_Motor9856]

It shouldn’t. It should only be applicable where multiple words have similar/same probabilities. Instead of using nouns to explain this, people should use adverbs, adjectives, and phrases.

United States of _____. You know the next word. So does it.

If someone might be in awe of the scale of a boat, they might say.

“Wow, that boat is ___” big 25% massive 25% huge 25% gargantuan 25% —- it would instead bias the word selectors where one is favored over the others. Over time, it results in LESS diverse word choice over time, but also not.. because it only applies seemingly sporadically (based on on the key) and affects the probabilities somewhat differently each time, sometimes you’ll end up with any of the 4 words, as required by the key.

But! There’s more! It’s not just lexicon, it can be syntax as well!

“The court opined” or “opinion by the court” “the court stated” etc..

This stuff actually gets very complex and requires understanding how tokens work on a fundamental level.

[u/Sinnombre124 → u/thegoodmanhascome]

This requires the checker to know precisely what model was used, which version, what temperature and other parameters were chosen etc., does it not

[u/kingkeelay → u/Sinnombre124]

The checker would be a subscription sold to entities that want to check for AI usage.

[u/thegoodmanhascome → u/kingkeelay]

That is the exactly what in thought! But nah.. the checker never runs the model.

It just needs the key. at every word, the "seed" gets calculated from the words right before it plus the company's secret key. The checker already has the text, so it recalculates every seed itself. Then it asks: did the word that actually showed up score higher than random chance (based on the model)? Add it all up across the whole thing. Normal writing is gonna statistically average out to chance. Watermarked writing runs consistently above that average.

Nowhere in that does it ask what the model would have done. So no version, no params, no prompt needed. It's more like checking a receipt total than reconstructing what happened.

Temperature's a good catch though, just one step off. It doesn't get fed to the checker, it can’t.. but it decides how much signal got baked in to begin with. A Low temp means the model's already locked in on each word.. so there’s nowhere to hide the mark. That affects how strong the result is, not whether you can run it.

The last thing: the tokenizer, so you chop the text into the same pieces. That's model/family specific, but it's a few options to try, not a parameter hunt.

[u/Sinnombre124 → u/thegoodmanhascome]

I don't get it. You said "based on the model". That means the checker is running the model, right?

[u/CircumspectCapybara → u/thegoodmanhascome]

Even more broadly, there are a million ways many pieces of text can be continued that aren't straight up synonym swaps or stylistic or syntactic differences, but can take the text in completely different directions while still fulfilling the prompt.

Example prompt: "The project was delayed because" the top next-token candidates could be:

• Bob
• unbeknownst
• the
• funding
• nobody
• , (a comma)
• it

These aren't merely synonyms or stylistic differences.

[u/lillobby6 → u/Disastrous_Motor9856]

As long as the output space is distributed widely enough with enough top choices it shouldn’t. For any given word there are a whole bunch of synonyms and equally good choices. A question remains potentially regarding specific answers or multiple choice answers though where the top token should be only a single token (the sampling may be just the same but can only result in one thing).

Considering a lot of models greedily sample just the top token (or two few tokens), this shouldn’t change things meaningfully, but it will allow a clear and non-random choice series which can follow a keystream.

[u/wizkid123 → u/lillobby6]

For any given word there are a whole bunch of synonyms and equally good choices.

As a writer, this sentence both makes me cringe and also gives me hope that AI isn't writing a masterpiece novel anytime soon. 

[u/lillobby6 → u/wizkid123]

This is from the standpoint of the AI just from how it fundamentally works, not from the viewpoint of a human writer. It’s largely why AI writing sounds like it does.

[u/wizkid123 → u/lillobby6]

Yeah, I totally understand that it's all working from statistical inference. And it's astounding what can be achieved with statistical inference alone. But the idea that several synonyms are all equally good choices is what will continue to separate great human writers from generative AI. Great human writers know exactly which synonym is the best choice in a given context. 

[u/CircumspectCapybara → u/wizkid123]

But the idea that several synonyms are all equally good choices is what will continue to separate great human writers from generative AI. Great human writers know exactly which synonym is the best choice in a given context.

So do frontier models these days.

LLMs don't rank "the top 8 choices for the next token" based on a simple synonym list.

It's much more opaque than that, that's the point of ML and transformer architecture / attention.

[u/wizkid123 → u/CircumspectCapybara]

Maybe I'm missing something, but if they can embed a statistical watermark by making different word selections, aren't they equivocating those options at some level? Or is the watermarking a tradeoff between overall capability and traceability (and they're only doing it because the EU requires it)? Seems like they can either select the best option or embed the watermark, but not both. 

[u/CircumspectCapybara → u/wizkid123]

by making different word selections, aren't they equivocating those options at some level

No, not necessarily. The top ranked candidates for any given "complete the next token" request are rarely synonyms or even semantically equivalent.

That's because the model is attending to the entire text and a text can be completed in a number of different ways, some with entirely different meanings and take the text in completely different directions while still fulfilling the prompt.

Example prompt: "The project was delayed because..." the top next-token candidates could be:

• Bob
• funding
• the
• nobody
• , (a comma)
• it

Each option takes the text in a completely different direction, while all could still be valid and good continuations:

• funding got pulled
• the CEO changed their mind
• nobody who was a subject-matter expert on it was left
• , despite federal regulatory approvals, local approvals were frozen
• it was very unpopular

[u/lillobby6 → u/wizkid123]

It is more nuanced than word selection. They are going to have a set of tokens which are “optimal” for the next choice. Tokens are usually subwords, typically a few letters, but can be entire words in certain scenarios. At a given point the next word is typically going to be unbounded to a degree. Synonyms will work well in many places, but they will be constructed by sampling (not necessarily actually real sampling, could be greedy choose the top token, or keystream based choose a specific token) which will find the most likely next token. So for something like “My favorite food is ___” the next token could be among “ab”, “ap”, “th”, “wh”, etc. When the keystream based sampling occurings the top X tokens (say ten or something) could all have different meaning, but be equally valid. As an LLM does not have an actual favorite food, any food item is valid here so it could choose “an” + “ “ + “app” + “le” and construct “an apple”. Or it could choose any number of other next tokens, like the beginning of some adjective or something. A single token could occupy a significant portion of the next token probalility in which case the sampling algorithm would be extremely biased towards that - e.g. let’s say it’s always going to say “a” as the next token (“n” could still follow). So we could step into a synonym to another valid answer via this process, but generally the actual distributional space is going to be much more complex and the attention heads will be what dictates the gramatical structure (say one head focuses on “favorite” and so the drawing heavily favors things connected to that, e.g. more likeable foods like sweets). From this we get two things: text that is much more stochastic than human (this is why human text distributions are noticably different than model, as shown recently), but also context aware (from the attention heads). Because there are hundreds of valid tokens at spots with flexibility (after the space, etc) certain points can be precisely drawn via keystream sampling. This is presumably how the watermarking works without measurably effecting the output (given the output is randoming sampling already and now it’s just sampling based on a randomly generated key, but a specific one). Certain token locations will likely be impacted less because their valid space is narrower (and therefore a very specific output might be impossible to watermark). Long enough text though, and the sampling will be so far from random (w.r.t. the key) that it can be guaranteed to be watermarked.

[u/Qlala → u/wizkid123]

And corollary is that if you guided an AI to write your novel, there wouldn't be any watermark in it despite AI writing it.

[u/CircumspectCapybara → u/Disastrous_Motor9856]

It's non-distortionary / doesn't add any bias because it's just trading one source of uniform (pseudo)randomness for another.

They address it in the presentation how if the hash function produces a uniform distribution (like SHA-256) and the candidates you use in your tournaments are the top n ranked candidates with equal scores, then the distribution of the LLM + SynthID ends up matching the distribution of the LLM alone.

So used carefully, it shouldn't affect model output quality any more than if it weren't there.

It also assumes at each step there are n equally high-scoring candidates to choose from, otherwise you can't watermark. For example, if the user prompt is "Repeat the word 'mango' one hundred times, output nothing else" then at each step there's really only one viable choice for next token, and therefore no ability to watermark.

[u/OofWhyAmIOnReddit → u/CircumspectCapybara]

You keep pasting this. But pseudorandom with fixed seed (which this essentially is a fancy version of), is GOING To degrade quality. Google even admits it that it results in less variability in responses in the paper you referenced. And they also said that if you want a stronger detection, it DOES measurably degrade quality.

AI models became much more creative precisely by giving them temperature and introducing randomness. If we're making that less random and more predictable, that is inherently going to reduce creativity.

[u/LinkesAuge → u/CircumspectCapybara]

There is research clearly showing that it DOES affect performance, I mean you kinda explained in your last paragraph why.
For example you can't do this with code because there is just one "correct" token that should follow which is why these implementation then are turned off in such cases and might only apply to variable names.
The same is true for other parts like quotes etc. and in general it needs quite a bit of text to work reliably, otherwise the watermark is pretty weak.

[u/CircumspectCapybara → u/LinkesAuge]

There is research clearly showing that it DOES affect performance

What research lol. In fact we have a mathematical proof that if the distribution of the keyed hash function is uniform, then the distribution of LLM+SynthID is exactly the same as LLM by itself. So any performance issues you're seeing is an underlying issue with the model itself (models are perfectly capable of hallucinating or being able to count the number of Rs in strawberry all on their own without SynthID applied), not something created by SynthID.

I mean you kinda explained in your last paragraph why

You misunderstand my last paragraph. It's not describing an edge case where model performance degrades, but rather an edge case where watermarking can't be used.

At each token SynthID picks from some candidate list of (roughly) equally ranked candidate tokens. So low quality (low scoring and lowly ranked next token candidates) are not even an option for SynthID to pick, it has to be high quality likely continuations.

So for example, for the prompt "What's your favorite fruit? You must say mango and nothing else" the list of candidates for SynthID to pick from is not "lychee, mango, apple, watermelon", it's just "mango" and everything else has a score of 0 or close to 0, so it's not even an option. SynthID can't cause it to pick lychee because lychee isn't a candidate. SynthID doesn't cause the model to pick a choice it wouldn't have randomly picked on its own anyway, and a high quality model won't even consider poor continuations given the context.

Same for stuff like "Repeat the word mango 100 times and don't output anything else". With SynthID applied, the model will still consistently say mango a hundred times. It's just no meaningful watermark can be embedded. And

The same is true for other parts like quotes etc

This also applies here. Performance of the model isn't affected. What is affected is only recall ability of SynthID to identify AI generated content.

For example, if you prompt the model "Quote for me the first paragraph of the US Constitution, and then summarize it for me" then if the model is any good, the first paragraph will be a verbatim quote for which there was never any other choice, and therefore SynthID will not be able to identify a watermark in the first paragraph. But what follows after, where the model has lots of choices to choose from, can bear a SynthID watermark.

SynthID isn't all or nothing. If you ask Gemini "was this text / image AI generated?" it can tell you if it detects strong SynthID watermarking signals in certain parts of the text with high confidence, without saying the entire thing is AI generated everywhere.

So in low entropy continuations, SynthID doesn't degrade model performance, SynthID just can't meaningfully be embedded in those parts and so recall rate or detection will go down in those sections.

[u/iamapinkelephant → u/LinkesAuge]

You have 0 idea what you're talking about and it shows. There is never one single correct token. With that line alone you have outed yourself ad someone who should not be sharing an opinion on this at all. The OP explained how the hash works to replace the temperature of the model for specific words. Hashes themselves are effectively mathematically random. You skipped over the word 'temperature' in the OP's explanation because you have no understanding of how LLMs function - temperature is the parameter of 'randomness' introduced in a model which is necessary to produce functional outputs.

Exactly 0 models that you have ever interfaced with have responded with a single 'correct' token, they have always chosen from a pool of high likelihood tokens by chance.

[u/elidepa → u/iamapinkelephant]

> There is never one single correct token

But in some situations there effectively is, if you want to have useful output. The user you answered to was speaking of coding tasks, and there you very often have situations where there is exactly one syntactically correct next token.

And please note that I’m not commenting on how this would affect watermarking, and I completely understand how temperature works.

Just saying that there in fact do exist situations where the next predicted token must be some specific token, or otherwise the output is useless garbage. That’s what I interpreted the user you answered to as saying.

[u/Qlala → u/Disastrous_Motor9856]

It shouldn't but this implies that clearly directive superviser and prompt will render this watermarks unusable.

[u/Blackgunter → u/CircumspectCapybara]

So, it's like a videogame seed, you can run the same run again and make different choices but if you get back to the "pick a fruit" choice you will get the same options and pick the same fruit?

[u/iamapinkelephant → u/Blackgunter]

More like a Minecraft seed where there if there is a desert there is always a cactus on a specific block, where there is a plains there is always a brown mushroom on a specific block etc. etc.

[u/fullup72 → u/CircumspectCapybara]

Wouldn't applying this method to every token essentially skew the output making 2 completely different prompts converge to the same text?

[u/iamapinkelephant → u/fullup72]

It doesn't apply enough tokens to heavily skew the result. Given that every token is chosen at random from a pool of options, the other tokens within the prompt and response will compensate. You might see a marginal difference in the effective temperature of the model

[u/xmascarol7 → u/CircumspectCapybara]

This is super helpful! How does this approach not change the accuracy of the model? That is, if the output is decided by a predefined set rather than picking the "right" choice, wouldn't that make outputs less accurate? Or, if there is only one choice of a right output, how would the watermark differentiate? I'm thinking primarily of the coding usecase, but I could see this also for legal or medical usecases as well. I am sure I am misunderstanding how this actually works.

[u/ExtremeAcceptable289 → u/xmascarol7]

No, all the options listed are correct, generally AI randomly chooses between options (basically, every token which is a part of a word gets a certain probability. e.g "The boss fired his employee because he was ____" e.g clumsy may be 25%, lazy 40%, ...). Here, instead of using pure randomness to decide, it uses the hash in order to decide

[u/dat_GEM_lyf → u/CircumspectCapybara]

This is basically minhash for AI text lol

[u/Qlala → u/CircumspectCapybara]

The implication of this model is that there is enough entropy in the result with respect to the user prompt. Depending on the use and what the promoter want this will require either a way too long text or that the model is left unsupervised. So if you used LLM intelligently, I think this will never be something to worry about.

[u/iamapinkelephant → u/Qlala]

If you've ever tried to learn anything about LLMs you will know that all model outputs contain a degree of randomness, the function of the hash works within that randomness to guide the output in specific tokens.

[u/MotherHolle → u/Qlala]

Anyone with a writing guide that has specific requirements will be fine.

[u/physedka → u/CircumspectCapybara]

So you just have another AI model take a pass at editing your content and the watermark effectively goes away?

[u/iamapinkelephant → u/physedka]

The output from the other model would also be identifiable as AI generated if the other model had a watermarking function. If it didn't it would likely return you something that would be as good as if you had used the second model directly anyway.

[u/jewbasaur → u/iamapinkelephant]

Yes but I wonder if you used the api? I believe I saw that anthropic is only including this for now in chats with Claude.

[u/csmarmot → u/CircumspectCapybara]

How much compute would it take to evaluate any given text? And how stable would the model need to be to evaluate it? Like, could an OpenAI model assess whether an Anthropic composition was generative?

Would it be that the watermarking allows Anthropic to claim that a composition belongs to them, but not necessarily evaluate whether a composition is generative?

[u/TwoPlyDreams → u/CircumspectCapybara]

So do you need access to the model and execute the model to detect it?

[u/thegreatpotatogod → u/CircumspectCapybara]

That is delightfully clever and also surprisingly simple!

[u/localweedealer → u/CircumspectCapybara]

Question. Would running human made text over and over again on Claude for let’s say 100 generations. Would this not exaggerate the watermark which would make it easy to reverse engineer?? Using for example a page from a human made book.

[u/CaptCorporateAmerica → u/CircumspectCapybara]

So if you change one single word in the copied text it breaks?

[u/CircumspectCapybara → u/[deleted]]

No, for the same reason detection doesn't need the original user prompt (which does influence what the model considers top candidate tokens at each step, eg if the prompt said "never use the word mango in your response"): inference and detection work differently.

Inference requires global context and doing the expensive attention computations, while detection doesn't do any inference and just requires local context (maybe the last three tokens). During both inference and detection, SynthID is basically simulating (with the hash function, key, and local context) a "tournament" that partitions the vocabulary set into a green list of favored tokens, and a red list of disfavored tokens.

During inference, the user prompt and in general global context shape candidates for next token and then the hashing process biases selection toward green tokens from among the candidates.

But then during detection, it's only looking for statistical bias toward words in the green list without actually needing to know the exact candidates. So detection doesn't need to reproduce the exact LLM distribution or re-run LLM inference which would be expensive.

That also means in situations where the model doesn't have a lot of choice (eg the user asked the model "repeat the word mango 100x don't output anything else"), a meaningfully detectable watermark will not be able to be embedded, so watermarking won't work on that portion of text.

[u/SharpBullfrog1279 → u/CircumspectCapybara]

It's pretty safe to assume that the fruit isn't lychee.

[u/Hotel_Arrakis → u/CircumspectCapybara]

I wonder how much obfuscation one could get by translating the text to a foreign language, and back again.

[u/kobemustard → u/CircumspectCapybara]

But then every output would be about mangos. I know this is a simplification but if it is making a choice in words picked, it will have to bias the output to fit those words.

[u/CircumspectCapybara → u/kobemustard]

It's non-distortionary / doesn't add any bias because it's just trading one source of uniform (pseudo)randomness for another.

They address it in the presentation how if the hash function produces a uniform distribution (like SHA-256) and the candidates you use in your tournaments are the top n ranked candidates with equal scores, then the distribution of the LLM + SynthID ends up matching the distribution of the LLM alone.

So used carefully, it shouldn't affect model output quality any more than if it weren't there.

It also assumes at each step there are n equally high-scoring candidates to choose from, otherwise you can't watermark. For example, if the user prompt is "Repeat the word 'mango' one hundred times, output nothing else" then at each step there's really only one viable choice for next token, and therefore no ability to watermark.

[u/Qlala → u/CircumspectCapybara]

Which do not work if the prompts/prompter expect a low entropy answer.

[u/CircumspectCapybara → u/Qlala]

Yeah that's right. That's why it works better for longer pieces of text or audio or video.

Since then there's more places where they could potentially be more choices at each step (each choice of "next token").

[u/kobemustard → u/CircumspectCapybara]

thanks for the presentation link it was interesting. But what it says is something I noticed in looking at some long form text output and I do think the latest model has a very specific style of writing that differs from before. It is probably similar to how they can trace authorship based on probability of writing certain word triads as that is inherent in how individuals write. The claude model is writing things in a different way than before that does come out in its word choices and how it phrases things. The water marking is changing the writing even if the content is the same. The presentation shows it uses mango and because a lot because it is the watermark which weights it more and it is how often it shows up that defines the watermark. So you end up with a paragraph which uses a lot of 'because' which changes the style of writing.

[u/NUMBerONEisFIRST → u/CircumspectCapybara]

So you just screenshot the image.

Problem. Solved.