Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I don't really see how this would work anyway.
Even if you find a way to 100% watermark any text, couldn't you just use a non-watermark model? I have a hard time believing every AI company on heart would comply.
Hell, even if every AI company on earth decide to somehow apply watermarking to their next model, they would also need to apply it to all the previous version that they commercialize. Given that anybody could make a copy of an open source model right now and would be safe forever, this seems quite the lost cause to me.
by Otterly99 - This is just managing the low-effort low hanging fruit.
The students who, without a single neuron activating, will just copy paste questions to an AI web UI and paste the answers back.
Or the mid-tier corporate people who file 50 page "reports" that are 100% AI bullshit.
None of them will install a local model with no watermarking or bother looking up some Badonk AI service to do the same thing.
by theshrike79 - I don't think this is a good argument. There exist digital watermarking techniques for image and video that are imperceptible to humans but still survive cropping, rotation, resizing, recompression, or an analog round trip (photographing the image or pointing a camera at the video). These watermarks aren't, like, hiding in the low-bits of color information, they're spread among many perceptible details.
It's not clear to me that it's impossible, or even especially difficult, to make something that survives a casual LLM paraphrase. Remember, all you need to encode is a single bit of info. There's a lot of space to redundantly encode that signal.
by fwip - Would OpenPangram's LoRa fine-tuning training be able to pick up on the patterns of steganography left behind by LLM vendors? https://huggingface.co/pangram/editlens_Llama-3.2-3B
(pardon for reposting just now from off-front-page thread on https://declaude.org/watermarking/, just thought of question)
by thadk - I've been working in the media and model IP space for quite many years. What this article misses a bit is the threat model for watermarking in general.
Watermarking and fingerprinting have inherently weak security guarantees -- they rely a lot on security through obscurity, weak assumed adversaries to deliver.
There are clear trade offs between true positives, false positives and maintaining the quality of the media. It's true for audio-visual media, models and their outputs alike.
As much as I like to take shots at poor technical choices by corps and govs, this one is unjustified. Sure, inserting glyphs is bad but biased sampling is as good as it gets in 2026.
EDIT: grammar
by sbszllr - Isnt this absurd? Say im brainstorming a resume bulet point. Its 15 words. I like it but want to condense it to a single line. I give it to the ai and tell it how much overflows and now it gives me back a simplified sentence and 11 words and some extra stenography constraint? What kind of rule could possibly not effect the quality of that output?
Ok say i do that on 30% of bullet points. Karen the hiring manager is vehemently anti AI. She gives my resume to her AI scanner and what does she find? This not a rhetorical question. Will it treat the text as a whole and not find it? Does it scan every combination of contiguous terms? It could scan bullet points but i could generate in pairs of 2. What about novels?
by nonethewiser - Suppose I gave you a series of 1000 coin flips. I tell you they were generated by a fair coin. You’re suspicious, you think I hid a watermark in them. But you look at the sequence and 485 are heads, close enough to 50%. You look at the correlation between a coin flip and the next and it’s 0.0433. Close to zero. You do a bunch more stats and everything checks out. So you’re convinced.
Then I tell you: calculate the average of every 3rd flip minus the average of every second. It should come out close to zero, and unlikely to be higher than +/- 30 but for my sequence it comes out to +89. Ok, that’s very unlikely.
So from now on we share this secret. Whenever I generate sequences of coin flips they all came out with this particular statistic out of whack, but unless you’re looking for it, you can’t detect it. In fact, in the real world I use cryptography such that unless you know my secret key, the specific statistic in question is mathematically undetectable.
Now use this sequence of coin flips to pick amongst next tokens in an LLM. It doesn’t change the distribution of words used in the LLM. It doesn’t change its writing style. In fact, unless you know the secret key you cannot detect the watermark. So it’s not that some words are used more often. That would be detectable. It’s just that if you translate back to a series of 0’s and 1’s the average of every 3rd bit minus the average of every 2nd is out of whack.
by ruilov - >watermarks
Whatever happened to just delivering the best product or service? Why must tech be full of ninnying nannies that act against their users, "for their 'safety'‽"
by rustcleaner - Because the best product should still take care of some social accountability, Meta would not sell their shitty glasses without the light indicator and even with it, as it's trivial to hack there's large social pushback.by dana-s
- For SynthID and similar solutions, there is much I don't understand ...
Here's what I grasp: The AI system scores each token and then selects tokens based on those scores. If we encode something in the token selection routine ('in order choose the 1st, 3rd, 1st, 5th, 2nd, then 1st highest scored tokens'), we can identify AI-generated text by comparing sample text (ST) to the expected text (ET) for that prompt.
1) How do we score the tokens for the ET without the original prompt? Even a Markov-like process needs to start somewhere.
2) To recreate ET don't we need to maintain, until the end of time, the AI state - entire model and code - at the time of ST output?
3) Doesn't #2 require maintaining all states for all AIs? Often you won't know when and from which AI system the ST might have been generated. What happens when an AI vendor goes out of business?
4) To recreate ET, don't we effectively have to rerun the prompt? Won't rerunning it for every verification increase most costs of AI output by an order of magnitude? Most of what AI vendors do would be ST validation.
by mmooss - 1. score by the past paragraph (this is also how the verifier checks without needing a GPU, it takes the previous length of text)
2. same answer
3. no, it just needs the previous text, private key, and the matrix math (CPU is fine)
4. no, see above.
- https://declaude.org/watermarking/ did a good job in explaining how SynthID works. As per their blog, it feels like it will be difficult to remove watermarking on bigger text and the checking for watermarking is also not complex
- There’s some healthy discussion on the submission of that link: https://news.ycombinator.com/item?id=49292932by WalterGR
- The goal of the AI act is not to determine if an "oh yeah!" comment was AI generated. The target is long papers that falsely claim human review and can have real significant consequences.
E.g. research paper, law makers, lawyers, state policies, notaries,...
These are much longer content and thus statistically they will disclose a better guess at AI generated content.
Asking another AI to paraphrase will not erase the mark (which they are unaware about) but rather cumulatively add their own mark and make it easier to detect.
The problem is not to use AI, but to endorse the responsibility of the content you (as a human) deliver and somehow make sure that fake-news, biased content or unverified output is detected as early as possible.
by simon84 - I don’t understand how asking another AI to paraphrase causes both watermarks to remainby wodenokoto
- You'd think that the humans being paid to review these things are actually reviewing them. Journals, laywers etc. are expensive. With the addition of AI, it should be easier than ever to review things on their merits.
Maybe some part of it is that the deluge of slop is uncovering how poorly/sloppily these social institutions were working in the first place.
by avaer - Yeah, but it's better than nothing.
People underestimate the value of rules that only take malice and a little knowledge to break.
And they tend to exaggerate that underestimation if they... don't like the rule.
- Exactly. If this works on pull requests, for instance, it'd be really useful for projects trying to do a first-pass filter to close slop spam.by JoshTriplett
- Yes! How many people have been caught committing fraud because they used a modern word processor and fonts to forge old documents? How many leaks have occurred because people failed to redact documents correctly, despite there being easy to use tools for this very purpose? How many people neglected to strip sensitive EXIF information from images they share (before websites started doing it for them)? How many people flat out post evidence of their crimes on social media?
Yes, this watermark will be easy to strip. It is still valuable for the vast majority of times where people just don't.
by pavon - How is this "better than nothing" considering that it's not even needed in the first place?by nradov
- It's worse than nothing because it gives people the false impression that there exists a system they can trust to tell them what information is authentic and what isn't. The incentive for governments and other interests to undermine that system to push false narratives and disinformation is just too great.by krapp
- I even see the Gemini diamond watermark on so many fake social media profile pictures. You could ask an LLM to find a github project that removes/inpaints those watermarks and be done with it. Or you could just use the API, which doesn't stamp the visible diamond on it (just the invisible synthID).
Most people are generally lazy. They upload text to LinkedIn full of "genuine", "honest" and "load-bearing".
by bonoboTP - The article mentions you can always simply use a smaller, local, un-watermarked LLM to rephrase the original watermarked text. Which is true, sure.
But if we're talking about deterministically taking some watermarked LLM output and having a function removeWatermark(text), it won't necessarily be "trivial" to remove, because the watermark function itself need not be public. Only the API that tests for the watermark need be public, right?
Anthropic's magic watermark could be, like the article mentions, something like "every 7th semicolon has a N% chance to be a comma where N is the sum of the last X characters mod Y, and every character in the bit range q1...q2 has a Z% chance to..." etc etc etc. And if Anthropic controls those variables, it would be very difficult to determine the rule, even with some pretty advanced analysis (I would assume). And keep in mind, that example rule I mentioned is pretty naive, too. I expect the actual rule would be way more advanced and not so straightforward as "swap every <charX> for a <charY>"
- It could be, but common, we all know that Anthropic's watermark is the using "load bearing", "genuine", and "seam" 1000x more in the same paragraph than any human in history.by cayleyh
- To remove the watermark you'd just need to paraphrase the text with another model that wasn't adding the statistical signature to it. You wouldn't need to know what the original statistical signature was.
- I don't know if it's possible to achieve a watermark that is undetectable, has a low false positive rate, and survives a wholesale rephrasing. Can you make a statistical measure that reliably survives 95+% of the words being different and the sentences reordered? Of course the more of the content you replace, the lower the quality, but in many cases you probably care more about the meaning of the text than the exact choice of words.
- >Anthropic's magic watermark could be, like the article mentions, something like "every 7th semicolon has a N% chance to be a comma where N is the sum of the last X characters mod Y, and every character in the bit range q1...q2 has a Z% chance to..." etc etc etc.
Doesnt this and probably all techniques require the validator to know which portion of the text to validate?
If its not all generated together then how could it reliably carry the mark? Sure, run it against the full text. But what if the full text was not one-shot by the llm?
In other words, in order to reliably detect if the text is ai you need to first determine which part of the text was generated together by ai.
by nonethewiser - If you can submit the text to determine whether it's watermarked, you just have to progressively alter the content more and more until it passes.by gblargg
- There exist methods to detect what kind of watermarking tool that someone is using, and most of the big tools have specific signatures that you can look for.
For Anthropic, it’s highly likely that the watermark is a SynthID type mark similar to the one that Sean is talking about (I actually ran the analysis here https://johnjwang.com/post/2026/08/12/how-claude-watermarkin...). When we get confirmation of whether all models actually are watermarked, I think we’ll be even more confident.
Of course it’s always possible that Anthropic has come up with a proprietary scheme, but I think it’s definitely harder to implement.
I think the game will be a cat and mouse game similar to LinkedIn and other websites trying to block scrapers: each iteration makes it harder for someone to figure out the watermarking scheme, but likely not impossible
by johnjwang - I feel like this is going to end up being like cookie laws. It sounds good, I don't know how any one benefits from it.
Currently I can recognize AI text because I read thousands of ai generated text. I know that 110% of yahoo finance news is generated. I don't want to read an AI generated personal blog, but if I do what's the problem really? Other than the companies distinguishing AI text for getting better training data, how do people benefit from watermarked text exactly?
by firefoxd