Guess which of these LLM outputs is watermarked

Join the discussion

• Hacker News
• Interesting. This showed how imperceptible it is at first glance. If they had 100 of these and they showed you if you got it right or wrong and why after each answer instead of making you do all ten in a row, I wonder if I would be able to train myself to detect it. I would figure it would just start to seem like something is a little off. The fact that it is so hard to detect just makes this more insidious.
  by mpalczewski
• It feels all of them are terribly written. I don't know why.
  by rrr_oh_man
• Because it's AI slop? Not that surprising.
  by StilesCrisis
• Interesting, I did very badly, 3/10!
  by arcwhite
• Same, doing worse than random chance seems like an interesting signal though, but I'm not sure what it's a signal of.
  by bastawhiz
• 3/10 too, and I've actually tried to discern the answer. My working theory was to pick texts which jumped between more to less frequent words (subjectively of course), but I was very wrong, basically I couldn't spot a watermarked trait at all.
  by Yizahi
• Wow I actually got a 7/10. It was hard to tell at first but there are signs that tipped me off to which one probably had a higher score out of the multiple choice.
  by reactordev
• You likely just got lucky.
  by petters
• Could do with some context on how watermarking works. Objectively speaking it should be impossible to tell.
  by NotPractical
• My understanding is that watermarking in prose is basically a bias when sampling tokens. For a system that knows the average probability for each possible token in the LLM vocabulary it is possbile to quantify said bias given enough text.

  For a human that doesn't reason in tokens and therefore doesn't know anything about their probability distribution, it should be impossible to tell. Relying on fancy words/constructs within sentences should not give you any signal as well, since you don't know if the the prompt included instructions for that.

  by marcyb5st
• My sense of the concern here is that watermarking may somehow deprive someone or something of value regardless of whether or not they can tell, so I briefly pondered trying to rank these from best to worst and see if any set of those votes meaningfully deviated from ~average.

  That said, I read the first triple and found all three tortured enough that I can't be bothered with the rest.

  Call me persuaded, I guess.

  by abathur
• I disliked the fact that the experiment only covered prose, which my eyes glossed over and made me actually do random entries to pass on and see the results. I'd love to see it on a more accurate output distribution like commented code
  by elikoga
• I don't think anyone is, or plans to be, watermarking AI-generated code as opposed to text.

  [EDITED to add:] As pointed out by a helpful comment below, I was misremembering: Anthropic do apply their watermarking to code, they just say that it will have negligible impact on the actual code (because there's generally less scope for variation in that) but e.g. it will have its usual effect on comments in the code.

  by gjm11
• Interestingly, it seems almost every set of three seems to follow a pattern: one passage of the three will have a key word or phrase swapped in the first sentence. That is, for every set of 3 passages, two will start with ~identical sentences, and one will have a key word or token changed.

  I caught onto this early and used it every time, and ended up getting 2/10, which is worse than random chance. I smell trickery!

  by Jowsey
• This is like giving you three outputs from md5sum and asking you to guess for which one the input ended in a "q". There's no way to tell unless you break the RNG.
  by lacker
• Yeah, it's a pointless exercise. I hope the author is just trolling given that he is knowledgeable in the field.

  > Here are three 64-character hex strings. Two are random. One is HMAC-SHA256(secret_key, "anthropic"). You don't have the key. Which one is the HMAC?

  by pllbnk
• Please report success/failure after each test. Asking me to read and compare 30 writing samples to get any feedback at all means I won't finish. Telling me immediately when I got one wrong lets me recognize patterns and improve my guesses.
  by Noumenon72
• I believe this is to test the theory that people can detect watermarked text.

  Teaching you how to identify watermarked text while the experiment is running would ruin the data.

  by qarl2
• Yes. Did one - saw that I wouldn’t get feedback until I have completed all 10 (if at all) and noped out.
  by stranded22
• > Telling me immediately when I got one wrong lets me recognize patterns and improve my guesses.

  Wouldn't this make it a worse measurement?

  by andai
• I managed 0/10 - far worse than random chance

  Not sure what that says about me or the LLM but I guess I shouldn't worry too much about watermarking ruining the outputs…

  by barnabee
• Yea, I did two and then harrumphed in annoyance that I was expected to do all 10.
  by dozerly
• I did five, then gave up and just pressed A until I reached the end. I got 3/5 right.
  by StilesCrisis
• I've read that watermarking should in theory be impossible to detect except by the entity that watermarked it. Which is sensible, and I mostly understand at a high level.

  But what I don't know and don't understand is what happens if you watermark watermarked text. Does it test positive for both watermarks? Only the second? Indeterminate?

  Or maybe I'm misunderstanding. Can you tell that it's watermarked, but only the entity who put the watermark in place can test if it's theirs? My confusion about watermarking multiple times still stands, though.

  Regardless of what happens when you watermark multiple times, no matter the outcome, it weakens the watermark. Which, depending on the threat model, kind of makes it moot. I can't imagine a serious situation where a watermark can be weakened in any way and still be useful. Even "this came from an LLM" isn't a valid signal if you can just watermark ANY text through purely mechanical means.

  It's also not clear to me how this will affect mainstream LLMs. If all output text is watermarked, there MUST be an escape hatch. Otherwise, JSON schemas will break (or provide holes where unwatermarked text can be exfiltrated through MCP), "return this text exactly with no changes" will be impossible, and writing diffs will break.

  I feel like I must be missing something.

  by bastawhiz
• The watermarking is an inextricable part of the token generation, it just using a known pseudo random sequence for the sampling. It’s not a transform that can be applied later.
  by andy99
• Watermarking only applies where the AI has a free choice (https://www.anthropic.com/news/claude-text-watermark).
  by red_admiral
• If you are refering in terms of the code of practice part of the EU AI Act

  > I've read that watermarking should in theory be impossible to detect except by the entity that watermarked it

  This is a carveout exception, for watermarking. In the spirit of those terms it should be machine identifiable.

  In my opinion they should have thought better about this, paricularly for text, because in its current forms it is easy to lead next to a new "tamper-proof" requirement, which in practice is DRM. And we do not need more DRM.

  For images, music there is metadata already where such information can be stored. And if end users are found using unlabeled AI their accounts could be ban from these platforms. Not something the social platforms might want, but it's a saner approach than trying to reinvent the secret printer dots on all generated media.

  by mhitza
• Utterly imperceptible, even when studied under the microscope in a way that LLM text very rarely is in practice.

  It will be interesting to see whose concerns are assuaged (perhaps they genuinely though mistakenly believed it would degrade quality), and whose concerns are heightened (perhaps their real objection is that their AI-generated text will become detectable).

  by fwlr
• If anyone notices degraded quality, that would imply they could break the crypto behind the watermark.

  For an analogy, distinguishing AES ciphertext from random bits without the key would be counted as breaking AES (the more precise statement of this is called AEAD).

  by red_admiral
• My personal concern after the initial news broke about the topic, was not that generated content would become worse, but that to verify the presence of the watermark, one need to upload the complete and unedited source back to these megacorpos, and likely separately to each of them in a few years. Basically this is a truly novel mechanism to legally siphon any new and not yet stolen intellectual property and do that in perpetuity. And there is an absolutely disastrous loss of responsibility here, because soon any organization which requires content integrity (say science, education, literature etc.) will add a new requirement to accept that the submitted new work will be legally and "voluntarily" fed into the LLM megacorpos (with implied loss of property right).

  Basically we are on the verge of moment when intellectual property will cease to exist outside of a handful of max security closed sites for military or similar work. Everything else will be automatically and now legally fed into the maw of LLMs.

  The fact that watermarking work so spectacularly transparent and undetectable only allows this moment to happen sooner.

  by Yizahi