Going forward, you may need to be careful to leave hidden traces in any content written by Claude.

I have been reborn, returning to the era when people translated Chinese into English, then English into Romanian, and then circled back to Chinese just to reduce the repetition rate of their papers.

Only this time, my opponent is not CNKI.

It is Claude.

Just yesterday, Anthropic released an official statement: the new Claude models released after August 2 will support a machine-readable content tag, and the generated text will be embedded with watermarks. (Old models released before August 2 will go through a transition period)

Every piece of text generated by Claude in the future will carry a watermark that is invisible to the naked eye.

01

This measure was originally taken by Anthropic to cope with the EU's regulations, but unexpectedly, all Claude users around the world have been treated indiscriminately as a result.

Moreover, wherever you use Claude, from Claude, Claude Platform (API), Claude Code, Cowork, to Claude called on AWS, Google Cloud, and Microsoft Foundry, all are covered by the watermark rule.

As soon as the news came out, the internet immediately exploded.

Foreign netizens directly mocked and secretly called Anthropic shameless.

Some people have already begun to consider our domestic AI models.

Of course, some people think this watermark can promote AI governance, which is a good thing.

As for the meme lovers, they don't take a stand but just play around with jokes, saying that the so-called watermark may not be high-tech at all, but Claude's unique verbal tics.

You don't even need a detector to check, you can smell the AI flavor just by reading a couple more lines.

But what is more interesting is our pragmatic domestic netizens. Putting aside whether the watermark is meaningful or not, the top priority is to figure out how to remove it first.

Does copy-paste work? What about taking a screenshot and then recognizing the text? Throw it to another model to rewrite it? If it doesn't work, translate it into seven or eight languages and then translate it back?

First of all, those friends who think they can remove the watermark by copying and pasting the text out, or taking a screenshot and then recognizing the text, can go to bed and forget about it.

Although the specific technical principle has not been announced by Anthropic for the time being, it has revealed a little about the basic working mode. There are mainly two types: embedded watermark for text, and provenance metadata with digital signature for files.

Let's first talk about the text that everyone is more concerned about.

According to Anthropic, when a Claude model that supports watermark generates text, it will directly integrate a watermark that is invisible to the human eye into the text.

This watermark will not change the meaning, quality and readability of the text.

Because the watermark itself is part of the text, when you copy the text to Word, the official account backend, or send it to others, the watermark will go along with it. Even after some editing, the watermark may still exist.

Moreover, the watermark is added at the model level. No matter which product you use, as long as it runs the model that supports watermark, it will theoretically leave a watermark.

So for those tricks that netizens came up with, let alone copy-paste, screenshot and text recognition, even if you retype the whole text word for word, you still can't get rid of the watermark.

As for how Claude stuffs a string of invisible things into the text, Anthropic is tight-lipped for now, but the method of adding watermarks to text is not a new thing in the academic world.

In the past few years, researchers have come up with many ways to secretly mark the text output by large models. A relatively classic approach is to manipulate the model's word selection process.

Every time a large model outputs a token, there are actually a bunch of candidate options behind it.

A 2023 paper published in ICML titled "A Watermark for Large Language Models" proposed a method: before generating each next token, according to a set of secret rules, temporarily divide the candidate tokens into two groups, which can be simply understood as a "green list" and a "red list", and then when the model generates content, it slightly prefers the words in the green list.

You can't see it just by looking at one or two words, but if the text is long enough, the model is more likely to select words from the green list all the way, then the statistical pattern will gradually emerge.

The detector checks according to this set of rules, sees whether the tokens in the green list appear significantly more often than normal, and then it can identify the watermark from the seemingly normal wording.

In other words, if the sentence pattern of "not... but..." is our judgment of AI flavor, then the statistical pattern is the secret code that only machines can understand.

SynthID-Text used on Gemini actually has a similar idea.

Moreover, a later paper published by Google DeepMind in Nature showed that they conducted an online experiment of nearly 20 million real interactions with SynthID-Text, and found that the watermark did not have a significant impact on the quality of responses.

For us, the model speaks in the same way as usual, but the watermark has already been added.

In addition, there is a group of researches that hide watermarks at the semantic level.

For example, a 2024 study at ICLR no longer only focuses on the first few tokens, but takes the overall semantic information of the previous text into account. In recent years, some studies have directly encoded signals in the embedding space, sentence semantics, and even the expression preferences of different paraphrasers.

To put it in plain terms, it no longer focuses on which specific word to use, but uses the semantics of the whole sentence and different rewriting methods to hide the watermark. With this idea, you can't remove the watermark in a short time by simple synonym replacement.

So now some people in the community are guessing whether Claude is tampering with the token probability, and some are guessing whether it encodes through specific wording, sentence patterns or even more complex semantic structures. These guesses are not completely groundless.

But none of the guesses has been confirmed by Anthropic yet. We still have to wait for Anthropic to reveal how the text watermark is added.

Of course, in addition to embedding watermarks in text, Anthropic has prepared another marking method.

If the files generated by Claude are SVG, PNG, JPG and other similar formats, it will add "provenance metadata" with digital signature to the files.

This set of technologies uses the C2PA standard, which you can simply understand as attaching an electronic birth certificate to the file. Who generated it and what processing it has undergone can all be recorded as source information.

Moreover, this practice is already very common now. Many AI-generated images carry similar source information, and large manufacturers including Adobe, Google and OpenAI also support the C2PA standard.

02

However, by now you may be wondering, since the watermark relies on a specific pattern in the text, if I disrupt this pattern, won't the watermark disappear?

That's true. The method to disrupt this pattern is already written in the open.

In the "Limitations" section of the official documentation, Anthropic clearly mentions that if a piece of text is heavily edited, rewritten, translated, or mixed with other text, the watermark may become undetectable.

Too short text won't work, deleted file metadata won't work, and text generated by a model that does not support text marking won't work either.

To put it bluntly, the traditional old-school repetition reduction method is about to usher in a renaissance.

But there is a problem that you are not sure to what extent the text needs to be modified so that the watermark cannot be detected. Now Anthropic has not even released the official detection tool, only saying that it will support users and third parties to detect Claude's marks in the future. The specific detection method will also be announced in subsequent technical documents.

I originally planned to do a practical test of Claude's watermark removal for everyone, to see after manual 10% modification, manual 30% modification, GPT rewriting, Chinese-English mutual translation... how many rounds the watermark can survive.

Now it seems that this test can only be postponed for the time being.

However, even if the watermark is detected, what does it prove?

Anthropic itself also specially emphasized that detecting the Claude watermark can only serve as a signal that this piece of content may have been processed by Claude, and cannot prove that the entire content was written by Claude from beginning to end.

I spent days and nights writing more than 2000 words for this article, and finally threw it to Claude to modify a few sentences, then the whole article will carry Claude's watermark.

So I would like to ask, is this article written by me or by Claude? Where can I reason this out?

The same goes the other way around.

No watermark is detected in your paper, which cannot prove that it has nothing to do with Claude. It may be that the watermark has been removed by modification, or the paper was not generated when the watermark feature was supported at all.

If the watermark is found, you cannot directly confirm that the whole text is written by Claude. If no watermark is found, you also cannot prove that Claude did not participate in writing it.

But don't think that this watermark is just a completely useless redundant move.

There are more and more AI-generated contents. How to distinguish human-written content from machine-generated content is a very realistic problem.

On a large scale, fake news, fraud, and mass-generated spam all require reliable traceability methods. On a small scale, schools want to know whether a paper is written by AI ghostwriting, and platforms want to judge where a piece of content comes from, all have detection demands.

The watermark at least provides a more reliable technical means than judging AI content by subjective feeling.

Over the past period of time, expressions like "not... but...", dashes, colons, and double quotes, which were originally very normal, have been overused by AI, so when we write by ourselves, we will subconsciously avoid using them, for fear that someone will say your writing smells too much like AI...

It's quite absurd to think about it. AI started by imitating how humans write, but as it learns, it forces humans to prove that their writing is not like AI, and there are so many things you can't write or use.