Claude's text watermark has successfully outsmarted humans

Last week, Anthropic announced that it would add an "invisible watermark" to the text generated by Claude, and it finally released the technical details over the weekend.

As speculated earlier, Claude's text watermark will adopt SynthID developed by Google DeepMind. The solution is more sophisticated than "inserting several special characters into the text": the watermark is not added after the text is fully generated, but is "written" into the text little by little as Claude generates each token.

At the same time, anti-detection tools have emerged. Some developers on GitHub have started to make dedicated removal tools targeting text watermarks.

This is indeed not a highly robust technology. In plain terms, "rewriting the content with another model" can easily break the effectiveness of the invisible watermark.

This puts Claude's watermark in an awkward position for the time being, and there is a thought-provoking hidden concern: To make a piece of text recognizable in the future, Claude needs to change the probability of each word being selected; while for people who want to make the text unrecognizable, one of the most natural countermeasures is precisely to rewrite these words.

Claude's watermark is not "hidden" in the text, but "written" into it

To understand this attack-defense dynamic, you first need to figure out what the long-existing SynthID is actually doing.

When a large language model generates text, it does not first conceive a complete sentence in its mind and then output it word by word. At each step, it calculates a set of probabilities for the next possible token based on the existing context, and then makes a selection from them.

For ease of understanding, assume Claude is completing the sentence "This movie is really ____". At this point, it may face many options, among which the higher-probability choices are:

"great" 40%

"impressive" 20%

"wonderful" 10%

...

SynthID will not force Claude to select a specific word, nor will it delete any option. What it does is more like, before the model makes a selection, slightly adjust the scores of some candidate tokens according to a set of rules only known to the inspection side, making some options more likely to be selected than before.

When moving to the next token, since the context has changed, the probabilities will be recalculated, and the preferred candidates will also change accordingly. Therefore, there is no fixed "Claude watermark word list": even if a certain word is conducive to watermark embedding in one context, it may not be the case in another.

If you take any single word out of the context, it is almost impossible for humans to detect any abnormality. What can actually be detected is the statistical pattern left after a large number of generation choices are accumulated.

You can simply understand it as an exam with only multiple-choice questions. The teacher does not directly "leak the answers", but secretly tells the favored student: When you are unsure of the answer, just choose C.

Choosing option C by chance in one question makes no sense, and getting C in ten questions could also be a coincidence, after all, option C does exist.

But after hundreds of questions, if only this student's answers, whether correct or wrong, show an abnormally high proportion of option C, and repeatedly conform to the rule that "this teacher tends to set C as the answer", it is hard to claim that this is completely accidental.

Watermark detection works in a similar way. It is not looking for unique evidence that "only Claude could have written this sentence", but asking: In a sufficiently long piece of text, there are many possible options at each generation node. Why do the finally output tokens continuously show statistical preferences that conform to a set of secret rules?

The term "invisible" is defined in this sense: the watermark does not correspond to any character that can be located by the naked eye, and it relies entirely on statistical rules. But this also brings another problem: since the signal itself is attached to the selection of tokens, reselecting the tokens will naturally break this statistical relationship.

Claude rewrites, then the user rewrites again

If the watermark is hidden in the file metadata, attackers can delete the metadata; if the watermark is hidden in invisible Unicode characters, the special characters can be cleaned up. The trouble with SynthID, however, is that it is completely integrated with the text itself.

If you want to remove the watermark without deleting the entire paragraph directly, the most straightforward idea is to reorganize this sequence of tokens while keeping the original meaning as much as possible.

Replacing a word with its synonym, changing active voice to passive voice, or more directly — sending the text to another model to "rewash" it, self-modify the content.

All these operations may weaken the originally accumulated statistical relationship. To illustrate this point, blogger Daring Fireball takes the rewriting tool Declaude as the most intuitive example: it was originally used to "remove the heavy AI flavor of the generated text", and this kind of rewriting can easily erase the traces deliberately left by Claude.

Tools like Pangram have long been popular on the market for detecting the proportion of a text that is generated with AI participation, which further turns this attack-defense dynamic from theoretical discussion into a ready-made demand. Specific attack methods may vary, but the goals are highly consistent: Preserve the content as much as possible, while destroying the token sequence that the detector relies on for judgment.

What a thrilling hide-and-seek game.

To check whether there is AI participation, the model has to slightly adjust the word selection during generation; to evade detection, the user has to reselect the words. To make the watermark resistant to ordinary rewriting, the watermark system needs to increase its intensity; then users will continue to find methods that do not change the original meaning but more effectively destroy the statistical signal.

From a technical perspective, this is a very standard attack-defense scenario: the defense side wants the signal to survive copying, editing and format changes, while the attack side tries to make the detection invalid at the lowest cost.

The situation of text is slightly different from that of images and audio. The watermark in images can be hidden in spaces that do not affect viewing, while the "space" available for text watermarks is exactly the specific words, sentence patterns and expression choices themselves.

Image source: Atlasiko

Therefore, every step forward in this attack-defense game will inevitably affect the text content itself.

What is more awkward is that this mechanism is inherently asymmetrical between people who intentionally evade detection and ordinary users. People who are determined to cheat can actively find non-watermarked models, rewriting tools, or repeatedly "polish" the text; people who have no awareness of evasion may have to accept the generated results with watermark constraints by default.

In the end, the people most likely to be marked by the watermark are exactly those who never tried to evade it.

Everyone is rewriting words, but who still cares about how the text should be written?

In the end, this hide-and-seek game is no longer about who can catch the other, or who can avoid being caught.

Although the watermark side and the de-watermark side stand in completely opposite positions, they share the same premise: A sentence seems to be split into "meaning that needs to be preserved" and "wording that can be modified".

As long as the general meaning does not change significantly, specific words can become the operation space for technical systems, whether operated by the watermark system or the author himself.

The biggest doubt about text watermark from tech blogger and author of Daring Fireball John Gruber can actually be converted into a simpler question: Does similar meaning mean the text has not been changed?

Let's compare the following two sentences:

"He finally agreed."

vs

"He finally gave in."

Both sentences can describe "a person finally consented to something", but the second one inherently implies that the person resisted before and conceded after some negotiation.

These two sentences do have almost the same "meaning", but for people who truly care about writing, they are not interchangeable at will. Even in daily life, these two sentences carry slightly different connotations.

Both Anthropic and Google emphasize that the design goal of the watermark is not to change the semantics, quality and readability of the text; whether a very slight probability bias will cause perceptible quality differences in the actual output still requires additional evidence.

But one thing has already changed: when the model selects a word, there is an additional optimization goal that has nothing to do with "how to write this sentence well".

In the past, a generation system, at least in the ideal state, balanced between goals such as accuracy, clarity, naturalness, compliance with user requirements and human writing habits.

After adding the text watermark, it also needs to consider "whether this text can be recognized by the watermark system in the future"; and when users try to counteract it, the text goes through another round of optimization of "how to modify it to be unrecognizable". No matter what the purpose is, both sides can claim that they have tried their best not to change the "meaning".

But writing is never about detaching words from meaning, they are as closely related as lips and teeth. Text does not generate a complete "meaning" first and then randomly select a set of synonyms to fill in. The specific choice of words itself creates the "meaning".

Claude wants to prove "I have generated this text", and users want to achieve "you can't recognize it". When everyone starts modifying a sentence just to prove or hide identity, "how this sentence should originally be written" has been squeezed into the corner.

In the end, what this dispute is fighting for is not whether the technology is sufficiently invisible and imperceptible, but whether the original pursuits of language itself — for style, rhythm and expression precision — can still have a place to survive.

This article is from WeChat official account "APPSO", author: Discovering Tomorrow's Products, published with authorization from 36Kr.