Interesting. Here's the section of the EU Act that mandates this:

> Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.

https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng

It definitely makes Pangram's job a bit easier.

> Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.

For some reason I had assumed testing this would be more sophisticated than just checking the thumbs up/down stats and user "vibes"

We are very fortunate open source models have reached parity for virtually all non-coding use cases.

From what I understand when you re-tokenize the output you can simply look at how often certain tokens show up and the position of them, enough of these matches would result it watermarked text.

Let's say we are at token 431 and there is 49% to generate token 1 and 51% to generate token 2, we apply bias to our token 1 which would make it win causing a repeating pattern invisible to the human eye.

Now you apply this to multiple tokens and a reversible source of random you have a pretty strong watermarking system... That is rather annoying to defeat as you essentially have to rewrite most of the text. The alternative is to use a diffusion model and spray some gaps across non-literal information such as ids, links, etc.

The method of identifying authorship isn’t new. I guess the main new thing here is to ensure Claude has a specified word distribution so you can identify its writing.

https://towardsdatascience.com/text-classification-and-the-b...

> We will soon be offering a watermark detection API. We’re in the process of working out the details of its implementation.

Dumb question - doesn't this defeat the purpose of a watermark? i.e., anyone who wants to avoid detection can simply run `while (has_watermark(text)) text = slightly_rewrite_with_non_anthropic_llm(text)` until it's gone? I feel I am missing the intent of the watermark if it is so easily defeated.

Opus 5 must be the pilot becuase it's writing style is so grating it has to be intentional. Let's hope they make it more subtle in the future.

I’d like to better understand the minimum text length to get a confident result, i would presume it would need to be quite long, perhaps > 1000 words to get an accurate result.

Yesterday https://news.ycombinator.com/item?id=49292932

Can anybody take a body of text and determine if it's from Claude or not? (Or if it's AI-generated or not)?

“How does affect Claude’s outputs?”

Is poor proofreading a form of watermarking? Clever, I suppose, but they should consider running posts through Sol for clarity.

Seems pretty easy to defeat by running text output through a random reworder process that would effectively repeat the same routine on low-stakes words, replacing them with similar ones. We learned this in high school, jumping through your paper and hitting random words with the thesaurus to 'sound smarter'

Anthropic: doing everything they can to own any output they produce/prevent scrubbing of association for them - except when it comes to the CEO's wife's porn funding attempt from Epstein: https://www.wsj.com/tech/ai/claude-dario-amodei-wife-anthrop...

Yeah kinda. You cant be confident a negative is true.

It doesn’t undermine positives though. That’s just whatever the false positive rate is.

So if it comes back as anthropic generated, it most likely is. If it comes back as non-anthropic generated, we have no idea.

If anthropic didnt make it public there would only be a narrow path for governments or something to make requests. Its kind of fucked either way.

It's completely pointless without an API, unless you're thinking the API should be private or restricted. The public needs some way of identifying the watermark.

> anybody who wants to avoid detection can just

They can just use a different LLM. By far easier and more reliable than what you're suggesting. This whole watermarking requirement is better then nothing because meant people are profoundly lazy, but yes it is not hard to work around with any effort.

> anyone who wants to avoid detection can simply run `while (has_watermark(text)) text = slightly_rewrite_with_non_anthropic_llm(text)` until it's gone?

What do you think the pricing per call of "has_watermark(...)" will be?

https://x.com/i/status/2087235360690741690

An important principle: Never pay someone to remove a problem that they themselves created

> while (has_watermark(text)) slightly_rewrite...

I understand what you are trying to say but I am not sure any watermark detection API would definitively return a true/false answer, I would have expected something more like a numeric confidence value. I am also not sure if the API would be deterministic.

Not sure either why they are providing an API to detect either and what you say make sense.

However, if my understanding is correct, the reason for the watermark / detections is that its not directly aimed at end-users, but to be able from them to detect if text was produced by one of their models so they don't use it as input in training data. So, yeah, in that context, not sure why they are announcing this with an ability for anyone to detect if it was produced by one of their models. Also, they are happy to ingest text produced by models they don't own? Maybe someone with more information can elaborate?

I thought the same thing. Maybe they can restrict it so that you can’t run the same text through multiple times with only one word differences. At least from an IP perspective that would start to get really expensive to rotate through IPs to get around a block like that.