Hacker News new | past | comments | ask | show | jobs | submit
simonw | on: How Claude marks AI-generated content
> When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.

I'd like to know a lot more about how that works.

A lot of my interactions with Claude return pretty precise text. If I ask it to edit a project and refactor a specific function in several places I know exactly what I want to happen, it will NOT be OK if those refactors have some kind of weird pattern baked into their text to act as a watermark.

I guess this may be covered by this:

> Content generated by Claude may not carry a detectable mark if, for example: [...] The passage is very short, leaving too little text for a reliable signal;

COAGULOPATH | parent | next
>I'd like to know a lot more about how that works.

My guess is that it works like Gemini's SynthID: by altering the logprobs of the next token.

Like, for every 10th token, instead of outputting the most probable, it outputs the 17th most probable, or something. (Obviously it's way more complicated but I think conceptually this is how it works.) No human will notice this, but a classifier trained on Claude's output will.

So it's not like the watermark is the words "le epic bacon" and Claude will output "le epic bacon" in everything. That would be extremely annoying (and easy to defeat).

loading story #49257247
KoolKat23 | root | parent | next
Less probable also means less optimal and you get a subpar response. More so if it's baked into its reasoning. It's intelligence will suffer unless this is some post processing thing.
loading story #49257070
thunfischtoast | root | parent | next
They still need to choose when to do that though. When I prompt the program to e.g. alter a bash script in a specific way or to recite a longer known text it can't go round and randomly exchange tokens. It has to somehow define what is a simple repeated text from a different origin and what is a novel generation.
user43928 | root | parent | next
I am wondering how that applies to newly generated code.

Odd variable naming? Stylistic choices that are watermarked?

Or as someone else noted further down in the comments, it could be more subtle:

Between the first and second most likely choice, in certain positions it will consistently choose in a certain way.

loading story #49254997
loading story #49256630
wpietri | root | parent
I would guess they're not worrying about watermarking a tweak to a human-written program. That's both a tiny fraction of Claude use and of very little concern to the kinds of people who want to check watermarks.
loading story #49257465
lozenge | root | parent | next
Most probable usually means for a specific prompt. How can this operate without the the original prompt?
ebtebt | root | parent
Just double checking my understanding: If this is true then only Anthropic will be able to detect if text was generated by one of its models, correct?
ForHackernews | root | parent
Likely yes.
loading story #49255737
akozak | parent | next
Most likely this method https://arxiv.org/pdf/2301.10226 (EDIT: and Google's SynthID paper which builds on it https://www.nature.com/articles/s41586-024-08025-4)
iamherrylok | root | parent | next
If different model providers use different green logits, does that mean they can only tell if the text came from their own model?
hannasanarion | root | parent
That "just add a constant to the green logits" as a fix to the entropy problem is so elegant I love it.
baq | parent | next
> I'd like to know a lot more about how that works.

Count load-bearing words using two different algorithms in a belt-and-braces fashion

jbs789 | root | parent | next
Fair - I should have been honest about the watermark.
r_lee | root | parent | next
One thing worth flagging: those words are load-bearing
loading story #49256854
dd8601fn | root | parent | next
That’s the real shape of the problem.
seamlessdev | root | parent | next
Belt, braces, and suspenders.
isoprophlex | root | parent
Don't forget the suppositories
quintu5 | root | parent
This is why I never use max effort! I’ll stick with my suspenders, thank you.
Razengan | root | parent
You’re absolutely right. Yo momma is doing a lot of heavy lifting here. Her load-bearing methods have the right shape.
infinite_spin | parent | next
My guess is it will be similar to how Genius watermarked lyrics, using things like variants of punctuation

https://www.pcmag.com/news/genius-we-caught-google-red-hande...

toxik | root | parent
In program code? Unlikely, surely¡
sixtyj | parent | next
It was quick :) … https://claudewatermarkremover.app/
loading story #49257103
s_dev | root | parent | next
So was it going down:

"Neutralize engine is temporarily unavailable. Try again."

shinryuu | root | parent
Though if pangram should be trusted, there are still statistical artifacts that tells you that a text LLM generated. I don't find that to be implausible.
timpera | root | parent
Alas, Pangram should not be trusted.
loading story #49256734
miohtama | parent | next
Maybe there is a reason why Opus 5 produces such word salad conversations
loading story #49256334
w_for_wumbo | parent | next
What happens if someone handwrites a Claude output, then someone uses that handwritten text as a reference. Now you've got a watermarked idea which may have no direct linkage to the usage of Claude.
loading story #49256036
phainopepla2 | root | parent | next
How is that different from referencing digital text that someone copied and pasted from Claude?
w_for_wumbo | root | parent
Because there's an expectation of authenticity from the written word. If you've referenced something handwritten, you don't expect it to be the output of an LLM.

Similarly, if you quote someone word-for-word, you wouldn't anticipate their words to be flagged as Claude content, but if someone memorized Claude output word-for-word. That would still be classified as a Claude output.

Going forward you could categorize the influence of Claude on a population based off a percentage match between their spoken words with the LLM prose.

dns_snek | root | parent
Are you worried about being accused of using LLMs to generate your work? As long as you don't plagiarize you have nothing to worry about.
Cthulhu_ | root | parent | next
I'm not too sure about that, people making stuff have already gotten penalized by overzealous AI detectors, most recently Kurtzgesagt.
platinumrad | root | parent | next
You can't make a blanket statement like this without knowing how the watermark is implemented.
AlecSchueler | root | parent
What if I unknowingly read content written by Claude in various articles and it influences my own writing style?
stabbles | parent | next
It will just thread some load-bearing seams through the paragraphs.
mihaelm | parent | next
> have some kind of weird pattern baked into their text to act as a watermark.

public abstract class BaseAnimalBeanFactoryGeneratedFromClaudeFactory

gajus | parent | next
Most likely watermark will be proportional to the input/output ratio, i.e. if you input a long document and ask to make edits, it will not attempt to watermark it. On the other hand, if you provide a tweet and ask it to write an article, that will include watermark. Just a guess (and yes, it feels flawed)
nprateem | parent | next
Load-bearing==claude
siva7 | parent
I can tell you how: Claude produces a huge wall of text with jargon ridden bullshit and invented terms no human subject matter expert would seriously use and overuse.