lol this is awesome. savvy operators will automate ways to remove the watermarks, but this will catch everyone below a certain level of sophistication with far more irrefutable proof than Pangram
something something bits something colour something
stripping jpg or pdf metadata is of course trivial. with text it’s gotta be some invisible unicode characters, right? so a pass through the right sed pipeline should uncolour those bits.
Confidently: invisible unicode characters are completely irrelevant
Unconfidently: gonna be a similar principle to this I bet:
A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example,
It's almost surely an implementation of an idea that OpenAI paid Scott Aaronson to develop and then decided not to use, because "they were worried (among other things) about risk to the product, customers hating the idea of watermarking and leaving for a competing LLM."
The basic idea is as follows:
The actual output of a model is a probability distribution over tokens, and then you use randomness to sample a token from that distribution (because always selecting the highest-probability token leads to getting stuck in ruts).
Periodically, the model will switch to using a pseudorandom seed based on recent tokens, rather than a fully random seed. This seed is the watermark.
If Anthropic re-runs the model to get the original distributions, they can detect that the text perfectly matches a watermark seed.
If a text contains several long segments that match a watermark seed, you can be highly confident that it's a lightly edited output of that model.
Possibly Anthropic has pushed the idea further to defeat some tricks (e.g. using the best closed-source model to produce an essay, then having a non-watermarked open model rephrase everything).















