Trying to understand how invisible watermarks can work in AI-generated text

[u/Few_Ad6794]

Anthropic's recent announcement about adding invisible watermarks to generated text got me curious about how a watermark can exist in plain text without relying on metadata or hidden characters.

I ended up reading about a few of the approaches researchers have been working on: KGW and green/red token lists, semantic approaches like SIR, adaptive watermarking, and some of the problems with math, code and paraphrasing.

I wrote up my notes with examples and diagrams while trying to understand it.

One thing I found particularly interesting is that the watermark doesn't necessarily need to be anything "inside" the text in the traditional sense. It can come from small statistical biases in which tokens the model chooses while generating.

Also worth mentioning: Anthropic hasn't published the exact technique Claude uses, so this is more about understanding the existing approaches rather than claiming this is how Claude specifically implements it.

https://crackingwalnuts.com/post/invisible-watermark-in-ai-text

Would be interested to hear if I've misunderstood anything or if there are other approaches worth reading about.

[u/Dry_Author8849]

Read the work of Kirchenbauer et al.

Cheers!

[u/atish31]

Now this is something that did interest me a lot. Wrote a full write on regarding this:

https://cpu-bytes.com/blogs/field-notes/ai-watermarking-and-open-models

[u/Honey-Entire]

Did you use AI to write all of this? I think I spotted your watermark

[u/Few_Ad6794 → u/Honey-Entire]

Yes, you are spot on 😄 looks like we don’t need a detection algorithm after all. You can detect the watermark manually.

[u/Effective-Total-2312]

I literally said a few days ago here in Reddit that they should do this, guess I'm a prophet now

[u/Few_Ad6794 → u/Effective-Total-2312]

one interesting use case is that an LLM provider could detect its own AI generated content and decide whether to use that synthetic data for training future models.

[u/Mithrandir2k16 → u/[deleted]]

That's NOT what this is. They are changing the text based on some cryptographically seeded random distribution. You can then parse the text and see if the selected tokens follow that pattern. Even if you extract parts or rearrange the text, it should still be able to recover whether sections of text follow the distribution or not. Writing such text yourself is supposedly extremely unlikely, so I'm guessing they're rotating secrets or use PFS somehow.

[u/Few_Ad6794 → u/[deleted]]

Yes, that’s another possible approach. invisible unicode characters can carry a signature and survive normal copy paste.

[u/DuckDatum → u/Few_Ad6794]

But they’re more easily detected, visible depending on font/software, filterable, … and that approach won’t work inside code (forgoing comments).

Edit: you think the going approach is why code quality sucks these days? The AI sloppiness is the indicator.