5 votes

AI text watermarking is free and good

3 comments

  1. skybrian
    Link
    From the article: [...] [...] [...]

    From the article:

    Scott Aaronson, while working at OpenAI, largely solved AI text watermarking together with Hendrik Kirchner.

    Here is how his solution works, or see Tenobrus’s version.

    1. AI outputs are not deterministic. The AI’s job is to pick the probability of each potential next token. The token is then chosen at random.

    2. By default you use a source of pseudo-randomness for each choice, since actual true randomness is annoying.

    3. To apply the watermark, you use an otherwise identical private source of pseudo-randomness derived from a secret key.

    4. Then, given enough text, a score is derived for howe well the choices fit with that particular pseudo-randomness source, versus a different source.

    5. You provide an API that lets anyone check for the watermark.

    [...]

    Google implemented this, including for Gemini 3.7 Flash, and they have been rolling out this feature since 2024. Google has done, for over two years, the exact thing Anthropic is now doing, except with a public detector, and Google confirmed in a test (n = 20 million) that there is no difference in user feedback.

    Anthropic quietly announced a week ago they were rolling out watermarking to comply with the EU Code of Practice. Since they don’t want to have to differentiate traffic sources, the marginal cost is zero, and watermarking is pro-social, this will apply to everyone. They then offered an FAQ of how it works.

    [...]

    The entire practical effect is: There will be an API that will tell you if a given piece of writing comes from Claude. That’s it. And yet.

    [...]

    The rest of this post is about exploring why people are Big Mad about this, in large part as a worked example of how people get worked up over approximately nothing.

    3 votes
  2. pallas
    Link
    I wonder if one reason why people might seem angry with Anthropic's watermarking specifically is that Claude's specific writing style is so idiosyncratic and grating, to the point of being like a...

    I wonder if one reason why people might seem angry with Anthropic's watermarking specifically is that Claude's specific writing style is so idiosyncratic and grating, to the point of being like a human-discernible watermark, and is so difficult to reliably change, that they assume, perhaps even unconsciously, the watermarking must have something to do with it.

    What does make me angry is that, the last time I checked, Google's "public detector" for their watermarking is not a public detector, it's a private detector that their public LLM is allowed to use. You are forced to use their LLM chat, hope that their LLM decides to run the detector given your prompt, and then interpret its answer, along with whatever Google-perspective moralizing it added.

    3 votes
  3. skybrian
    Link
    This is counterintuitive because we know that word choices matter when we write, so how can choosing a different word not matter? Surely there are subtle grades of meaning to consider when picking...

    This is counterintuitive because we know that word choices matter when we write, so how can choosing a different word not matter? Surely there are subtle grades of meaning to consider when picking one synonym over another?

    That's going to depend on what words come before. In some positions, the next word will be highly constrained so it will always pick the next word the same way. There won't be any randomness at that position. At other places, the next word is a freer choice.

    This won't prevent the AI labs from working on improving AI writing style. As training gets better, LLM's will become more sensitive about word choices and less likely to choose randomly. So, the amount of freedom delegated to the random number generator will drop. Probably not to zero, though!

    2 votes