Why am I being baited by watermark misinformation on this app, is it 2023 again?
A small FAQ:
๐ช๐ต๐ฎ๐'๐ ๐ฎ ๐๐ฒ๐ ๐ ๐๐ฎ๐๐ฒ๐ฟ๐บ๐ฎ๐ฟ๐ธ? -- A modification of the LLM sampling algorithm that, if there are multiple ways to write something, will pick one that agrees with a pseudorandom key. This is a local, invisible signature hidden in the way phrases are used in any LLM text that persists when text is copied.
๐๐ผ๐ฒ๐ ๐๐ต๐ถ๐ ๐บ๐ฎ๐ธ๐ฒ ๐๐ต๐ฒ ๐๐ฒ๐ ๐ ๐๐ผ๐ฟ๐๐ฒ? -- A good implementation is 'undetectable' (in polynomial time), meaning: If you do not have the private key, then neither you, the model itself, or pangram could detect that this is happening.
๐ช๐ถ๐น๐น ๐๐ต๐ถ๐ ๐ฏ๐ฟ๐ฒ๐ฎ๐ธ ๐๐ต๐ฒ ๐บ๐ผ๐ฑ๐ฒ๐น'๐ ๐ฟ๐ฒ๐ฎ๐๐ผ๐ป๐ถ๐ป๐ด? -- Because Ant already encrypts the model's reasoning, they can just not watermark the model's internal reasoning, leaving the thinking unaffected.
๐ช๐ถ๐น๐น ๐๐ต๐ถ๐ ๐บ๐ฎ๐ธ๐ฒ ๐๐ต๐ฒ ๐บ๐ผ๐ฑ๐ฒ๐น ๐น๐ฒ๐๐ ๐ฐ๐ฟ๐ฒ๐ฎ๐๐ถ๐๐ฒ/ ๐บ๐ผ๐ฟ๐ฒ ๐๐ฎ๐บ๐ฒ-๐? -- If anything this (marginally) increases entropy across different generations, so it will make model outputs slightly more varied.
๐๐๐ ๐ ๐ฐ๐ฎ๐ป ๐ท๐๐๐ ๐ฟ๐ฒ๐บ๐ผ๐๐ฒ ๐ถ๐ ๐ฝ๐ฎ๐ฟ๐ฎ๐ฝ๐ต๐ฟ๐ฎ๐๐ถ๐ป๐ด? -- Absolutely! But, judging from the amount of writing on the web that already unmistakably sounds like Claude, most people likely will not bother.
5b: Also, not any paraphrase will work. To remove (for example) a k=5-minhash watermark completely from a long document, you need to make sure none of the original 2-grams, 3-grams, 4-grams, 5-grams and 6-grams of the text remain.
๐ช๐ถ๐น๐น ๐๐ผ๐ ๐ถ๐ป๐ฎ๐ฑ๐๐ฒ๐ฟ๐๐ฒ๐ป๐๐น๐ ๐ฐ๐ผ๐ฝ๐ ๐๐ต๐ฒ ๐๐ฎ๐๐ฒ๐ฟ๐บ๐ฎ๐ฟ๐ธ? -- No, with a good implementation the space of possible realizations of the key is too large to memorize.
๐ช๐ถ๐น๐น ๐๐ต๐ถ๐ ๐ฎ๐น๐น๐ผ๐ ๐๐น๐ฎ๐๐ฑ๐ฒ๐ ๐๐ผ ๐ถ๐ฑ๐ฒ๐ป๐๐ถ๐ณ๐ ๐ผ๐๐ต๐ฒ๐ฟ ๐ถ๐ป๐๐๐ฎ๐ป๐ฐ๐ฒ๐ ๐ถ๐ป ๐ฎ ๐๐๐ฎ๐ฟ๐บ? -- The watermark will 'appear' like random sampler fluctuation to the model and would not be detectable. But, if an agent gets hold of a detector endpoint, it can absolutely use the watermark to ID other Claude agents (not that it would have trouble noticing them based on their writing as of today).
๐ช๐ถ๐น๐น ๐๐ต๐ถ๐ ๐ฑ๐ฒ๐๐ฒ๐ฐ๐ ๐ฑ๐ถ๐๐๐ถ๐น๐น๐ฎ๐๐ถ๐ผ๐ป? -- By default, no. If the watermark is set up to be 'undetectable' (as assumed above), it will not be picked up in training by other models. For that to happen, the watermark needs to be detectable by ML algorithms.
๐ช๐ถ๐น๐น ๐๐ต๐ถ๐ ๐บ๐ฎ๐ธ๐ฒ ๐ฃ๐ฎ๐ป๐ด๐ฟ๐ฎ๐บ'๐ ๐ท๐ผ๐ฏ ๐ฒ๐ฎ๐๐ถ๐ฒ๐ฟ? -- By default no, this is a separate avenue to detection. But, they might collaborate with Anthropic which would allow them to detect the watermark as well and show a watermark score next to their text detection score.
Bonus: All aside, is this a good idea? I don't know. The companies are doing it to follow the writing of the EU AI act, which was written based on 2024 information and when the field looked very different, and threat models were focused much more on slop/propaganda (like the Kokotajlo 2026 prediction). The actual 2026 looks quite a bit different.