Anthropic 文本水印机制 FAQ 解读
Anthropic 在 Claude 中引入文本水印，通过修改 LLM 采样算法嵌入伪随机密钥签名，无密钥者在多项式时间内无法检测。该机制不影响模型推理（内部思维链不加水印），且略微提升输出多样性；改写可去除水印，但需确保长文档中所有 2-gram 至 6-gram 均不残留。默认设置下水印无法被其他模型在训练中习得，也不会让 Pangram 等检测工具更易识别。
Why am I being baited by watermark misinformation on this app, is it 2023 again?
A small FAQ:
1. 𝗪𝗵𝗮𝘁'𝘀 𝗮 𝘁𝗲𝘅𝘁 𝘄𝗮𝘁𝗲𝗿𝗺𝗮𝗿𝗸? -- A modification of the LLM sampling algorithm that, if there are multiple ways to write something, will pick one that agrees with a pseudorandom key. This is a local, invisible signature hidden in the way phrases are used in any LLM text that persists when text is copied.
2. 𝗗𝗼𝗲𝘀 𝘁𝗵𝗶𝘀 𝗺𝗮𝗸𝗲 𝘁𝗵𝗲 𝘁𝗲𝘅𝘁 𝘄𝗼𝗿𝘀𝗲? -- A good implementation is 'undetectable' (in polynomial time), meaning: If you do not have the private key, then neither you, the model itself, or pangram could detect that this is happening.
3. 𝗪𝗶𝗹𝗹 𝘁𝗵𝗶𝘀 𝗯𝗿𝗲𝗮𝗸 𝘁𝗵𝗲 𝗺𝗼𝗱𝗲𝗹'𝘀 𝗿𝗲𝗮𝘀𝗼𝗻𝗶𝗻𝗴? -- Because Ant already encrypts the model's reasoning, they can just not watermark the model's internal reasoning, leaving the thinking unaffected.
4. 𝗪𝗶𝗹𝗹 𝘁𝗵𝗶𝘀 𝗺𝗮𝗸𝗲 𝘁𝗵𝗲 𝗺𝗼𝗱𝗲𝗹 𝗹𝗲𝘀𝘀 𝗰𝗿𝗲𝗮𝘁𝗶𝘃𝗲/ 𝗺𝗼𝗿𝗲 𝘀𝗮𝗺𝗲-𝘆? -- If anything this (marginally) increases entropy across different generations, so it will make model outputs slightly more varied.
5. 𝗕𝘂𝘁 𝗜 𝗰𝗮𝗻 𝗷𝘂𝘀𝘁 𝗿𝗲𝗺𝗼𝘃𝗲 𝗶𝘁 𝗽𝗮𝗿𝗮𝗽𝗵𝗿𝗮𝘀𝗶𝗻𝗴? -- Absolutely! But, judging from the amount of writing on the web that already unmistakably sounds like Claude, most people likely will not bother.
5b: Also, not any paraphrase will work. To remove (for example) a k=5-minhash watermark completely from a long document, you need to make sure none of the original 2-grams, 3-grams, 4-grams, 5-grams and 6-grams of the text remain.
6. 𝗪𝗶𝗹𝗹 𝘆𝗼𝘂 𝗶𝗻𝗮𝗱𝘃𝗲𝗿𝘁𝗲𝗻𝘁𝗹𝘆 𝗰𝗼𝗽𝘆 𝘁𝗵𝗲 𝘄𝗮𝘁𝗲𝗿𝗺𝗮𝗿𝗸? -- No, with a good implementation the space of possible realizations of the key is too large to memorize.
7. 𝗪𝗶𝗹𝗹 𝘁𝗵𝗶𝘀 𝗮𝗹𝗹𝗼𝘄 𝗖𝗹𝗮𝘂𝗱𝗲𝘀 𝘁𝗼 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝘆 𝗼𝘁𝗵𝗲𝗿 𝗶𝗻𝘀𝘁𝗮𝗻𝗰𝗲𝘀 𝗶𝗻 𝗮 𝘀𝘄𝗮𝗿𝗺? -- The watermark will 'appear' like random sampler fluctuation to the model and would not be detectable. But, if an agent gets hold of a detector endpoint, it can absolutely use the watermark to ID other Claude agents (not that it would have trouble noticing them based on their writing as of today).
8. 𝗪𝗶𝗹𝗹 𝘁𝗵𝗶𝘀 𝗱𝗲𝘁𝗲𝗰𝘁 𝗱𝗶𝘀𝘁𝗶𝗹𝗹𝗮𝘁𝗶𝗼𝗻? -- By default, no. If the watermark is set up to be 'undetectable' (as assumed above), it will not be picked up in training by other models. For that to happen, the watermark needs to be detectable by ML algorithms.
9. 𝗪𝗶𝗹𝗹 𝘁𝗵𝗶𝘀 𝗺𝗮𝗸𝗲 𝗣𝗮𝗻𝗴𝗿𝗮𝗺'𝘀 𝗷𝗼𝗯 𝗲𝗮𝘀𝗶𝗲𝗿? -- By default no, this is a separate avenue to detection. But, they might collaborate with Anthropic which would allow them to detect the watermark as well and show a watermark score next to their text detection score.
10. Bonus: All aside, is this a good idea? I don't know. The companies are doing it to follow the writing of the EU AI act, which was written based on 2024 information and when the field looked very different, and threat models were focused much more on slop/propaganda (like the Kokotajlo 2026 prediction). The actual 2026 looks quite a bit different.