Anthropic has revealed how it’s watermarking text generated by Claude AI to comply with the European Union’s new AI transparency rules. The company said its text watermarking will not have easy-to-see visuals, will not be distinguishable to the people who read it and will not be adding hidden characters to the text. Instead, Anthropic’s method involves leaving a pattern in the text that can only be decoded by someone who has the key for it.
The company explained that large language models pick one word at a time when generating text by choosing from a list of potential appropriate words to use. They pick words randomly, as long as they make sense for the context of what they’re generating. With watermarking on, Claude will use a key to decide on what word to choose instead of using an arbitrary random number generator to pick the next word.
In its example, Anthropic used the digits of pi as a key. Say, the key starts with the digit 2 from the pi sequence 3.1415926535. The next word generated is the sixth in the list of choices, then the fifth, the third and then the fifth again. This method is an adaptation of Google DeepMind’s SynthID-Text approach to watermarking, which the team described in a paper published in Nature. Watermarking doesn’t affect the quality of Claude’s output or slow it down, the company said, and it will not require extra tokens or make generations more expensive.
Of course, AI-generated prose typically has tells. Models are fond of using certain sentence constructions like “this isn’t [X], it’s [Y],” for instance. But those tells are only enough to let you know that an AI was involved in writing that text, not the model used. Anthropic will release an API that has “keys” to decode Claude’s watermarking and will be able to say whether the its AI generated the block of text being checked.
Anthropic admits that its text watermarking method does have limitations. It can’t tell whether Claude actually wrote the text or just edited it, which means if you ask the AI to edit something for you, it will be watermarked too. As the company explains, it can only tell that Claude was likely involved with the text at some point. Even translations will be watermarked. If Claude has only proofread and lightly edited the text, or if the text is too short, the watermark may not be enough to be detectable. Take note that lightly editing Claude-generated text probably won’t remove its watermark. If you want to be sure, you will need to rewrite it completely.
There have been some concerns on how watermarking would affect code, since it may not be copyrightable without significant human input. If one could prove that an entire codebase was AI-generated, they could copy and then iterate on it. Anthropic said, though, that code has “generally less watermarking than some other forms of text” because it typically requires exact output. If there are no choices to be made in the text generation, then watermarking can’t be applied.
Anthropic will also watermark images by adding a cryptographically signed note in its metadata that says it was generated by Claude. In its announcement, the company said it was applying watermarks to all of Claude’s output at launch because it doesn’t have sure ways to implement the changes by region. The changes will affect output across all Claude products that use models released after August 2. Anthropic will also add watermarking capability to older Claude models over the coming months.
