Hacker News Reader

There exist methods to detect what kind of watermarking tool that someone is using, and most of the big tools have specific signatures that you can look for.

For Anthropic, it’s highly likely that the watermark is a SynthID type mark similar to the one that Sean is talking about (I actually ran the analysis here https://johnjwang.com/post/2026/08/12/how-claude-watermarkin...). When we get confirmation of whether all models actually are watermarked, I think we’ll be even more confident.

Of course it’s always possible that Anthropic has come up with a proprietary scheme, but I think it’s definitely harder to implement.

I think the game will be a cat and mouse game similar to LinkedIn and other websites trying to block scrapers: each iteration makes it harder for someone to figure out the watermarking scheme, but likely not impossible

>There exist methods to detect what kind of watermarking tool that someone is using, and most of the big tools have specific signatures that you can look for.

Serious question… what is the point if you cant verify the watermark? Then only the model provider will know.

Is that what this law is about? I thought it was so anyone would know (which of course means anyone can bypass).

This always reminds me of the Trace Buster Buster Buster -scene from The Big Hit :D

https://www.youtube.com/watch?v=Iw3G80bplTg

There really isn't a whole lot of choice in how to do this big-picture wise. The cost of doing it post-generation would be way too high, so you need to do it while generating/sampling, meaning it has to be a statistical biasing of the sampling process.

If you can submit the text to determine whether it's watermarked, you just have to progressively alter the content more and more until it passes.

Yes this is what im trying to figure out. It means you cant be confident a negative is true. It sounds like this is the spirit of the law but it makes no sense. It would work better if only the model provider knows and the government can ask.

> the government can ask.

the government can ask .... who? If the claimed text is genuine, then the government is responsible for submitting the text to ...? all frontier labs? surely not every model within a lab is going to watermark in the same fashion?

I'm so very confused on this implementation and would want to see an expected use case.

This just shifts the legal responsibility to you.

Doing this manually would be very time consuming - you'd basically need to rewrite the entire text. What they are doing is altering the statistical properties of the entire generated text, essentially on a word by word basis - they are not just hiding a watermark pattern in there someplace.

>Anthropic's magic watermark could be, like the article mentions, something like "every 7th semicolon has a N% chance to be a comma where N is the sum of the last X characters mod Y, and every character in the bit range q1...q2 has a Z% chance to..." etc etc etc.

Doesnt this and probably all techniques require the validator to know which portion of the text to validate?

If its not all generated together then how could it reliably carry the mark? Sure, run it against the full text. But what if the full text was not one-shot by the llm?

In other words, in order to reliably detect if the text is ai you need to first determine which part of the text was generated together by ai.

I don't know if it's possible to achieve a watermark that is undetectable, has a low false positive rate, and survives a wholesale rephrasing. Can you make a statistical measure that reliably survives 95+% of the words being different and the sentences reordered? Of course the more of the content you replace, the lower the quality, but in many cases you probably care more about the meaning of the text than the exact choice of words.

>...and survives a wholesale rephrasing.

There's also literal language translation. Generate in language A, translate to language B (Either "manually" by being proficient in it, or with non-LLM translation).

A very, very significant portion of the world knows more than 1 language.

I think that would defeat the watermark. But low quality language translation tools have low quality output. If llm watermarks are defeated by making slop even sloppier, it’ll at least make it easier for humans to tell the difference.

And the more hoops you make cheaters jump through, the better.

>But low quality language translation tools have low quality output.

Perhaps, but no tools needed for those who know more than one language, which is a lot of people.

Yeah, but you’re still manually translating a whole essay or design document or whatever between languages. People who get LLMs to do their work for them do it because they don’t want to spend time and effort writing. Making people do a translation process like this removes some of the benefit of using an llm in the first place.

Watermarking will never be a perfect tool. But there’s a lot of value in making low effort llm slop detectable. Even if high effort llm slop is still undetectable. Don’t make perfect the enemy of good.

I don't think skillfully translating into idiomatic, grammatical, well written text is meaningfully easier then composing the text yourself in the first place.

If your goal is to defeat an AI detector for kicks, this might work. If your goal is to save effort by using AI to produce text, I don't think this works.

>I don't think skillfully translating into idiomatic, grammatical, well written text is meaningfully easier then composing the text yourself in the first place.

You don't think so based on what? One does not have to be a subject matter expert to translate from one language to another.

People that know more than one language are translating all the time, both consciously and unconsciously (While they're proficient in language A, they may "think" in language B). It's not as much effort as you think.

Most AI sloperators can't even be bothered to remove the EM dashes or emoji spam from older models. The watermark doesn't have to be literally impossible to remove. If someone spent significant effort to rephrase it then let them have it. But the bulk of spam will be easier to detect.

Well it depends on what you want to achieve.

Catch true positives? Sure

Reliably determine if text was generated by AI? Not even a little.

To remove the watermark you'd just need to paraphrase the text with another model that wasn't adding the statistical signature to it. You wouldn't need to know what the original statistical signature was.

It could be, but common, we all know that Anthropic's watermark is the using "load bearing", "genuine", and "seam" 1000x more in the same paragraph than any human in history.

Worth surfacing that you're absolutely right