Hacker News Reader

Comment by Tiberium | Hacker News Reader

This is just C2PA for Claude-processed files, apparently. It's not related to their text watermarking.

C2PA is file metadata and can be trivially stripped away, unlike hidden watermarks, e.g. SynthID.

That is where their responsibility ends in terms of the EU AI Act. And that is fine and how it should be, no secret watermarks.

Watermarks should even be removable "if substantially proofread or altered" in the EU for the text from an LLM, that you verify to be as true as if you wrote it yourself. Not clear is this is a may, shall, or should. It certainly is not a must.

Watermarks cane even be removed, "if substantially proofread" in the EU, law says. For the text from an LLM, that you verify to be as true as if you wrote it yourself. Not clear is this is a may, shall, or should. It certainly is not a must.

(If you post a comment here on HN, then hit the back button, edit your comment, and click “reply” again, you end up posting multiple comments. That’s what’s happened here.)

It's not gonna survive my linter in a tightly coupled code base where it's not allowed to write comments but I do resent it for trying.

There's no way text watermarking isn't causing a degradation in writing quality.

Text watermarking will surely cause a degradation in quality writing.

There's is no text watermarking that doesn't cause a decline in writing quality.

Writing quality will surely deteriorate if text watermarking is implemented.

Maybe this is silly: what about zero-width spaces or other hidden characters? Add them in post-processing, and the response quality doesn't degrade (though rendering etc. might be wonky).

That would be so much worse. Code written that doesn't work, SQL that couldn't be parsed, ...

Yes, it is silly. Stripping these is about as trivial as removing "this post was written by Claude" appended in plaintext. You could make a clipboard monitor that does this as soon as you CTRL+C, it's a 1-shot prompt. Not to mention that these wonky Unicode chars will break in every other program.

Stripping Anthropic's watermarking, however, is more difficult - probably about 2 prompts.

But your average joe won't "setup custom clipboard monitor to auto clip out whitespace". That's why Gemini still include its logo into generated picture even if it's trivial to crop it out

Ok, sounds like a watermark of “this post was written by Claude” is sufficient then. Or don’t add any at all - the average joe is that Canadian politician whose speech included “here is a more natural-flowing version of that section that sounds more like legislative speech rather than a series of short points.”

A lot of random-ish numbers go into LLM output and there's a lot of room to hide signals in random-ish numbers.

The real problem is false positives. One false positives is enough to make the whole thing dangerous. The results can't really be acted upon without risking defamation. If you admit that you redistributed someone else's copyrighted work to an AI company that never forgets, it's an admission of distributing copyrighted works.

The law should have at the very least required offline validation tools that cannot track or retain a copy of the documents being checked.

> offline validation tools

As soon as the validator is available without a rate-limit, just apply input fuzzing to defeat it.

Watermarks can even be removed, "if substantially proofread" in the EU, law says (for now. There might be a transition period on that).

For the text from an LLM, that you verify to be as true as if you wrote it yourself.

Not clear if making watermarks removable is a may, shall, or should, according to legislation. It certainly is not a must.

The way I read it, I thought they would just check if the file hash exists on their end. Is that not the case?

That’s incompatible with the file not leaving your browser, which you can trivially verify with the Network tab in chrome (or wireshack, etc).

This is just a C2PA metadata checker.

Why? The browser can see the file and contents so it can calculate and send the hash over without the actual file ever leaving the browser.

Strictly speaking, properly checking C2PA metadata requires network requests in the general case, because you need to check if the signing certificate has been revoked or not via OCSP.

But in anthropic's use case they can probably get away with just pinning their own certs in the verification webpage.

> I thought they would just check if the file hash exists on their end

That would invalidate the hash on minor changes. Too much effort and not enough return.

Reply on news.ycombinator.com