Anthropic’s ‘watermark’ text adulteration in Claude is a perversion of writing

Anthropic 在 Claude 中加入的“水印”文本篡改是对写作的扭曲

When I wrote this week about Anthropic’s announcement that all Claude models, worldwide, would soon begin “watermarking” everything they generate, including text, to comply with this EU regulation, we were left to speculate how this was going to work, because Anthropic offered not even a vague description of how it would work — despite the fact that the title of the announcement was, absurdly and insultingly, “How Claude Marks AI-Generated Content”.

本周我撰文谈及 Anthropic 的公告，称全球所有 Claude 模型很快将开始对其生成的所有内容（包括文本）进行“加水印”，以符合欧盟的相关法规。当时我们只能猜测这究竟是如何运作的，因为 Anthropic 甚至没有提供任何模糊的说明——尽管该公告的标题荒谬且令人反感地写着“Claude 如何标记 AI 生成的内容”。

My initial speculation was that maybe they’d hide invisible non-printing Unicode characters in the text. Just spitballing. Turns out that’s not what they’re going to do. What they’re going to do is apply a form of steganography, where the choice of words (or other token output) at inference time will leave fingerprints that can later, maybe, be detected probabilistically.

我最初的猜测是，他们可能会在文本中隐藏不可见的非打印 Unicode 字符。这只是随口一说。事实证明，他们并不打算这样做。他们要做的是应用一种隐写术，即在推理过程中对词汇（或其他 Token 输出）的选择会留下指纹，这些指纹随后或许可以通过概率方法被检测出来。

I initially guessed “invisible characters” not because I didn’t think of the semantic word-choice technique, but because I was a fool who took Anthropic at its word in their description of what they would do. Their original support document claims: When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.

我最初猜测是“不可见字符”，并不是因为我没考虑到语义词汇选择技术，而是因为我太傻，竟然相信了 Anthropic 对其做法的描述。他们最初的支持文档声称：当受支持的 Claude 模型生成文本时，它会将一个不可察觉的水印直接编织进文本本身。你看不见它，它也不会改变 Claude 回复的含义、质量或可读性。

They say “imperceptible” and “doesn’t change the meaning, quality, or readability”. Their words. Not almost imperceptible. Not slightly changes the meaning, quality, or readability. That made sense to me, because that’s absolutely what I want — nay, demand — from any tools I use personally. It’s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance.

他们用了“不可察觉”和“不改变含义、质量或可读性”这样的词。这是他们的原话。不是“几乎不可察觉”，也不是“轻微改变含义、质量或可读性”。这对我来说很有道理，因为这绝对是我对我个人使用的任何工具所期望的——甚至可以说是要求的。如果一个工具为了在文本中嵌入隐藏线索以表明其来源，而牺牲了哪怕一丝清晰度、连贯性、含义或质量，那是不可接受的。

That’s what I would and will demand. And Anthropic’s (original) support document unambiguously claims that’s what their system will enable. So if that were true, I couldn’t see what was left other than hiding invisible characters within the text. My error was believing Anthropic that their system wouldn’t adulterate and corrupt the semantics of the text their models generate. That is in fact exactly what they plan to do.

这就是我所要求并将继续要求的。而 Anthropic（最初的）支持文档明确声称他们的系统能够做到这一点。所以如果这是真的，除了在文本中隐藏不可见字符外，我想不出还有什么其他方法。我的错误在于相信了 Anthropic，认为他们的系统不会篡改和破坏其模型生成的文本语义。而事实上，这正是他们计划要做的事情。

I should have my head examined for believing a single word of a document titled “How Claude Marks AI-Generated Content” that doesn’t explain, at all, how Claude marks (or will mark) AI-generated content.

我真该去检查一下脑子，竟然会相信一份题为“Claude 如何标记 AI 生成的内容”的文档中的任何一个字，而这份文档根本没有解释 Claude 是如何（或将如何）标记 AI 生成内容的。

How It’s Actually Going to Work

它实际上将如何运作

Yesterday, on an entirely different website than the original “How Claude marks AI-generated content” article (the one that didn’t explain anything at all about how it works), Anthropic published “How Claude’s Text Watermark Works”, which does actually explain in layman-accessible terms how it’s going to work. I will return to Anthropic’s new highly euphemistic and slightly misleading description below.

昨天，在与最初那篇“Claude 如何标记 AI 生成的内容”（那篇完全没解释运作原理的文章）完全不同的网站上，Anthropic 发布了“Claude 的文本水印是如何运作的”，这篇文章确实用通俗易懂的语言解释了其运作方式。我将在下文回到 Anthropic 这篇充满委婉语且略带误导性的新描述上。

There’s a bunch of research on this topic, some of which I have also linked to below. But the very best description of the general idea behind the technique is an interactive essay by James Padolsey, “How AI Text Watermarking Works”. It’s a wonderfully cogent read, and the interactive elements splendidly illustrate the main concepts. A+ work. If you have any interest in this at all, I dare say you must read — and play with — Padolsey’s piece.

关于这个主题有很多研究，我在下文也链接了一些。但对该技术背后基本理念的最佳描述，是 James Padolsey 的交互式文章《AI 文本水印是如何运作的》。这是一篇非常精辟的文章，其中的交互元素出色地阐释了核心概念。满分作品。如果你对此有任何兴趣，我敢说你一定要读一读——并亲自体验一下——Padolsey 的文章。

But here’s my stab at a layman’s high-level summary. If you toss a coin N times and note the results, you can determine with a degree of certainty whether the coin is fair or biased. LLMs are, in their popular incarnations, non-deterministic. Ask the same question of the same model and you often get at least slightly different answers. Maybe the same meaning, but different phrasing.

以下是我对该技术的高层通俗总结。如果你抛硬币 N 次并记录结果，你就可以在一定程度上确定这枚硬币是公平的还是有偏向的。大语言模型（LLM）在目前的流行版本中是非确定性的。对同一个模型问同一个问题，你通常会得到至少略有不同的答案。也许含义相同，但措辞不同。

At each decision point for generating the next token, the model makes a choice. With these semantic watermarking techniques, they make different choices for some tokens based on word lists that could be called “green” and “red”. At each decision point, they’re a little more likely to pick a word from the green list than the red list. That doesn’t mean they never choose words from the red list. Just that they’re less likely to than they would if the adulterated marking technique weren’t in place.

在生成下一个 Token 的每个决策点，模型都会做出选择。通过这些语义水印技术，它们会根据可以被称为“绿色”和“红色”的词表，对某些 Token 做出不同的选择。在每个决策点，它们选择“绿色”列表中的词的概率会比“红色”列表中的词稍高一些。这并不意味着它们从不选择红色列表中的词，只是说相比没有这种篡改标记技术的情况，它们选择红色词的概率降低了。

(Same way that a crooked 51-49 coin will still land “wrong” side up 49 times out of 100 on average.) Words or word phrases are sorted into the green and red lists deterministically on the fly, at each “next token” generation point. So sometimes a specific word will be on the green list, and other times it will be on the red list. Someone with the secret key can determine which list a word will be on at each token generation point (which is how the watermarking is detected); those without the secret key cannot.

（就像一枚 51-49 的作弊硬币，平均每 100 次抛掷中仍会有 49 次出现“错误”的一面。）词汇或短语在每个“下一个 Token”生成点，会被实时且确定性地分配到绿色和红色列表中。因此，同一个词有时会在绿色列表中，有时会在红色列表中。拥有密钥的人可以确定在每个 Token 生成点某个词属于哪个列表（这就是水印被检测出的方式）；而没有密钥的人则无法做到。

This means there will never be a list of words that Claude prefers or eschews. With coin flipping, the higher N is — the more times you flip — the more confident you can be that the coin is fair or biased. So too with this semantic watermarking. The more words in the text, the more accurate the analysis will be that the text was generated by a specific AI model or not.

这意味着永远不会存在一个 Claude 偏好或回避的固定词表。在抛硬币实验中，N 越大（抛掷次数越多），你对硬币是否公平的判断就越有把握。这种语义水印也是如此。文本中的词越多，分析该文本是否由特定 AI 模型生成的准确性就越高。

With too few coin flips, you can’t achieve any confidence at all regarding a coin’s fairness. With too few words (or tokens), there’s no way to achieve any confidence whether a string of text was AI-generated or not. Given a string of text to examine for signs of a specific watermarking system, if there are more words tagged as green and fewer tagged as red than would otherwise be expected, the text can be flagged — with some degree of confidence — as having been generated, or merely modified, by the AI system that applies the specific secret-key watermarking system.

如果抛硬币次数太少，你根本无法确定硬币是否公平。同样，如果词数（或 Token 数）太少，也无法确定一段文本是否由 AI 生成。给定一段文本来检查是否存在特定水印系统的迹象，如果其中被标记为“绿色”的词比预期多，而“红色”的词比预期少，那么该文本就可以被标记——并具有一定的置信度——为是由应用了该特定密钥水印系统的 AI 系统生成或修改的。