Text Watermarking in Python: Catch Whoever Copies Your Writing

Python 文本水印：揪出抄袭你文章的人

On August 2, 2026, Anthropic began watermarking every piece of text Claude produces. Since 2024, Gemini (Google) has used SynthID-Text, a method they published in Nature and later open-sourced. OpenAI built something similar. China has required embedded labels on AI-generated content since September 2025, and nearly 190 organizations have signed the EU’s transparency code. 2026 年 8 月 2 日，Anthropic 开始为其 Claude 生成的每一段文本添加水印。自 2024 年起，Google 的 Gemini 就开始使用 SynthID-Text，这是一种他们在《自然》杂志上发表并随后开源的方法。OpenAI 也构建了类似的技术。中国自 2025 年 9 月起要求对 AI 生成的内容进行嵌入式标注，且已有近 190 家机构签署了欧盟的透明度准则。

The result: billions of words generated from these systems every day carrying an invisible mark—not metadata that vanishes on copy-paste, but a signal baked into the words themselves. 结果是：这些系统每天生成的数十亿字都带有隐形标记——这并非复制粘贴后就会消失的元数据，而是嵌入在文字本身的信号。

So if AI companies can do that, can you? 那么，如果 AI 公司能做到这一点，你也可以吗？

Most people assume no. Images have pixels to tweak; audio has a spectrum. Text is just characters. If someone scrapes your writing and claims it, it’s your word against theirs. 大多数人认为不行。图像有像素可以调整，音频有频谱可以处理。而文本只是字符。如果有人抓取了你的文章并据为己有，那只能是各执一词。

That assumption is wrong. A century ago, mapmakers, dictionary editors, and at least one very annoyed lyrics company figured this out long before language models existed. 这种假设是错误的。一个世纪前，地图绘制者、词典编辑以及至少一家非常恼火的歌词公司，早在语言模型出现之前就解决了这个问题。

You can watermark plain text three ways, each leaving a detectable signal: 你可以通过三种方式为纯文本添加水印，每种方式都会留下可检测的信号：

• Invisible characters: easiest to add, easiest to erase. Any sanitizer or chatbot pass wipes them out. 隐形字符： 最容易添加，也最容易擦除。任何清理工具或聊天机器人处理一遍就会将其抹去。
• Keyed word choices: specific substitutions based on a hidden key. Survives light editing, but a full rewrite kills it. 密钥词汇选择： 基于隐藏密钥进行的特定替换。能经受轻微编辑，但彻底重写会使其失效。
• Meaning-level marks (rigged sampling): hardest to remove. It holds up better under rewriting, but the signal weakens. Durability always costs strength. 语义级标记（操纵采样）： 最难移除。它在重写后表现更好，但信号会减弱。耐用性总是以牺牲强度为代价的。

A text watermark isn’t a visible stamp. It’s a pattern of choices only you know. 文本水印不是可见的印章，而是只有你自己知道的选择模式。

1. Who this is for, and what you’ll get

1. 本文受众及你将获得的内容

If you publish writing online and want more than a guess when it gets copied, this is for you. 如果你在网上发布文章，并且希望在文章被抄袭时能有确凿证据而非仅仅是猜测，那么本文适合你。

You’ll get: 你将获得：

• A simple coin-flip intuition for three types of text watermarking. 关于三种文本水印的简单“抛硬币”直觉理解。
• An 80-line, standard-library-only script that embeds a 32-bit ID in text and detects it later. 一个仅使用标准库、80 行代码的脚本，用于在文本中嵌入 32 位 ID 并进行后续检测。
• A keyed word-choice watermark, a model-free detector, and a meaning-aware upgrade—plus where they fall short in practice. 一种密钥词汇选择水印、一种无需模型的检测器以及一种语义感知升级版——以及它们在实践中的局限性。
• Real-world survival tests across 12 channels, several editing attacks, full paraphrasing, and Chinese translation. 跨越 12 个渠道的真实生存测试、多种编辑攻击、全文改写以及中文翻译测试。
• A practical rule for choosing the right watermark for the threat. 针对不同威胁选择合适水印的实用准则。

Everything was tested on real models: Gemma-2-9b-it for watermarking and Qwen2.5-7B-Instruct for attacks, running on an NVIDIA GB10. The test set included 50 original paragraphs and 100 public-domain passages for false-positive checks. 所有内容均在真实模型上进行了测试：使用 Gemma-2-9b-it 进行水印处理，使用 Qwen2.5-7B-Instruct 进行攻击测试，运行在 NVIDIA GB10 上。测试集包含 50 段原创段落和 100 段公有领域文本，用于进行误报检查。

The scripts, corpus, and calibration data are all in text-watermarking-toolkit, so you can reproduce the results yourself. 脚本、语料库和校准数据均已上传至 text-watermarking-toolkit，你可以自行复现这些结果。

2. People have been watermarking text for a century

2. 人们给文本加水印已经有一个世纪了

Long before watermarking became cryptographic, it was used in a much simpler way: hide a tiny, deliberate mistake or variation, then see who copies it. 在水印技术变得加密化之前，它曾以一种简单得多的方式被使用：隐藏一个微小且刻意的错误或变体，然后观察谁会抄袭它。

Figure 1 — A century of text watermarking, split by what does the recognising. Above the 2006 line, marks were planted by hand and spotted by a human who knew what to look for; below it, both halves become a key and a hypothesis test. Image by author. 图 1 — 一个世纪的文本水印技术，按识别方式划分。2006 年线以上，标记由人工植入，并由知情的观察者发现；线以下，两端分别演变为密钥和假设检验。图片由作者提供。

2.1 Trap streets

2.1 陷阱街道

One example is from mapmakers. Mapmakers inserted fake streets, towns, or landmarks into maps. If the same fake feature appears on a competitor’s map, the source of the copying is obvious. 一个例子来自地图绘制者。他们会在地图中插入虚构的街道、城镇或地标。如果竞争对手的地图上出现了同样的虚构特征，抄袭来源就显而易见了。

In 1925, the General Drafting Company added a fake New York town called Agloe, named from its founders’ initials. Years later, a store opened at the crossroads and adopted the name. The fictional town had effectively become real. 1925 年，通用制图公司（General Drafting Company）添加了一个名为 Agloe 的虚构纽约城镇，名字取自创始人的首字母缩写。多年后，一个商店在十字路口开业并采用了这个名字。这个虚构的城镇实际上变成了现实。

Figure 2 — The trap street. One invented street costs the map nothing and eventually becomes the copy of others. Image by author. 图 2 — 陷阱街道。一条虚构的街道对地图绘制成本毫无影响，却最终成为他人抄袭的证据。图片由作者提供。

2.2 Mountweazels

2.2 虚构条目（Mountweazels）

Reference books use the same trick with fake entries. The New Columbia Encyclopedia famously included Lillian Virginia Mountweazel, a fictional photographer with an elaborate biography. The New Oxford American Dictionary later planted esquivalience, supposedly meaning “the wilful avoidance of one’s official responsibilities.” 参考书也用同样的伎俩设置虚构条目。《新哥伦比亚百科全书》曾著名地收录了 Lillian Virginia Mountweazel，一位有着详尽生平的虚构摄影师。《新牛津美语大辞典》后来植入了“esquivalience”一词，意指“蓄意逃避个人职责”。

Neither was real. Both were bait: if another reference work reproduced them, that was evidence of copying. 两者都不是真实的。它们都是诱饵：如果其他参考书转载了这些内容，那就是抄袭的证据。

Figure 3 — The mountweazel. Same idea in a reference book: a word with no referent cannot be independently researched, only copied. Image by author. 图 3 — 虚构条目。参考书中的同理：一个没有指代对象的词无法被独立研究，只能是被抄袭。图片由作者提供。

2.3 Canary traps

2.3 金丝雀陷阱

A canary trap takes the idea one step further. Instead of giving everyone the same fake detail, each recipient gets a slightly different version. If the document leaks, the variation identifies whose copy it came from. 金丝雀陷阱将这一理念更进一步。它不是给每个人相同的虚构细节，而是给每个接收者提供略有不同的版本。如果文档泄露，这些差异就能识别出泄露源自谁的副本。

Elon Musk has said Tesla used this technique in 2008 by varying whether sentences were separated by one space or two. Those tiny differences formed a binary signature unique to each recipient. 埃隆·马斯克曾表示，特斯拉在 2008 年就使用了这种技术，通过改变句子间是一个空格还是两个空格来区分。这些微小的差异构成了每个接收者独有的二进制签名。

Figure 4 — The canary trap. Every recipient gets the same words and a different invisible pattern, so a leaked copy names the leaker. Image by author. 图 4 — 金丝雀陷阱。每个接收者得到相同的文字但带有不同的隐形模式，因此泄露的副本可以直接锁定泄露者。图片由作者提供。

2.4 Genius vs. Google

2.4 Genius 对阵 Google

The most important example here is one where the watermark apparently worked — but the lawsuit still failed. Lyrics site Genius suspected Google was reproducing its transcriptions in search results. Genius began alternating straight and curly apostrophes in a pattern that, when read as Morse code, spelled REDHANDED. 这里最重要的例子是水印显然起到了作用，但诉讼却失败了。歌词网站 Genius 怀疑 Google 在搜索结果中复制了他们的转录内容。Genius 开始交替使用直引号和弯引号，其模式读作摩尔斯电码时，拼写为“REDHANDED”（当场抓获）。

The pattern was seeded into 301 songs and reportedly appeared in Google’s results for 116 of them. Genius later used a second watermark based on different types of spaces, encoding the word Genius. 这种模式被植入到 301 首歌曲中，据报道在 Google 的搜索结果中出现了 116 次。Genius 后来使用了基于不同空格类型的第二种水印，编码了“Genius”一词。

Figure 5 — Genius’s apostrophes. Straight is a dot, curly is a dash, and the sequence spells REDHANDED in Morse: the last hand-planted watermark in the story, and the first carrying a real payload. Image by author. 图 5 — Genius 的引号。直引号代表点，弯引号代表横，序列在摩尔斯电码中拼写为 REDHANDED：这是故事中最后一次人工植入的水印，也是第一个携带实际载荷的水印。图片由作者提供。

It sued Google for $50 million in 2019. The case was dismissed in 2020, not because the watermark failed, but because Genius did not own the underlying lyrics; it licensed them. Genius 在 2019 年起诉 Google 并索赔 5000 万美元。该案在 2020 年被驳回，原因并非水印失效，而是因为 Genius 并不拥有这些歌词的版权；它只是获得了授权。

That distinction matters: A watermark can show that your version of a text was copied. It cannot, by itself, prove that you owned the text in the first place. 这一区别至关重要：水印可以证明你的文本版本被抄袭了，但它本身无法证明你最初就拥有该文本的所有权。

3. The coin-flip analogy

3. 抛硬币类比

Imagine that while writing, you repeatedly make a hidden binary action: insert one of two invisible characters, choose between two synonyms, or pick between two equally plausible next words. 想象一下，在写作时，你反复进行一个隐藏的二进制操作：插入两个隐形字符之一，在两个同义词之间做选择，或者在两个同样合理的后续词之间进行挑选。

One matching choice proves nothing: it has a 50% chance of happening by accident. But if 3… 一个匹配的选择证明不了什么：它有 50% 的概率是偶然发生的。但如果 3……