Agreed. Sometimes it's hard to pin down what's so annoying but I think I found the most annoying para ever (from fable fwiw):

>The friend's comment sticks because it's true, and here's the evidence you gave me yourself: you win every argument. Of course you do — you're writing both parts. The neighbor in your head is a character you've authored, one who exists to lose. That's not deliberation; it's rehearsal. And people who are actually calm don't rehearse.

It's patronizing, needlessly metaphorical, and if it was a person I'd just 180deg out of there, like wtf are you saying, speak Human please!

I hate the way Claude writes so much I’m at a breaking point ready ti crash out and try to convince my boss to switch to literally anything else.

It drives me up the fucking wall.

The worst part is I can prompt Claude with “this is gobbledegook, simplify” and it will reword its previous answer perfectly but no amount of hooks or system prompt hacking will fix it otherwise.

Do we know that Claude’s quirks are related to watermarking? The article said Gemini’s web console is apparently watermarked, and it has different quirks / a different sound.

Its quite bad. I use it for code all the time and then recently used it for writing and its so bad. Went back tk ChatGPT for the first time in a long time.

This reads like translate this English into Spanish into English into Spanish into English into Spanish into English and get something totally different than the original.

Full circle, the fired content writers are going to get rehired. What a time to be alive.

So a writer

Burn, witch

This seems like a know your audience situation.

>However, in a world of commodity AI models, can simply use a model from an AI provider that does not watermark. Or download any open source model and run it themselves

That's seems above the skill of the majority of the population that might be tempted at using generative text. I'm thinking of students trying to "write" a paper, or any of the myriad of other things people are blissfully unaware of how genAI works that are using it every day. For those people, that just use the default prompt to blindly copy/paste away. For techy nerd types running from CLI, yeah, they could simply use a different model.

One thing you can try is to write it by hand without an LLM! That way there will be no watermark.

And certainly never copy/paste an assignment

I can see this being real useful when they scrape the internet for content. And they don't want their own crap. Or just to see how prevalent their stuff is.

It doesn't look like the providers are going to publish their randomisation key. The google version is accessible only via the gemini prompt which only actually ran the synthID tool 1 out of 2 times I tried it the other day. So at the moment the best approach would be taking the suspicious test and using claude computer use to feed it into each provider's prompt brower window "manually"...

As per the link, the words in the green and red groups are calculated dynamically, so it's not like the model is going to be told "use 'unique' over 'unusual'" and suddenly writing from the model will contain the word 'unique' far more often than 'unusual'. So I'm not sure it's clear that this has an impact on creativity as such?

That being said, I do question how this will apply to code as opposed to prose. Even data dense text (ie, if you ask Claude to evaluate what running shoe to buy, and it spits back a list of options with reviews and prices) may struggle.

What it probably will work well at it flagging the current tsunami of entirely AI generated novels on Amazon/Kindle, which is...honestly not without value.

> Identifying code will be paramount in training future models

True, but note that this strictly allows providers to identify text generated by their own models. If Anthropic wants to filter out GPT generated text in their training data, they'll need to feed it through an OpenAI API, which is implausible. So it might help on the margins, but I don't think it solves the problem of model collapse.

The details will depend on the exact implemention, but I don't think this necessarily effects output quality.

The models "natural" output is the result of a series of random numbers. The watermark works by biassing that series towards a different series of numbers. Assuming that second series is cryptographically secure psuedo-random, the even distinguishing the biased sequence from true random would be impossible with compromising the key or prng.

As an extreme, suppose your prompt was public, and the model seeded its PRNG with a secret key instead of a genuine random seed. Such an output is not meaningfully different from one based on a true RNG, but can be trivially fingerprinted by someone who knows the keys.

In practice, I am doubtful they have a scheme that is both practically useful and cryptographically secure. However, there is a lot of room below cryptographically secure that is still just as good for all other purposes.

It is worse than that, it can make text unintelligible. I have Claude explain what is happening in a PR, and the technobabble and use of rare words have to look up in a dictionary make it difficult to understand. I need another LLM to translate what the LLM is saying.

And I pray it is because of the EU AI Act, because it is worth giving them my personal information to prove I am not in the EU so they can turn this off. Heck, I will pay more to avoid this crap.

If it were not so noticable, I would shrug it off. But it has made things clearly worse this year.

I think the goal is not to validate if you used Claude, the goal is to insert enough information in your code to identify who you are over at Anthropic, like a covert unique hash to identify you, hidden in plain sight, but that's my own speculation and not based on anything.

I'm having a hard time thinking of any other use case... What other reason is there to fingerprint your code?

I assume if they arrest you for vibe coding something that violated computing laws (hacking) they can then scan your code, send it to anthropic, anthropic confirms that Claude was used on your account, on x device to build malware.

Remember they busted a hacker because of his Windows unique install ID.

My guess would be to detect if their models are being distilled by other models.

I think that's the part the article glosses over, probably because it's such an evidence to the author.

The only way this works is to use the same exact model and weights right? So that you can replay the text generation as it would have been originally done, and compare output?

And then what, if there is no match do you need to retry with all other known models that could have been used?

Or are models sufficiently similar that they are interchangeable for this type of watermark?

And what if a competing or open source model was used? I can't see how the watermark would work.

And if you have access to a non-watermarked output? How can you prove they are not simply using another key? How can you be sure the text is not watermarked? From the explanations, you can't.

I’d be curious to play with this with some different open weights models. I’d think that a single next token would end up having similar probability distributions so given that this a probabilistic method, you’d be able to get at least some signal.

I suppose if that did work someone would have been able to work backwards and crack their key already, so I must be missing something.

I suspect there are too many potential methods to reliably reverse engineer.

Yeah code in general seems like it wouldnt work

The example above that paragraph shows how words might be chosen using fair dice. Watermarking works by using weighted (unfair) dice. It's saying that you can hide watermarking by weighted the dice, i.e. "lean on how the dice land."

If you then know how the particular dice weights, you can later use that to confirm watermarked text.

Like this pattern, where telling me there's just one idea followed by that-one-idea is weird and redundant.

> The one idea in this step: a model writes by rolling weighted dice between several words that would each be fine.

> The one idea in this step: the key secretly colours the shortlist and gives one colour a gentle nudge. The text still reads normally.

> The one idea in this step: with the key, you can re-colour any text and simply count. Marked text lands green too often to be luck.

> The one idea in this step: the mark lives in runs of untouched wording. Editing erases it exactly where the runs break, and nowhere else.

> The one idea in this step: detection is private, probabilistic, and about processing, not authorship.

I suspect someone prompted the LLM with "have just one idea in each step", because apparently breaking down a process into steps is just toooo much wooooork these days.

They/the LLM made sure to replace the em dashes with semicolons

[dead]

Really wish the EU would out up their own firewall already.

what we need is for high schools and colleges to have this access

Gemini has long watermarked text. No one made them, but they saw the danger of a recursive loop of AI text leading to future model corruption.

Anthropic always likes blaming other people and countries for everything they do -- it's in their DNA -- but they're doing this worldwide for their own benefit, not some sort of extraterritorial influence of Brussels. No one in Europe forced them to do it outside the EU, but they wanted to for their own reasons.

Here’s where it gets really fun. Watermarking could also be extended to include identifying information. Takes more tokens but maybe something like 200-300 words could do it.

Doesn’t seem to work on code, where there is often little choices