A mechanism that embeds a 'watermark' in AI-generated text.
'Watermarks,' which embed markers into AI-generated content to make it distinguishable, are attracting attention,
How AI text watermarking works: a visual guide
https://declaude.org/watermarking/
AI company Anthropic announced on August 11, 2026, that it plans to embed a 'watermark invisible to the human eye' into text generated by its AI chatbot 'Claude.' New Claude models released in the EU after August 2, 2026, will support watermarking from the time of release, and existing models released before that date will also be gradually updated to support watermarking.
Anthropic has announced that it will embed an 'invisible watermark' into text generated by Claude, and plans to apply it worldwide, including in Japan - GIGAZINE
Text doesn't have pixels to hide data like images or code; all characters are displayed exactly as they are. Furthermore, metadata disappears when you copy and paste. However, NOPE explains that even in such text, there are watermarks that are not clearly visible.
What's important here is how large-scale language models (LLMs) generate text. Instead of accurately predicting the next word, LLMs enumerate all possible words and assign a 'probability' to each. They create text by repeatedly 'ranking the next word,' but if they always select the highest-ranked word, the text will be flat and uncreative. Therefore, they sometimes 'deliberately break the mold' by selecting lower-ranked words.
What does ChatGPT do and why does it work? A theoretical physicist explains - GIGAZINE
The AI text watermark utilizes this 'range of generation,' which is the 'choice of which to select from multiple candidates.' For example, if four candidates are assigned to each word when generating text normally, a four-word sentence could be generated in '4 x 4 x 4' = '64 ways.' The watermark then applies a 'secret key' that divides the candidate words into two groups and slightly increases the probability that one of the groups will be selected.
The following is an example of a secret key provided by NOPE. Probabilities are assigned to four words that follow the sentence 'The results of the study were quite': 'important,' 'significant,' 'substantial,' and 'notable.' Of these, 'important' and 'substantial' are grouped in green, and 'significant' and 'notable' are grouped in red. Only the 'probability of a word being selected' is set high for the green group. This increases the likelihood that words from the green group will be included in the sentence.
Which words are classified as 'green' is not determined by the word itself, but by inputting the words immediately preceding it into a calculation using a secret key. Therefore, the same word may be classified into different groups if the surrounding sentences are different.
A text watermark detector recalculates the text using the 'secret key used to generate' to determine whether each word falls into the 'green' or 'red' category. If no watermark is present, the proportion of words in each group will be roughly 50/50. On the other hand, if a watermark is embedded, one group will appear far more frequently than the other, making a statistical determination possible.
In other words, text watermark detectors don't read the text and guess whether it's 'AI-like,' but rather they use a secret key to recalculate the word selection in the text and check for 'statistical biases that are difficult to explain by chance.' The mechanism of 'GPTZero, ' a tool released when chat AIs rose to prominence that distinguishes whether a text was written by a human or an AI, is different from that of watermarks, as it infers from the style of the text.
How accurate is 'GPTZero,' a tool that can distinguish whether a text was written by a human or an AI? - GIGAZINE
Text watermark detection relies on probability biases, making it easier to detect watermarks in longer texts. Furthermore, in texts with limited options for the next word, such as code, quotations, and bullet points, the potential for embedding watermarks is significantly reduced.
Furthermore, NOPE points out that watermarking methods based on the words themselves are far more effective than methods based on surrounding words. Even if the text generated by the AI is rewritten with paraphrasing or changes in expression, a sufficient number of words remain as long as the meaning is the same, so most of the features are preserved.
It's important to note that when a watermark is detected, it simply means 'processed by AI,' not 'written by AI.' Anthropic's official documentation states that 'watermarks can be detected even in human text that has only been proofread or translated by Claude.' Conversely, text generated by older AI models without watermarks may not be identified as AI-written even by the latest detectors.
It's also important to note that the explanation of NOPE is derived from measurable, publicly available implementations. Since Google and Anthropic do not disclose their watermark generation methods, it's impossible to test how they actually work. Detection is only visible to the owner who set the private key, so you'll need to use Anthropic's detector if you're using Claude, or Google's detector if you're using Gemini.
NOPE has released an application called 'declaude.' that utilizes this watermarking mechanism and returns the same content as regular text when you input text generated by Claude.
declaude: rewrite AI-flavored text as plain prose
https://declaude.org/
Related Posts:
in AI, Posted by log1e_dh