

From a technical perspective, I don’t really know how to let it track specific users. The goal is that if some AI vendor provides their key, it is easy for them to prove that their AI produced the text. So I guess if a user wanted to show that they generated the text, they could prove it. But usually AI users don’t want people knowing that they used the slop cannon. In any case, Anthropic’s own announcement states that their watermark does not contain identifying information for users.
In any case, some proud AI users are now frightened that there might be a way for people to identify that they use such a wonderful tool. How will I ever deliver low quality slop for my contracts now?
He said he uses AI for code reviews and translations, and worried an AI label on code shipped to clients could raise questions about authorship or trigger contract penalties.
Having code attributed to Claude “definitely would be not desirable,” he said, as he would not want professionally shipped code to carry an invisible marker that could raise questions about authorship, compliance, or client policies.

Some systems like SynthID (for Google’s AI) get around this problem. In fact you don’t need to know the LLM’s internal state, and defeating it would likely involve breaking up most blocks of 3 words. The oversimplified explanation is that it introduces a function g that gives a score to each word, with the score being (pseudo)randomly determined by your secret key. For each next word the LLM generates, the LLM produces a small list of candidate next words, and the one with the highest score according to g is selected. You should expect that the LLM will generally pick words with a high score, but the score itself is independent of the LLM. To detect a watermark, you need to know g and the secret key, and you check if the average score is much higher than expected from normal text.
Now, one question is, will this bias to the LLM to favor certain words? The solution is that for each next word, you append the last 3 words (nothing special about 3, just a small number) to the secret key for g, and this repeatedly scrambles which words have a high score. To defeat the watermark, you would need to break up most blocks of 3 words. I’m sure there are deeper issues with this, but I have not studied the topic that much.