# Embedding watermarks in AI-generated text **URL:** \ **Category:** Factual Questions\ **Created:** [August 12, 2026, 8:54am UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309 "2026-08-12T08:54:49Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![Schnitte](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/schnitte/32/9033_2.png) [@Schnitte](https://boards.straightdope.com/u/Schnitte)\ **Post date:** [August 13, 2026, 7:07am UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/41 "2026-08-13T07:07:32Z")
> [@CaveMike](#): > > “Invisible watermark” is what the OP’s article called Anthropic’s technique to comply with EU Artificial Intelligence Act. Specifically “Article 50(2), Transparency obligations for providers and deployers of certain AI systems”. If it’s meant to comply with transparency obligations, wouldn’t they have to publish the algorithm that’s used to imprint the watermark or to detect it? A proprietary algorithm that works only with Anthropic’s own tools would hardly be transparent. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [August 13, 2026, 12:21pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/42 "2026-08-13T12:21:44Z")
> [@Schnitte](#): > > If it’s meant to comply with transparency obligations, wouldn’t they have to publish the algorithm that’s used to imprint the watermark or to detect it? But then it would be trivial to remove it, like telling a bank robber which strap of money has the ink pack in it. Plus, agree or disagree, people aren’t going to want a visible watermark (image or text) in the output. In some circumstances, the transparency act does require a provider/deployer to disclose to the user, in ‘natural language’ that it’s AI. However, in general, for text/audio/images/video, the act only requires that it’s marked in a ‘machine readable’ format and detectable. > **[The EU AI Act’s Transparency Rules: A Practical Guide to Article 50 | EU...](https://artificialintelligenceact.eu/transparency-rules-article-50/)** > Providers of AI systems (including general-purpose AI systems) that generate synthetic audio, image, video, or text must ensure that outputs are both marked in a machine-readable format and detectable as AI-generated. This is a technical obligation aimed at provenance: enabling detection tools to verify whether content is AI-generated. > [@steronz](#): > > “We’ll sell you tools to solve the problem we created.” Except you made that part up. They still appear to be working on the final wording of the transparency act, but from what I can tell, the tools should be free in most cases. > **[EU Finalises Transparency Rules for AI-Generated Content](https://www.paulweiss.com/insights/client-memos/eu-finalises-transparency-rules-for-ai-generated-content)** > > On 20 July 2026, the European Commission (the “Commission”) published its finalised guidelines (the “Guidelines”)\[1\] on the implementation of the transparency obligations for certain AI systems under Article 50 of the EU Artificial Intelligence Act... > The Code, going beyond the express marking obligations of Article 50(2), requires providers to make available a mechanism to detect AI-generated or manipulated content. The mechanism must in principle be free of charge… The California version of the rule includes a line stating the detection tools must be free of charge and accessible to the public. > **[SB 942: California AI Transparency Act. | Digital Democracy](https://calmatters.digitaldemocracy.org/bills/ca_202320240sb942)** > > Digital Democracy overview of bill SB 942: California AI Transparency Act. > This bill, the California AI Transparency Act, would, among other things, require a covered provider, as defined, to make available an artificial intelligence (AI) detection tool at no cost to the user that meets certain criteria, including that the AI detection tool is publicly accessible. ---
**Author:** ![Humbagger](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@Humbagger](https://boards.straightdope.com/u/Humbagger)\ **Post date:** [August 13, 2026, 1:06pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/43 "2026-08-13T13:06:56Z")
The result will probably do no more than comply with the words of that regulation. Off the top of my head, I can think of the following ways to fool the detection: 1. Short text snippets. Not enough words to embed enough “watermark signal”. 2. Combine text from multiple AI generators. A tool to do so is trivial to create (thanks, Claude!) 3. Randomly replace words in the text with others that have similar meanings. 4. Use an older pre-watermakr or self-hosted AI to rewrite the entire text. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [August 13, 2026, 1:15pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/44 "2026-08-13T13:15:30Z")
What if I do not pay money to Anthropic, but generate my own “AI-generated text” using my own custom software? I know people who have done that (for research purposes, not as part of some corporate scheme). Is that supposed to be illegal? I also know plenty of sites, including this one, that have an explicit “no AI slop” rule, or, at least, do not allow you to pass automatically generated text or images off as your own. On the other hand, I do know of at least one or two experimental books that (quite openly) used procedural generation as part of the process, and that was the point. ---
**Author:** ![Snarky\_Kong](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@Snarky\_Kong](https://boards.straightdope.com/u/Snarky_Kong)\ **Post date:** [August 13, 2026, 1:45pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/45 "2026-08-13T13:45:45Z")
I know at least that Google’s image watermark is supposed to be robust to tampering of the sort that is analogous to #3 in your list. It’s absolutely not perfectly robust, but Anthropic probably is attempting to make the method at least somewhat resistant to those attacks. ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 13, 2026, 1:58pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/46 "2026-08-13T13:58:58Z")
> [@Humbagger](#): > > The result will probably do no more than comply with the words of that regulation. Trying to stay in FQ here… If the main goal of the legislation is to capture the majority of brute-force LLM generated text, this is a good step; for example, some entity that want to blast a wall of fake, generated news stories. 1. **Short text snippets** : Not critical to catch, a human could just write them 2. **Combine text from multiple AI generators** : Depends on how long each snippet is and how many there are. The detector can still find it’s own signal if there is enough of it. 3. **Randomly replace words in the text with others that have similar meanings** : This will obscure the signal and lower the detector’s score, but not eliminate it. 4. **Use an older pre-watermark or self-hosted AI to rewrite the entire text** : Or create their own LLM. As I said, it’s an arms-race. The perfect is the enemy of the good here. Someone can always create their own LLM to generate glurge. The point is to create some barrier of entry. ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 13, 2026, 2:06pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/47 "2026-08-13T14:06:31Z")
> [@DPRK](#): > > What if I do not pay money to Anthropic, but generate my own “AI-generated text” using my own custom software? The point of the legislation is to require vendors to provide a free tool for their products. If you create your own and want to sell it, then you might have to comply. (I haven’t read the EU law; someone else can weigh in if they have.) For research and hobbyist LLMs, there are the black-box detectors that @wolfpup discussed. It’s an arms-race and will need multiple prongs of attack. We’re all worried about the impact of AI glurge and deep fakes. This is one prong to address it. ---
**Author:** ![scudsucker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scudsucker/32/14101_2.png) [@scudsucker](https://boards.straightdope.com/u/scudsucker)\ **Post date:** [August 14, 2026, 5:15pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/48 "2026-08-14T17:15:21Z")
> [@CaveMike](#): > > However, it may be possible to make the editing onorus enough that the human editor may as well write it in the first place. Editor: Claude, write me a thesis on the subject of galaxy merging. Editor: GPT04, take this thesis and rewrite it in a slightly different style. Editor: Command-R+: take this thesis and rewrite it in a more technical style. Etc etc. Editor: thanks all. I’ll just do a little light editing myself, paraphrasing, perhaps including some spelling/grammar errors, to show I am human. I’m fairly sure multiple pases through multiple different LLMs would eventually be undetectable, unless(in my example) Command-R+ has steganography of its own, AND the tool used to detect the LLM content is trained to use Command-R’s steganography “tells”. … and later… Editor: generic LLM: rewrite this thesis, ensuring that no steganographic “tells” from Claude. GPT04, or Command-R+ remain… ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [August 14, 2026, 5:21pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/49 "2026-08-14T17:21:57Z")
That just generates word salad (which I have seen people generate by hand and nevertheless be awarded Ph.Ds, which says something about the people who went ahead and signed it). OTOH, if you have a good thesis, why _not_ use spelling/grammar-checking tools? ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 14, 2026, 5:41pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/50 "2026-08-14T17:41:43Z")
> [@scudsucker](#): > > I’m fairly sure multiple pases through multiple different LLMs would eventually be undetectable, This is a separate, although important, problem. One person can create one document through a variety of tools that can defeat this type of detector. This would require a different detector. As an aside: I’m not sure if a student could defend a thesis created this way. The watermarking is useful to detect when one person is posting 100K fake news stories, testimonials, reviews to Twitter, Reddit, or Amazon. Sure, they can spend a lot of time and money to run each post through a pipeline of tools and if that obfuscates it enough to break the detector, then we’re back where we are today. Likewise a state actor could create their own LLM; same as where we are today. The point isn’t to use one method to catch 100% of the cases. It’s to require vendors to provide a tool that can be used to catch 95% of the cases ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [August 15, 2026, 12:05pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/51 "2026-08-15T12:05:55Z")
> [@scudsucker](#): > > I’m fairly sure multiple pases through multiple different LLMs would eventually be undetectable Why wouldn’t the watermarks from the last one you ran it through be detectable? It might erase the watermarks from the previous ones, but it would still leave it’s own. > [@scudsucker](#): > > Editor: generic LLM: rewrite this thesis, ensuring that no steganographic “tells” from Claude. GPT04, or Command-R+ remain… But that would only work if it knows what those tells are. And, if it knows, wouldn’t you just be able to ask it what they are so you could edit them out yourself? ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [August 30, 2026, 7:44pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/52 "2026-08-30T19:44:42Z")
I ran across [this video](https://youtu.be/Cmi-1QSaptA?si=tNA3lH6d8-ipI-GQ) which does a good job explaining how LLM watermarking works. He explains three schemes, “hard watermarking” which is simple to understand and robust but degrades the quality of the output text, “soft watermarking” which is less robust (watermarked text might sometimes be detected as not watermarked and vice versa) but produces higher quality output, and Google’s Synth-ID (tournament sampling), which produces even higher quality output than soft watermarking. Anthropic says that they will be using Synth-ID for Claude watermarking. One thing that occurs to me is that this scheme adds a lot of extra computation to each generated word in the LLM output. This will make LLM even more computationally expensive than it already is, and use more resources. ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 30, 2026, 9:40pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/53 "2026-08-30T21:40:25Z")
> [@markn\_1](#): > > One thing that occurs to me is that this scheme adds a lot of extra computation to each generated word in the LLM output. This will make LLM even more computationally expensive than it already is, and use more resources. That’s a great video, thanks for sharing it. The Synth-id technique doesn’t add as much overhead as it seems. The Supplementary information provides a vectorized version in Appendix E and compares the computational overhead in Appendix F. From the main paper: > a latency increase of only 0.57%. In comparison, Gumbel sampling increases latency by 0.26% and Soft Red List by 0.28%. Furthermore, the computational complexity of all three watermarks remains constant even as the LLM grows And from Appendix F: > Tournament sampling generally has higher computational complexity than Gumbel or Soft Red List sampling; however if |V | is large compared to Nm+1 then Tournament sampling (the tournament-based Methods Algorithm 2 implementation) may have lower complexity. Nonetheless, in the context of the computational complexity of generating text from a large LLM, these differences are in practice negligible (see Section 3 in main paper). The paper is “Scalable watermarking for identifying large language model outputs” if anyone wants to read more. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [August 30, 2026, 9:56pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/54 "2026-08-30T21:56:20Z")
Thanks for those snippets @CaveMike. Out of curiosity (no pressure if you don’t want to share) but what’s your background? ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 30, 2026, 10:12pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/55 "2026-08-30T22:12:48Z")
My degree is in Computer Engineering and I spent most of my career in software, but for the last 10-11 years, I worked on running Machine Leaning (AI) on mobile phones – voice recognition, camera, and most recently LLMs; I retired last month. I was never a researcher – my math/stats skills are not strong enough. I would have to put in a lot of time to understand how the vectorizing is equivalent to the paired-tournaments in the synth-id paper. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [October 8, 2026, 4:04pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/56 "2026-10-08T16:04:50Z")
> [@Johnny\_Bravo](#): > > No idea how this would work in coding. Naming choices for variables and functions maybe, or whitespace and other stuff that is transparent to the compiler/interpreter. I suppose it could also be done by choosing one of many different possible methods to perform the same small action. ---
**Author:** ![md-2000](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@md-2000](https://boards.straightdope.com/u/md-2000)\ **Post date:** [October 8, 2026, 4:48pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/57 "2026-10-08T16:48:35Z")
Another issue is - unless the watermark technique is common, then as implied in earlier posts, you would have to run any piece through a number of different detection tools to determine if it is indeed AI generated. …and hope the LLM used adheres to the requirement to watermark. As for techniques that require the selection based on odds of predicted words or other similar characteristics - would that not change frequently as the LLM is continuously trained on more and more input? For example the odds that “Hormuz” follows “Strait” has probably increased dramatically for any LLM training on daily news feeds. Whereas “bab al-Mandab” was probably not in the top 40 straits until a month ago… And if it is dependent on patterns, and can be altered with word substitutions and such - then you are back to the question “Is it AI?” then “Maybe, it seems so, but there’s no definitive answer”. ---
**Author:** ![CoolHandCox](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/coolhandcox/32/16233_2.png) [@CoolHandCox](https://boards.straightdope.com/u/CoolHandCox)\ **Post date:** [October 8, 2026, 6:23pm UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/58 "2026-10-08T18:23:24Z")
Thanks for sharing that video. I kinda sorta get it, but it’s way above my paygrade and there’s no way I could intentionally defeat, or even understand how to defeat, that kind of watermarking. @CaveMike Thanks for your input. Good stuff. Before I read this thread, I thought text “watermarking” was not going to be helpful for anything beyond say paragraphs of Claude produced AI text, not altered/lightly altered, and then Claude or Claude approved detector confirming the watermark. Is that still about right? Or is it more robust than that? ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [October 9, 2026, 1:10am UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/59 "2026-10-09T01:10:31Z")
> [@CoolHandCox](#): > > Is that still about right? That’s correct. There are two classes of detectors (one made by an AI vendor and one not): 1. An AI vendor adds a watermark to their output and provides a detector that works with their AI. Short outputs and heavily modified outputs reduce the effectiveness of these detectors. 2. A third-party creates a detector that uses heuristics to detect AI output and does not use watermarking at all. These types of detectors can potentially identify multiple vendor’s AIs, but the overall effectiveness is lower than #1. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 9, 2026, 1:40am UTC](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309/60 "2026-10-09T01:40:27Z")
Would it be possible to have the AI just remember what it’s written? It might be prohibitive to remember it all verbatim, but maybe just some sort of hash? [Previous page](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309.md?page=2) [Next page](https://boards.straightdope.com/t/embedding-watermarks-in-ai-generated-text/1032309.md?page=4)