Anthropic 详解 Claude 新文本水印的工作方式

Anthropic 周五发布了一篇博客文章，试图回答一些有关其将如何为聊天机器人 Claude 生成的文本添加水印的基础问题，例如：水印究竟如何运作？能否通过编辑将其隐藏？这将如何影响代码？

自该公司本周早些时候披露将为文本添加水印、以遵守欧盟《AI 法案》透明度行为准则以来，Claude 用户一直在讨论这一举措。该准则要求 AI 公司采用能够识别 AI 生成内容的系统。

例如，在 Reddit 上，一名发帖者将此举形容为针对无辜 Claude 用户的阴谋，另一人则称：“你唯一不希望有这个功能的理由，就是想对别人撒谎。”而 Business Insider 报道，X 平台上有“数十名”用户表示，他们因此取消了 Claude 订阅。

Anthropic 的新文章首先概述了水印概念，解释称，在作出“低风险选择”时——例如用“阴天（overcast）”还是“灰蒙蒙（grey）”来描述天气——Claude 可以在回复中创建一种模式。这种模式“读者无法察觉，但任何拥有用于编码该模式的密钥的人都可以检测到”。

“水印不会影响 Claude 输出的质量，”该公司表示，“对于读者而言，带水印的回复与未带水印的回复没有区别。”

更具体地说，Anthropic 表示将采用 Google DeepMind 团队在 2024 年提出的 SynthID-Text 方法，并计划发布水印检测 API。该公司还指出，水印不同于 Pangram 等公司提供的 AI 检测方法；后者通过寻找写作中的“特征”——例如“his isn’t [X], it’s [Y]”这种句式——来识别 AI 的使用痕迹：“识别这些模式，与检查水印在根本上是不同的。”

那么，是否只需改写文本就能隐藏水印？Anthropic 表示，这确实可能做到，但“轻度编辑可能无法完全去除水印”，而“替换每一个词的彻底重写”则可以。

“当然，在后一种情况下，是否还能将文本描述为 AI 生成的，就存在争议了，”该公司表示。

至于仅经 Claude 校对或编辑的文本是否能检测到水印，Anthropic 表示，这将取决于“文本长度以及 Claude 编辑的程度”。如果只是轻度编辑，“几乎所有词语”都将由人类作者写成，“可供水印附着的内容非常少，甚至完全没有”。

与此同时，代码中的水印应当少于其他文本，因为模型需要生成能够运行的代码，无法自由地在多种同样有效的选项之间进行选择。

“话虽如此，在代码中可以对特定词语或术语进行任意选择的领域，水印仍然可以使用，例如代码注释，”Anthropic 表示，“但根据定义，它对实际生成代码的影响将微乎其微。”

Anthropic 还表示，Claude 不会是唯一生成带水印文本的 AI 聊天机器人，因为“其他主要模型开发者也签署了同一份行为准则，并将实施各自的水印。”

Anthropic published a blog post Friday seeking to answer some basic questions about how it will watermark the text generated by its chatbot Claude. Such as: How will the watermarking actually work? Can it be hidden with editing? And how does this affect code?

Claude users have been debating the move since the company revealed earlier this week that it would be doing this watermarking to comply with the EU AI Act’s Transparency Code, which requires AI companies to use systems that make it possible to identify AI-generated content.

On Reddit, for example, one poster characterized this as a conspiracy against innocent Claude users, while another claimed, “The only reason you wouldn’t want this is to lie to people.” And Business Insider reports that “dozens” of users on X have claimed to cancel their Claude subscriptions as a result.

Anthropic’s new post starts with a general overview of the watermarking concept, explaining that when making “low-stakes choices” — like choosing between the words “overcast” and “grey” to describe the weather — Claude can create a pattern in its responses that is “undetectable to the reader, but is detectable to anyone who has a key that encodes it.”

“Watermarking does not impact the quality of Claude’s output,” the company said. “To a reader, a watermarked response is indistinguishable from an unwatermarked one.”

More specifically, Anthropic said it will be using the SynthID-Text approach that the Google DeepMind team outlined in 2024, and that it plans to release a watermark detection API. It also noted that watermarking is distinct from the AI detection approaches offered by companies like Pangram that look for “tells” in the writing (like the construction “his isn’t [X], it’s [Y]”) to reveal AI usage: “Picking up on these patterns is fundamentally different from checking for a watermark.”

Could someone just rewrite the text to hide the watermark? Anthropic said it’s possible, but “light editing probably won’t remove the watermark completely,” while “a complete rewrite where every word is replaced will.”

“In the latter case, of course, it’s arguable whether the text can any longer be described as AI-generated,” the company said.

As for whether the watermark will be detectable in text that was only proofread or edited by Claude, Anthropic said that will depend on “the length of the text and how heavily Claude has edited it.” If it’s only been lightly edited, “nearly all the words” will have been written by the human author and “there’s very little (if anything) for the watermark to attach to.”

Code, meanwhile, should have less of a watermark than other text, because the model will need to create working code and won’t have the freedom to choose between a variety of equally valid options.

“Having said that, in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code,” Anthropic said. “But by definition, it will have a negligible effect on the actual code produced.”

Anthropic also said that Claude won’t be the only AI chatbot to generate watermarked text, as “other major model developers have signed the same Code of Practice and will be implementing their own watermarks.”