Thanks for informing us Sylwia!

Sure, the flood of AI slop across social media is annoying. Unfortunately, I have a feeling this watermark isn't going to magically solve that problem either. 😐

To be fair, this is expected and not surprised. It has become an issue and I have receive complaints from other people that they despised AI Slop on this platform (regardless of the moderation I have done).

The best things we can do, is the thing we need to for ourselves, which is start to critical think. Our attention span is so awful to the point where everyone is starting to lose this ability to think for ourselves instead of just giving up and following the herd. Yes, AI is everywhere BUT we need to train ourselves to take control and think to ourselves instead of reaching conclusions and I can't stress this enough.

Sorry Sylwia if this sounds frustrating, but it's something I thought about while typing lol. xD

Thanks for the writeup. Tbh, I'm glad somebody is finally enforcing this AI content thing. I wrote about it a while back when I got upset with the "ban everything AI" wave that's still hanging around in places. My biggest concern with this is that your distinction

watermark detected ≠ AI wrote everything
no watermark detected ≠ human wrote everything

gets collapsed into something resembling the AI version of hellfire and pitchforks...

Great article, nonetheless!

Interesting, thanks for the information, Sylwia. I’m really curious how this will work in practice, especially with code.

At least in our case, we use AI to generate code that has to fit into an existing codebase: naming conventions, patterns, formatting ... So I’m really curious how they want to put a watermark into that and how much of it will survive after the code is adapted, formatted, or refactored.

It looks like I have the wrong friends on LinkedIn though, because my feed definitely didn’t blow up with this. I still mostly see recruiter posts with pictures of them working from the beach. 😂😂

PS: I just had to add this, it perfectly fits the whole EU situation (and it doesn’t even have to be about watermarking). 😂

Ah, Sylwia! Your articles always seem to show up exactly where I need them. I was actually wondering about this watermark earlier tonight.

And what Claude says — and what you point out — pretty much confirms my view: this is a band-aid on a wooden leg.

Written by AI? Written with AI assistance? Corrected by AI? Not AI at all? Or actually written by AI but simply not detected?

In other words, complete nonsense on a scale matching the sheer foolishness of people who think they can know everything about everything and solve every problem with a binary answer.

It reminds me, for instance, of the proposed ban on social media for under-15s, or France’s tax supposedly aimed at blocking Temu, which ultimately did little more than hurt jobs in France — and, incidentally, make Bercy and its brilliant minds look rather ridiculous.

The more complicated the problem, the more absurd it becomes to pretend there’s a simple yes/no solution.

By the way, I wrote this comment in French and had ChatGPT translate it into English. So… how exactly should we classify it? 😉

Interesting article, Sylwia! Thank you. I didn't know about Anthropic's watermark.

I'm really curious what the future will bring... I noticed that I myself tend to quit reading the content as soon as my brain realises it is generated. Introducing a watermark can bring a new trend of people boycotting AI slop by simply not reading it. So not only people like me, who easily get AI fatigue, but also people who reject content simply because it is generated with AI. This may, in turn, bring us back to the times when people put more heart into writing, not just prompting AI to do this for them. Or maybe it's just my wishful thinking 😅

Good read! But no matter how hard they try to watermark anything, their efforts are ultimately pointless. Any watermarking algorithm can potentially be reversed, even when it relies on statistical techniques, such as systematically distributing the sampling of certain words.

In fact, I’ve built a humble bumble lil tool that lets you remove watermarks from outputs generated by any LLM provider. I called it CUM: Claude Unmarking Machine.

wiseaidotdev / cum

💦 Claude Unmarking Machine.

CUM

Claude Unmarking Machine: a multilanguage Rust crate that removes AI-provider watermarks from text, images, and documents Works regardless of provider (Claude, OpenAI, Gemini, Grok, open-LLM) All processing is 100% local: no data leaves your machine.

The cum binary, cheerfully evicting zero-width gremlins from your prose.

🤔 What is happening here, exactly?

So you copy-pasted some text from an AI. Totally normal. You are not doing anything illegal. Probably.

The bad news: every major LLM provider stuffs your output full of invisible Unicode graffiti so they can identify their own generation later. It is like spray-painting "CLAUDE WAS HERE" on every wall, except the paint is literally invisible and you cannot see it without specialized equipment.

The good news: we have the specialized equipment. And it is written in Rust, so it is blazingly fast.

Layer	What lurks in the shadows	What we do about it
A: Unicode

…

View on GitHub

Some watermarked text you can try to unwatermark:

CUM Examples.

Have fun!

Hi Sylwia, fantastic breakdown! You perfectly cut through the hype and myths surrounding the EU AI Act and Anthropic's watermark.

Your point about the "Code Watermarking" challenge is the most critical part of this discussion. In natural language, the latent space for synonyms is vast, but in code, syntax is rigid. If we add tools like Prettier, ESLint, or minifiers into the CI/CD pipeline, the statistical bias could easily be flattened out or stripped entirely.

I'm really curious to see Anthropic's technical docs on how they plan to solve the code watermarking problem without breaking linters or refactoring workflows.

Do you have any insight into whether Anthropic has discussed a multi-stage watermarking approach that survives code minification? For instance, minifiers rename variables and remove whitespace—so wouldn't it be more robust to embed the watermark in the AST (Abstract Syntax Tree) structure rather than the raw text? This seems like the real engineering challenge: any watermark that relies on surface-level syntax might be stripped after running Prettier or ESLint.

Thanks for another insightful read! Wishing you continued success and more great technical deep dives!
🗻🌊

Great article, @sylwia-lask, thanks for putting it together.

I find the whole AI-generated content particularly interesting from a job candidate standpoint. Job descriptions for the roles I'm looking for frequently include "must be knowledgeable, familiar with, and actively use AI tools for content and code generation." That's fine. At the same time, they don't want to see anything actually generated by AI. It all must be human-generated. Blog posts, resumes, cover letters, repository code, documentation, etc., are all expected to have "never been touched by AI," but at the same time we need to be well-versed in using it.

I fully understand and can appreciate the concept of "AI Slop." But, in my opinion, there needs to be some happy middle ground somewhere: "This was a human's idea, guided by a human, integrates a human's experience, etc., and was polished in some fashion by AI" that becomes acceptable to folks.

Do I think AI is a silver-bullet solution for content generation? No. In my experience, strictly AI-generated content loses something that humans bring to the table. When writing about technical things, is having an AI available to double-check that your spelling is correct, arguments are sound, and structure makes sense helpful? I think there are cases when it is, yes.

We're just in somewhat of a strange period at the moment, I think, with AI, in which lots of folks want to use it, but apparently no one wants to admit they used it or accept the outcome of it. And corporately, we're seeing it being used more and more, either AI -generated content itself or agentic use cases, so it doesn't appear to be going away. The "AI Slop" issue will be around for a while, I think. Regardless of how many watermarks are added. Someone out there will undoubtedly create a "watermark stripper".

Maybe it's just me and my experience here, and sorry for the rambling.

Thanks for bringing up this important topic, Sylwia!
At this point in time I do not understand what the intended purpose of this technology is.
For example, if it cannot tell apart generated content from generated translations then what exactly does this mark indicate? It seems to carry little information but instead a massive potential for misunderstandings and misuse.
Furthermore, if it is really some kind of "watermark" then rather sooner than later tools will exist to remove them. It would be a first in IT that a protection mechanism survives longer than a few weeks once it is out.
It will be interesting to see how the labs will react in case a widespread misuse of this technology will drive customers away from their models to either competitors or open-source models.

From the positive perspective, the watermark could help universities to check whether students cheating or violating academic integrity policies by using AI. They may not be the definitive proof, but they could provide an additional signal.

So we finally got AI watermarks.

Now we just need a watermark for the human who approved the PR without reading it.

@sylwia-lask The point about code watermarking is spot on. Between linters, auto-formatting, refactoring, and strict team style guides, I really don't see how a statistical token bias survives a standard build pipeline. Text is flexible, but code context is way tighter. Will be really interested to see their technical breakdown once it drops.

@mudassirkhan19 asked about detection confidence thresholds near the end of this thread and nobody picked it up, so — it is the question with an actual answer, and the answer is that a threshold cannot be chosen from the detector's accuracy at all. It needs the base rate and the cost ratio, and neither is a property of the watermark.

Take a generous detector: 99% true positive rate, 1% false positive rate. Run it over 10,000 essays.

30% are AI-assisted -> 2970 true, 70 false -> 97.7% of flags correct
5% are AI-assisted -> 495 true, 95 false -> 83.9% correct, 1 in 6 flags wrong
1% are AI-assisted -> 99 true, 99 false -> 50.0% correct, a coin flip

Same detector, untouched. Only the prevalence moved. In the course where almost nobody cheats — the one where an accusation is most devastating — half the accusations are wrong.

And the threshold question needs the cost ratio explicitly. If falsely accusing a student is 100x worse than missing one, you need a likelihood ratio above 100, so FPR below 0.0099 — and pushing specificity that far collapses sensitivity, which is the trade nobody writing policy will state out loud.

The detail from your SynthID update makes this sharper: a full translation gets watermarked while proofreading may not. So the positive class is "a model chose these tokens," not "this person cheated." The prevalence of actual misconduct among watermark-positives is lower again, which pushes precision down further.

Which is why "probably watermarked" has no defensible action attached to it until someone names the cost ratio. Everything else is picking a number off a ROC curve and hoping.

I suspect that if you use synonyms for at least 40% of the words, you can blur the watermark. What do you think?

Solid ML write-up. For production ML systems, I'd add that implementing proper experiment tracking (MLflow, Weights & Biases) from the start is invaluable — you'll thank yourself when you need to reproduce results months later.

Never enjoyed reading AI generated content. If I wanted to learn something from AI, I could've just prompted it myself. At least with this, if it works as intended, will solve the headache most people face with AI generated content like myself.

I didn't know they are implementing it. Thank you.

Personally I think watermarking code in particular seems kinda dumb and I doubt they'll train the models to do so.

With general content at least there's the concern of public opinion and how it can be shaped through models but code is objective logic. There is one use case that could come into picture which is flagging PRs based on how much it's AI generated but other than that I can't think of any.

IDK maybe I'm not thinking hard enough about this.

I think there is an interesting distinction here between provenance and detection. 🔍 A watermark can be useful as a provenance signal, especially for media like images, audio and video, but I don't think it should be treated as proof that "AI wrote this".

The code example makes this even more interesting. 💻 If AI generates code, a human reviews it, refactors it, tests it and commits it, what exactly would an AI watermark tell us? For software, I'd argue that code provenance, review history, testing and supply-chain controls are much more useful signals than simply knowing that an AI model was involved. 🔐

I'm curious how others see this: where do you think AI watermarking provides real value, and where does it become mostly noise? 🤔

I think we have to accept that we're all guilty of technology — users and creators alike. 😅

Technology has been making the world lazier for as long as I've been conscious of it. That was actually my mindset about technology long before I ever touched a PC. But I've never believed technology can make the mind lazy in quite the same way.

We can automate more and more of what humans have to do. We can even outsource parts of writing, coding and research. But we can't outsource the fact that a human still has to think, have an idea, question something, or decide what they actually want.

And this is where AI gets particularly interesting to me. At the height of it, I've come to see pattern matching as statistics, and statistics as a function of abstraction. That's part of what makes these assistants feel so powerful. They can recognize and connect patterns across enormous amounts of information.

But abstraction without strong territorial knowledge has limits. The model can produce a beautifully coherent answer while missing the actual territory, especially when the context is ambiguous or the expression is weak. That's where hallucination becomes fascinating rather than simply "AI being stupid."

Humans do something similar too: we pattern-match, abstract and fill gaps from experience. The difference is that our territorial knowledge can sometimes tell us, wait, something is wrong here.

And I'm sure some people will disagree with that — just like some people will still be arguing in 2030 that using AI assistants means you're no longer original. 😂

The world will probably keep getting lazier. I'm not convinced human thinking will disappear with it . Happy weekend ✌️

Sylwia, this is exactly the post my feed needed this week. Two things I appreciate most. First, the way you nailed the two one-way implications: "watermark detected ≠ AI wrote everything" and "no watermark detected ≠ human wrote everything." Almost every take out there collapses that distinction into "AI detector, so what are you hiding?", and you kept it precise. Second, the code question: in natural language there are dozens of equivalent ways to say the same thing, but const result = await fetchData() leaves almost no token space for a statistical signal — and you were honest that Anthropic hasn't published enough detail to know how they solve it. That honesty matters. My suggestion while we wait on the docs: run your own survivability test. Generate a few hundred words via Claude, then put it through realistic transformations — translate to another language and back, heavy paraphrase, one honest edit pass. Whatever survives that gauntlet tells you empirically whether this watermark actually moves the needle on slop detection. Cheap to set up, and you'd have a great follow-up post.

Thank you for the update in the comments about translation vs. proofreading — I think that one detail is doing far more work than it first appears, and I'd genuinely like your take on where it lands.

If proofreading rarely produces a detectable watermark (too few new tokens) but a full translation reliably does (the model picks every token), then the mark correlates with which language you thought in — not with how much help you took.

Concretely: two people write the same article with the same amount of AI involvement. The native English speaker asks Claude to fix grammar → probably no detectable mark. You write it in Polish and have Claude translate → marked. Same ideas, same authorship, same editorial control, different flag.

That isn't a flaw in the watermark; it does exactly what it says it does. But if any platform ever turns that flag into ranking or reach, the cost lands hardest on people writing in a second language — who are also the people the tool helps most. And they'd be paying it for the part of the work that involved no AI thinking at all.

You mentioned yourself that you sometimes write comments in Polish and translate them. Does that thought bother you as much as it bothers me, or do you see a reason it might not play out that way?

The distinction that matters most isn't in the article's two-way split — it's one level up: a watermark tells you who wrote the text, never whether the text is true.

I shipped an AI-generated backtest summary to 234 readers across three platforms. It claimed "GOLDILOCKS +1.2% vs CONTRACTION -2.1%" — fluent, confident, well-structured, matched my priors so it read as authoritative. A text watermark would have correctly flagged it as AI-assisted, and that flag would have told readers exactly nothing useful. The dangerous property wasn't "a model wrote these words" (which the watermark catches) — the words were fine. The dangerous property was "this confident claim is false," which no watermark catches. The real event study later showed p=0.643 with the signal backwards at all four horizons.

Your distinction generalizes past provenance:

• watermark detected != the content is false
• no watermark detected != the content is true

For AI slop on LinkedIn, provenance detection is the whole game — "did a model write this empty engagement-bait?" is the question. For technical claims with money behind them, provenance is almost irrelevant and truth is the only question, and truth is the thing no statistical token bias can encode.

The code-watermarking subthread is where this gets sharp for me. Even if Anthropic perfectly watermarks a generated function, the watermark says a model wrote it. It says nothing about whether the function is correct, whether the model's "I ran the tests and they passed" claim about it is true, or whether the test suite itself was AI-generated and flattering. Marco's instinct above — code review ignores provenance and reads behavior — is right, and it's right precisely because for code, truth-checking (does it do what it claims) already exists and provenance-checking (who typed it) adds little. The watermark's real value is supply-chain attribution, not correctness.

The critical-thinking thread is the closest, but I'd split it: "is this AI slop?" (provenance, watermark helps) is a different and easier skill than "is this confident-looking claim actually true?" (truth, watermark is silent). Only the second one has money in it, and it's the one my backtest summary passed for three platforms and 234 readers until an event study the agent couldn't write to overrode it.

Open source: real_backtest.py — the detector that actually worked.

This article makes me wonder about the open-weights ecosystem (like running Llama or Qwen locally via Ollama). Since everything runs locally on the user's machine, enforcing a watermark seems really difficult. Wouldn't local models simply become the de facto alternative for developers needing full control over their outputs? I’m very curious to see how this side of the AI world fits into the picture.

I strongly feel like the watermarking feature would be a sophisticated process. How do they even tag a simple AI generated paragraph or code. There will also be errors in judgment too, that's for sure. If a detector is live, it should be used by the public too. The internet is filled with AI slop nowadays that having an automatic detector somewhat becomes a necessity.

The code watermarking question is the one I'd want answered most too.
Natural language has huge redundancy to hide a statistical bias in,
code doesn't, variable naming and formatting are about the only
degrees of freedom left once you're past a certain point of
correctness. If the bias has to concentrate into fewer decision
points, it seems like it'd either be more fragile (one refactor kills
it) or more detectable (if it's leaning hard on the few choices
available).

The "watermark detected ≠ AI wrote everything" framing is the part
worth repeating everywhere this topic comes up, most public discussion
collapses that into a binary the moment it leaves a technical audience,
and that's where the real-world false-accusation problems come from,
not the technology itself.

Appreciate that you separated what's confirmed from what's an educated
guess, most coverage of this blurred that line entirely.

I was actually about to write about this this week 😅. Really interesting development, but I still think humans will always find ways to remove, alter, or work around the watermark. The real challenge is making provenance useful without treating it as absolute proof.

the code question at the end is the best thing in here and i dont think it has a comfortable
answer, so let me try to make the shape of it worse.

statistical token watermarking needs entropy to work. you can only bias a choice where a choice
exists. so the real question isnt whether code has any entropy, its where the entropy actually
sits, and in code it sits almost entirely in identifier names, formatting, ordering of independent
statements, choosing between equivalent constructs, and comment text. everything else is pinned.
once the model commits to await fetchData the closing paren and the semicolon carry no signal at
all. api surface is fixed by the library. keywords are fixed by the grammar.

now line that list up against a normal toolchain. prettier and black and gofmt destroy the
formatting entropy. linters enforce the naming conventions. minifiers rename the identifiers
outright. review comments change names. refactoring tools rewrite the constructs.

so in prose the watermarks adversary is a person deliberately paraphrasing to hide something. in
code the adversary is the build pipeline, its not adversarial at all, and it runs automatically on
every commit. gofmt isnt trying to strip anything. it just does.

which leads to the part i think matters more than the mechanism.

you make the two error directions clearly, watermark detected does not mean ai wrote everything
and no watermark does not mean a human did. thats right and most coverage skips it. but the two
are not symmetric in kind, theyre different types of statement. a detected watermark is positive
evidence that a specific model touched the text. an undetected watermark is not evidence of
anything, its just the absence of a reading. one is a signal, the other is a null result, and null
results get read as negatives constantly.

that asymmetry is survivable in prose. in code it inverts the instrument, because absence becomes
the default rather than the edge case. and the failures wouldnt even be randomly distributed.
theyd correlate with tooling discipline. a team with formatters and linters and a minified build
strips the signal as a side effect of being competent. a team committing unformatted code with
model chosen variable names keeps it. so a detector pointed at repositories would systematically
under report exactly where engineering practice is strongest and over report where it is weakest,
which is a bias with a direction, not noise.

not an argument against doing it. marking is better than not marking and the eu is right that
machine readability is the floor. but if the detector ever gets used for anything consequential,
licensing, provenance, academic integrity, the thing that has to travel with it is that it answers
one question and stays silent on the other, and staying silent is not the same as saying no.

id also like the docs. specifically whether they attempted code at all or whether the marking is
natural language only and claude code output is covered on paper rather than in practice.

the statistical token angle is where practical questions pile up. if the signal requires paragraph length text to emerge, what happens when that paragraph gets edited down by 30% for a larger human doc — does the signal degrade proportionally or fall off a cliff? the editorial review exception in the EU Act seems to create a weird incentive structure: route AI output through nominal human editing, claim the exception.

the thing nobody's addressing is detection confidence thresholds. every real watermark system has false positives. what's the model for how platforms act on "probably watermarked" vs "confirmed"?

agree

Yep, I like the AI slop feature on LinkedIn

Great insights here 💡 Definitely bookmarking this for later! 🔖

I understand professionalism, but there are many ways to do this.

워터마크와 AI 문체 감지를 같은 문제로 보지 않아야 한다는 구분이 유용했습니다. 특히 인간 검토와 편집 책임이 있는 경우까지 함께 짚어 주셔서 실제 콘텐츠 운영 기준을 세우는 데 도움이 됩니다.

That was interesting read 😀

Are we aware on when more info are going to be officially shared with the public? Thanks again for this article!

If you can't beat them, join them!!

So all you have to do is replace couple of words, or change their or sentence order, in resulting text to get rid of the watermark... Kind of security by obscurity.

how refreshing finally good news :))

Bookmarked. The part about evaluation being mandatory is exactly what I keep missing in my own experiments. How do you measure regressions, a separate test set?

Good coverage of ML patterns. I'd stress that monitoring data drift and model staleness is as important as the initial training — a model that was accurate at launch can silently degrade without proper observability.

Interesting ML/AI content. One practical consideration is the inference cost — model distillation and quantization can dramatically reduce deployment costs while maintaining acceptable accuracy for many use cases.

Explore my home post