Gruber Says Claude's Token-Level Watermarks Compromise Generated Text
- Anthropic says it will soon watermark text from all Claude models worldwide to meet an EU code of practice, while John Gruber argues the approach alters the writing it is meant to identify.
- Anthropic's newly published explanation describes text watermarking as a token-choice technique: at generation time, Claude biases selections toward secret token groups so a detector can later identify a statistical pattern.
- Gruber says Anthropic's earlier support page claimed the watermark was imperceptible and did not change meaning, quality, or readability, but did not explain that it would influence word and token selection.
- The article contrasts semantic watermarking with hidden non-printing Unicode characters, which Gruber initially expected because those could identify provenance without changing the visible wording.
- The Hacker News discussion questions whether token-choice watermarks work for code or tightly constrained output, and raises concerns that rewriting, diffs, or ordinary editing can remove the signal. The discussion also disputes how much quality loss the added sampling constraint causes.
Hacker News opinions
I do not see how this works outside prose. Code and structured outputs often have no interchangeable tokens, especially under constraints like "answer only True or False."
Anthropic's own explanation says the watermark has limits for code and structured output, which is why I assume this mainly applies to flexible chat responses.
If the provider's terms require users not to remove watermarks, generated text is not freely usable. Copying, editing, or rewriting part of an output could erase the mark, so this looks like security theater that authorities could apply selectively.
Claude's word choice is already not reliably the best fit for meaning and tone. It randomly selects among close candidates, so adding another bias feels like one more arbitrary constraint.
This makes AI proofreading risky. If Claude rewrites my prose, the final text might be flagged as Claude-generated even though I wrote the original.
I think that is fair if the model rewrites the text, because the rewritten result is AI output and may not get copyright protection. But I do not see how proprietary, model-specific detectors can scale if every vendor keeps its method secret.
I do not think ordinary proofreading has that problem. If Claude points out problems and I make the changes myself, its watermark should never enter my text.
I can ask Claude for a diff or another intermediate representation, then apply the changes myself. That translation step should remove any text watermark.
Human proofreaders used to annotate my writing rather than rewrite it wholesale. Claude can still flag grammar, flow, and logic problems without making the prose its own output.
LLMs already sample from a probability distribution at every token, so watermarking may only make the random selection pseudorandom. The result can still be one of the outputs the model would otherwise have produced.
That description is wrong twice. Sampling is configurable rather than fundamental, and most implementations already use a seeded PRNG. Watermarking adds token-selection constraints, which necessarily trades off some output quality.
A watermark does not have to flatten the distribution. It can amplify the highest-probability tokens, making the next-token distribution more peaked while still leaving a detectable signal.
The distribution itself represents the model's best judgment, and Anthropic changes that distribution for identification. The company says the impact is small, but outsiders have no practical way to verify the quality cost or how much identification gets added later.
The article feels incoherent to me. Expecting an LLM to produce highly precise prose in the first place is already a questionable premise.