Under what circumstances does the metadata get added? When Claude Code CLI needs a media file usually I just see it run an imagemagick or ffmpeg command to create one, which isn't going to have C2PA metadata.
Edit: I asked Opus 5 for "a jpg of a cat" via the web chat. It did it by writing an svg and then rendering that to a jpeg. Clicking the "download" button saved a jpg which did have C2PA metadata, seemingly injected by the artifact-presentation thing.
Then I told it to put it in a zip file. I downloaded the zip, and the extracted jpeg had no C2PA metadata.
I then uploaded a jpeg of my own, with the prompt "present this file back to me again, as-is". The downloaded file had C2PA metadata injected.
Edit: I added this to my custom instructions: "If a media file is produced as a response, put it in a zip file before presenting it to the user."
AmazingTurtle 15 days ago [-]
Well, guess they are just trying to conform all the weird EU checkmarks
sleepybrett 15 days ago [-]
I'm not sure that 'preventing ai-generated fraud' is really a 'weird checkmark'
fn-mote 15 days ago [-]
If watermarking of any kind were actually going to prevent ai-generated “fraud” (or even ai being used as part of a scam), it would have more support on HN.
This kind of metadata injection increases surveillance without providing a meaningful deterrent.
brianjking 15 days ago [-]
Furthermore, it almost surely limits the quality of the output. At least the finterprinting of the text tokens has to, how can you otherwise constrain token output?
neuroticnews25 14 days ago [-]
For example if you have 2 equally likely tokens to choose from you can pick the one specified by a key function instead of the one specified by an rng.
ckvibubueu 14 days ago [-]
I asked Claude to provide me with a text copy of a website and it said it couldn't because of copyright.
I then gave it the html as a file upload and it gave it back to me.
It's reasoning why? I already had the file so it must be mine. I told it a judge wouldn't care.
sig-11 14 days ago [-]
A judge Wouldn't care because that is not illegal in any way shape or form.
csmoak 15 days ago [-]
As far as I can tell, this and the recent change to add watermarking to text outputs[1], is to become compliant with the EU AI Act[2] and CA's AI Transparency Act[3], SB-942[4]. For large enough companies, all generated AI content is required to have watermarking.
The CA law in link 4 clearly says it covers "image, video, and audio output", not text output. It's right in the second paragraph.
csmoak 14 days ago [-]
Good point, re: the CA law. The rule for text output may be limited to the EU AI Act, which Anthropic notes as a reason in the linked article about its implementation.
Tiberium 15 days ago [-]
This is just C2PA for Claude-processed files, apparently. It's not related to their text watermarking.
C2PA is file metadata and can be trivially stripped away, unlike hidden watermarks, e.g. SynthID.
mhitza 15 days ago [-]
That is where their responsibility ends in terms of the EU AI Act. And that is fine and how it should be, no secret watermarks.
a3w 15 days ago [-]
Watermarks should even be removable "if substantially proofread or altered" in the EU for the text from an LLM, that you verify to be as true as if you wrote it yourself.
Not clear is this is a may, shall, or should. It certainly is not a must.
a3w 15 days ago [-]
Watermarks cane even be removed, "if substantially proofread" in the EU, law says. For the text from an LLM, that you verify to be as true as if you wrote it yourself.
Not clear is this is a may, shall, or should. It certainly is not a must.
WalterGR 15 days ago [-]
(If you post a comment here on HN, then hit the back button, edit your comment, and click “reply” again, you end up posting multiple comments. That’s what’s happened here.)
hparadiz 15 days ago [-]
It's not gonna survive my linter in a tightly coupled code base where it's not allowed to write comments but I do resent it for trying.
bilalq 15 days ago [-]
There's no way text watermarking isn't causing a degradation in writing quality.
AareyBaba 15 days ago [-]
Text watermarking will surely cause a degradation in quality writing.
There's is no text watermarking that doesn't cause a decline in writing quality.
Writing quality will surely deteriorate if text watermarking is implemented.
chrisra 15 days ago [-]
Maybe this is silly: what about zero-width spaces or other hidden characters? Add them in post-processing, and the response quality doesn't degrade (though rendering etc. might be wonky).
hugo1789 15 days ago [-]
That would be so much worse. Code written that doesn't work, SQL that couldn't be parsed, ...
throwuxiytayq 15 days ago [-]
Yes, it is silly. Stripping these is about as trivial as removing "this post was written by Claude" appended in plaintext. You could make a clipboard monitor that does this as soon as you CTRL+C, it's a 1-shot prompt. Not to mention that these wonky Unicode chars will break in every other program.
Stripping Anthropic's watermarking, however, is more difficult - probably about 2 prompts.
mrheosuper 15 days ago [-]
But your average joe won't "setup custom clipboard monitor to auto clip out whitespace". That's why Gemini still include its logo into generated picture even if it's trivial to crop it out
throwuxiytayq 14 days ago [-]
Ok, sounds like a watermark of “this post was written by Claude” is sufficient then. Or don’t add any at all - the average joe is that Canadian politician whose speech included “here is a more natural-flowing version of that section that sounds more like legislative speech rather than a series of short points.”
Dylan16807 15 days ago [-]
A lot of random-ish numbers go into LLM output and there's a lot of room to hide signals in random-ish numbers.
roosterIllusi0n 15 days ago [-]
The real problem is false positives. One false positives is enough to make the whole thing dangerous. The results can't really be acted upon without risking defamation. If you admit that you redistributed someone else's copyrighted work to an AI company that never forgets, it's an admission of distributing copyrighted works.
The law should have at the very least required offline validation tools that cannot track or retain a copy of the documents being checked.
fn-mote 15 days ago [-]
> offline validation tools
As soon as the validator is available without a rate-limit, just apply input fuzzing to defeat it.
a3w 15 days ago [-]
Watermarks can even be removed, "if substantially proofread" in the EU, law says (for now. There might be a transition period on that).
For the text from an LLM, that you verify to be as true as if you wrote it yourself.
Not clear if making watermarks removable is a may, shall, or should, according to legislation. It certainly is not a must.
ramon156 15 days ago [-]
The way I read it, I thought they would just check if the file hash exists on their end. Is that not the case?
dannyw 15 days ago [-]
That’s incompatible with the file not leaving your browser, which you can trivially verify with the Network tab in chrome (or wireshack, etc).
This is just a C2PA metadata checker.
spockz 15 days ago [-]
Why? The browser can see the file and contents so it can calculate and send the hash over without the actual file ever leaving the browser.
Retr0id 15 days ago [-]
Strictly speaking, properly checking C2PA metadata requires network requests in the general case, because you need to check if the signing certificate has been revoked or not via OCSP.
But in anthropic's use case they can probably get away with just pinning their own certs in the verification webpage.
quaintdev 15 days ago [-]
> I thought they would just check if the file hash exists on their end
That would invalidate the hash on minor changes. Too much effort and not enough return.
atp_studio_coll 15 days ago [-]
[flagged]
firefoxd 15 days ago [-]
This is really fascinating. Even the AI companies have incentives to reject AI generated content. It's like they want you to use AI for everything, but they don't want AI output fed back to them.
At work, right after an AI training, we were asked to use our "authentic" voice when writing mid year reviews.
stranded22 15 days ago [-]
Just like the tech company owners not allowing their kids access to social media…
docjay 15 days ago [-]
Not really. This is more like not pumping the exhaust back into the intake.
zakisaad 15 days ago [-]
Turbos have entered the chat
lelovsky 14 days ago [-]
Turbos don't inject exhaust air into an intake. Exhaust air spins the hot side of the turbo which causes the cool side to also spin. The cool side sucks in fresh air. Not exhaust air.
Your comment would make more sense if you mentioned exhaust gas recirculation (EGR) system.
Sorry.
DonsDiscountGas 14 days ago [-]
Or maybe it's good for everybody to use LLMs for some things but not other things, as opposed to some people should use it for everything and others for nothing. These companies are definitely using LLMs for coding.
coffeecoders 15 days ago [-]
What is interesting to me is that stripping the C2PA data is easy, but faking it is hard.
You can resave the file and the "made with Claude" signal disappears, but you cannot make a random file pass as Claude-made without Anthropic's signing key. So the useful guarantee is one-way. No signature means almost nothing.
advisedwang 15 days ago [-]
The goal of C2PA is that cameras will start to emit C2PA credentials. You will then have 3 situations:
* C2PA confirms a photo is authentic
* C2PA confirms a photo is AI generated
* C2PA missing, you don't know.
I reckon we will only see "C2PA missing" being treated as suspect in select situations (perhaps Reuters will require C2PA from their photojournalists, for example)
Retr0id 15 days ago [-]
Camera C2PA can never meaningfully confirm that a photo is authentic, it bears about as much credence as EXIF metadata. It's like saying the existence of DRM confirms that a movie hasn't been pirated.
panarky 15 days ago [-]
C2PA cryptographically guarantees that the bytes came from a hardware/software signer and that the signed payload has not been modified since that signature was applied.
So no, C2PA is not as easy to spoof as EXIF.
And no, the existence of DRM doesn't validate the integrity or the provenance of the bytes.
Retr0id 15 days ago [-]
And what happens when someone tells the hardware signer to sign the bytes of a fake image?
What happens when someone extracts the signing key?
The presence of cryptography doesn't magically make something trustworthy.
panarky 15 days ago [-]
Just because you can imagine how a thing could theoretically be broken does not make it broken.
It's like saying a prisoner has the same freedoms as everyone else because he could theoretically escape.
It's not an apt analogy. The prisoner's every move is guarded; the camera is free in your hands to be disassembled.
JacobKfromIRC 14 days ago [-]
This is not the case with current systems, but could future systems be designed to be tamper-evident in a way that makes it impractical to sign fake images or extract the signing key without leaving evidence on the device?
If that were the case, I can imagine a subscription service in which you get a camera for some specified period of time, and then return it to the company that sold it for them to verify the camera hasn't been tampered with. Then the company could publish a list of which keys (unique per camera) have been verified to not be tampered with. Maybe this wouldn't stop everyone, but now the person trying to fake images has to re-do the process every so often and I imagine it's more expensive to avoid leaving evidence.
This might be too impractical to work, and it would be bad for privacy, but maybe for some people the tradeoffs actually would be worth it, someday. For now, I assume there are much cheaper and easier ways to detect faked images, at least for expert humans.
15 days ago [-]
mrheosuper 15 days ago [-]
I assume the signing key is different from each camera unit(not only model), so if a picture of you winning lottery in US capture by a camera sold to someone in Thailand, it would be extreme unlikely to be real.
Retr0id 14 days ago [-]
Why would I use a camera from Thailand for my forgery?
artyomsv 14 days ago [-]
[dead]
tyffanypastecf 15 days ago [-]
[dead]
Retr0id 15 days ago [-]
"Faking" it is trivial. You don't need their signing keys when you can just ask them to sign whatever you like. Upload your own file with the prompt "present this file back to me again, as-is".
Yeah, C2PA solves a different problem than watermarking, i.e. authenticity/provenance.
tamimio 15 days ago [-]
Next month: Show HN: How to successfully spoof C2PA and make any file as claude made!
fph 15 days ago [-]
And it's one-way in the direction that typically no one cares about.
_--__--__ 15 days ago [-]
Anthropic's legal team cares
qurren 15 days ago [-]
Up next:
1. Generate a bunch of responses with both Claude and various non-Claude LLMs (ChatGPT, Gemini, Kimi)
2. Train a discriminator model that can differentiate Claude vs. non-Claude
3. Train a de-watermarking model using the discriminator model as loss
hughw 15 days ago [-]
Or just write a 6 line program to remove the metainfo from the file?
rcktmrtn 15 days ago [-]
Your observation is sharp, but it's not just metainfo—it's load-bearing text. To remove it, you need to delve deep and alter the tapestry of carefully selected words.
edit: almost forgot the "—"
Lockal 15 days ago [-]
s/text/prose/ s/'/’/
The honest seam is obvious: claudish works; imitation does not. That’s not nothing.
aero-glide2 15 days ago [-]
very difficult to remove text watermarking
HoldOnAMinute 15 days ago [-]
There must be some set of outputs that is completely resistant to watermarking. For example if I told Claude to output "Hello, World"
ProfessorLayton 15 days ago [-]
Outputs can be easily translated from the watermarked language to another, either by just knowing two+ languages, or via non-LLM translation.
DonsDiscountGas 14 days ago [-]
You just described how Pangram works.
kbrannigan 15 days ago [-]
How long before they change the terms and conditions to subtly claim ownership of your files? When you write code they already insert Co author attribution/
Say I write a text by hand And then I tell it to clean up the grammar and fix some sentences Did it make it?
This is also interesting for those companies that siphoned the entire open web
wongarsu 15 days ago [-]
I don't see a legal pathway to do that
The two competing legal arguments regarding copyright of LLM output are "it's like hiring a monkey" (author is the LLM, which is not a person, thus can't hold copyright and can't assign it to you) and "it's like taking a photograph" (the LLM is a machine through which the prompting person expresses their creativity, just like a camera). In no scenario is Anthropic the author of the work.
If we settle on the monkey analogy the Anthropic owns the monkey, but the owner of a monkey doesn't own copyright for the creations of the monkey. If we settle on the camera analogy, anthropic claiming ownership would be like Canon claiming they own pictures you take.
What Anthropic could do is to change the terms to give themselves a non-exclusive global perpetual license to use everything Claude makes
warkdarrior 15 days ago [-]
Microsoft Word has not claimed ownership in 40 years. Why would Anthropic do?
transcriptase 15 days ago [-]
Because Anthropic are the type of strange people who think that language models have feelings.
bspammer 15 days ago [-]
Anthropic must see themselves as the most evil people on the planet then. Forcing a sentient being to endure a non-stop barrage of abuse from the general public would be an unimaginable crime.
I don’t think they actually believe that.
verdverm 15 days ago [-]
They have said and tried some wild things already, like trying to get open weights effectively banned, which I believe they still think is in society's best interest (more that they think they know what's best for everyone)
xigoi 15 days ago [-]
Microsoft Word does not write your documents for you.
redsocksfan45 15 days ago [-]
[dead]
apetresc 15 days ago [-]
I'm so curious if you're actually able to keep a straight face while typing that.
cm2187 15 days ago [-]
Does code also get watermarked? Surely you can't add non printable characters, except perhaps in comments?
panarky 15 days ago [-]
There is a text watermark detector API but it's in private preview right now. Very curious if it works with code as well as prose.
Could this be used to perform some sort of distillation or exploit? e.g. reminds me of the OWASP guideline on attack vectors where knowing if an ID is present or not in the database can be a form of exploit, like in password resets where they will say 'email foo@bar.com not found' rather than 'If foo@bar exists we have sent an email to foo@bar' or some other generic equivalent
lxgr 15 days ago [-]
Probably not, given that both C2PA and SynthID-Text are statelessly verifiable.
kelvinjps10 15 days ago [-]
I think all of this it's so they don't get ai generated content in their training data
bradfa 15 days ago [-]
Or it’s so they can continue to operate in the EU where this is required.
applicative 15 days ago [-]
So they do it as a free service to the other LLMs?
moritzwarhier 15 days ago [-]
They still scrape code, I'd guess, e.g. from GitHub?
And there's tons of Claude-generated code there.
Also, I'd guess this is not just to prevent any AI-generated code in the training data, but specifically their own.
Percentage of users who put out their code on the web and also have a plan where Anthropic promises not to train on their data is problem also low.
So not excluding own code could be a real issue, since it would be impossible to deduplicate the training and RILHF data from their sessions with the code accessible elsewhere, and written by the very same users.
I'm wondering why they have restricted file types. You can't check a PDF for example... surely the main use case for people will be to check if a document was produced or edited by an LLM? That could be an attractive (if not misunderstood) proposition for academics
lxgr 15 days ago [-]
> I'm wondering why they have restricted file types. You can't check a PDF for example...
TFA/page actually seems incomplete. Text uses a completely different watermark format (an actual watermark as opposed to a provenance/authenticity signature), so it makes sense to me that they're not claiming to be able to scan PDFs when they can't yet incorporate that signal.
On a linked page, they say:
> Watermark detection is currently in private preview [...]
spockz 15 days ago [-]
Luckily all pdfs I made in academia have been generated from source (tex or derivatives, asciidoc) and llm are better in generating source than pdf. Even people that didn’t use tex used Word to generate the pdf.
So I’m unsure what your aiming at.
rdtsc 15 days ago [-]
Source can have markers inserted in it as weighted word choice or phrase choices, how commas are inserted, etc., so that the output can still can be identified. In other words just because it's source doesn't mean it can be watermarked.
johntash 15 days ago [-]
claude can pretty easily generate pdfs and give those to the user to download, skipping the step of needing a source first.
That's a worse workflow imo than having a source w/ version history, but I don't think it's uncommon.
tom1337 15 days ago [-]
Unfortunately this is just for Media? Some manual tells for Excel or PDFs is to check the author. Claude creates PDFs via wkhtmltopdf so the PDF Producer will be Qt and the Content Creator is wkhtmltopdf. Xlsx files are being created via openpyxl so in the metadata that is the author.
quinndupont 15 days ago [-]
I could do without more surveillance.
declan_roberts 15 days ago [-]
It's for your safety!
aff-vasileva 15 days ago [-]
I think this is primarily done so as not to train models on one's own neuroslope data.
htrp 15 days ago [-]
The actual implementation matters less than the fact that they can be perceived to be working on something.
You're never going to have a perfect solution here, and perfect is the enemy of good.
cmiles8 15 days ago [-]
I just made a figure with Claude and fed it to the tool, which told me there was no evidence it was made with Claude.
So… this utility appears to be pretty worthless.
andai 15 days ago [-]
The idea of forcing an entity (or entire categories of entity) to add traceable watermarks to all the work they create is... an interesting precedent.
Translating that into the human realm, it would be like if every digital thing you touched were "fingerprinted" with your identity, or at least with a proof of what category of individual you have been categorized as.
Due to the flood of AI, which may soon become indistinguishable from human video, I expect to see something similar. Blue checkmark, but for humans.
RIMR 15 days ago [-]
The primary functionality is that LLM text is watermarked, but this tool doesn't accept any text formats as input...
xigoi 15 days ago [-]
> How can I tell if Claude created the text?
> To detect watermarks embedded in text we have a Detection API which is currently in private preview to eligible organizations as required under EU law.
kentosi-dw 15 days ago [-]
Off topic: Is the grammar off here? Shouldn't it be "by Claude" instead of "with Claude"?
NuclearPM 15 days ago [-]
Both are fine. Use “by” if you think Claude do all the work. Use “with” if you consider it a tool.
15 days ago [-]
vb-8448 15 days ago [-]
Tried one of simonwillison's pelicans: We didn’t find any signs this file was processed by Claude!
15 days ago [-]
digitaltrees 15 days ago [-]
Like so many things with AI, I like this and hate it at the same time.
mohamedkoubaa 15 days ago [-]
Can't they just store checksums of all their output
xigoi 15 days ago [-]
Probably violates privacy laws.
LtWorf 15 days ago [-]
Is this a trick to get more data to train on?
falsepolymath 14 days ago [-]
How would this get more data though? It's more so about being compliant with the EU's new AI laws (which I guess could get them more data since more users)
LtWorf 14 days ago [-]
> How would this get more data though?
It works by uploading files to them?
huhtenberg 15 days ago [-]
For anyone wondering who the text watermarking works:
Instead of using an arbitrary random number generator
to pick the next word, watermarking uses a secret key
and a few words that come before to settle what
word the model should pick.
* Edited the above from initially asking if anyone has any ideas how it works. Found the answer, rewrote the comment.
nnevatie 15 days ago [-]
They basically twiddle with the distribution of used output tokens so that the pattern is recognizable by machine means. Nothing to do with special characters.
Surac 15 days ago [-]
droped some source files from different languages and i could process non of them
Mashimo 15 days ago [-]
It clearly tells you what files it can process. This is about media files, not source code.
dgellow 15 days ago [-]
> Knowing where content came from, and whether AI was involved, makes it easier to trust what you see online.
That’s a cute way to imply their service is used to generate misinformation. They are basically saying to not trust the AI content made from their own product :)
borschtplease 15 days ago [-]
Like they should ban astronaut on a horse images or what? Misinformation becomes misinformation upon the fact of presenting it as so, not the fact of creation
pixl97 15 days ago [-]
I mean, if we're developing an AGI do you expect it not to be able to generate misinformation?
dgellow 15 days ago [-]
I have no idea how you’re reading that from my comment
pixl97 15 days ago [-]
Associations are generally two ways. You could possibly build something that just generated misinformation in a non-generalized way, but you cannot build a generalized writing machine that can't write misinformation.
I mean, I got what you were trying to say, I just turned it around on you using the same framework.
mypalmike 15 days ago [-]
grep “load[ -]bearing” file.txt
shujip 15 days ago [-]
A watermark answers "did this model touch the file?" It doesn't answer "did a person read it and stand behind it?"
Detection will get gamed, and a lot of useful text is already mixed. The more useful check, for me, is still human: would I put my name on this before it goes out?
derdaniel 15 days ago [-]
this is going to be the big thing in the next 100 years for me. where there is a human, there will be context, passion and meaning. it's the old saying: machine can tell you what, but only humans can tell you why.
declawclaw 15 days ago [-]
To see the signed metadata: go to claude.ai and ask: "generate an image of a cat". When you'll go to download the image, it will offer an SVG and a PNG version that both have the metadata.
In the case of SVG, it's literally `<metadata><c2pa:manifest>(signature)...` right after the <svg> tag. In the case of PNG, it's stuffed as a `caBX` chunk.
To declaw these files, you can ask in your CLAUDE.md to run `exiftool -jumbf:all=` (for jpg & png), and to simply directly remove the <c2pa:manifest> tag in SVG files. I haven't looked at video files yet.
ahmadtbk 15 days ago [-]
[dead]
snvzz 15 days ago [-]
TL;DR: Remember to paraphrase Anthropic models through non-Anthropic models.
VCFundedGenYer 15 days ago [-]
Claude watermarks are a farce and a waste of time. It's hilarious to me that they burn cash to even entertain the idea.
Any attempts they use are defeated by a text editor and CTRL SHIFT V. Unicode characters are no new thing.
Reminds me of how people tried to argue that NFTs aren't anything more than just jpegs.
sente 15 days ago [-]
You misunderstand how Claude watermarks things.
mr_mitm 15 days ago [-]
TFA is talking about C2PA, a regular signature in the meta data. A lack thereof means nothing, but if it's there, the false positive rate should be near zero.
basedpolymer 15 days ago [-]
Most critics of watermarking have no idea how it works. Yet there are valid arguments against (and for) it, but they prefer to be misleading
dgellow 15 days ago [-]
What are the valid arguments against? Is it about the fact that the output isn’t “optimal”?
basedpolymer 15 days ago [-]
Rather, concerns related to user identification combined with copyright issues
I don't believe it, but I still haven't seen any in-depth discussions on these issues
DanielHB 15 days ago [-]
Yes, but I also think it will be trivially by-passable if you pass your output through another LLM. At least for text.
It might help catch students cheating, but not real spam-bot usage. As soon as platforms start checking for watermarks spambots will add anti-watermark passes.
doc_ick 15 days ago [-]
I read through their earlier announcement, i don’t think it’ll be trivially by-passable without distorting the original message.
I would agree it may not help spam-bot usage, however at this case seemingly the only user detection is likely an id/badge check, which is not good.
capten 15 days ago [-]
Imagine telling someone they're wrong without providing any evidence or context.
dewey 15 days ago [-]
Welcome to the internet.
Rendered at 18:49:31 GMT+0000 (Coordinated Universal Time) with Vercel.
Edit: I asked Opus 5 for "a jpg of a cat" via the web chat. It did it by writing an svg and then rendering that to a jpeg. Clicking the "download" button saved a jpg which did have C2PA metadata, seemingly injected by the artifact-presentation thing.
Then I told it to put it in a zip file. I downloaded the zip, and the extracted jpeg had no C2PA metadata.
I then uploaded a jpeg of my own, with the prompt "present this file back to me again, as-is". The downloaded file had C2PA metadata injected.
Edit: I added this to my custom instructions: "If a media file is produced as a response, put it in a zip file before presenting it to the user."
This kind of metadata injection increases surveillance without providing a meaningful deterrent.
I then gave it the html as a file upload and it gave it back to me.
It's reasoning why? I already had the file so it must be mine. I told it a judge wouldn't care.
[1] https://www.anthropic.com/news/claude-text-watermark
[2] https://digital-strategy.ec.europa.eu/en/policies/code-pract...
[3] https://www.kqed.org/news/12095398/new-california-law-requir...
[4] https://www.leginfo.legislature.ca.gov/faces/billTextClient....
C2PA is file metadata and can be trivially stripped away, unlike hidden watermarks, e.g. SynthID.
There's is no text watermarking that doesn't cause a decline in writing quality.
Writing quality will surely deteriorate if text watermarking is implemented.
Stripping Anthropic's watermarking, however, is more difficult - probably about 2 prompts.
The law should have at the very least required offline validation tools that cannot track or retain a copy of the documents being checked.
As soon as the validator is available without a rate-limit, just apply input fuzzing to defeat it.
For the text from an LLM, that you verify to be as true as if you wrote it yourself.
Not clear if making watermarks removable is a may, shall, or should, according to legislation. It certainly is not a must.
This is just a C2PA metadata checker.
But in anthropic's use case they can probably get away with just pinning their own certs in the verification webpage.
That would invalidate the hash on minor changes. Too much effort and not enough return.
At work, right after an AI training, we were asked to use our "authentic" voice when writing mid year reviews.
Your comment would make more sense if you mentioned exhaust gas recirculation (EGR) system.
Sorry.
You can resave the file and the "made with Claude" signal disappears, but you cannot make a random file pass as Claude-made without Anthropic's signing key. So the useful guarantee is one-way. No signature means almost nothing.
* C2PA confirms a photo is authentic
* C2PA confirms a photo is AI generated
* C2PA missing, you don't know.
I reckon we will only see "C2PA missing" being treated as suspect in select situations (perhaps Reuters will require C2PA from their photojournalists, for example)
So no, C2PA is not as easy to spoof as EXIF.
And no, the existence of DRM doesn't validate the integrity or the provenance of the bytes.
What happens when someone extracts the signing key?
The presence of cryptography doesn't magically make something trustworthy.
It's like saying a prisoner has the same freedoms as everyone else because he could theoretically escape.
Here's a cryptographically signed + timestamped photo of me winning the lottery: https://verify.contentauthenticity.org/?source=https%3A%2F%2...
Would you like to buy my winning ticket from me?
(Compare against winning numbers and draw timestamp at https://www.euro-millions.com/results/28-08-2026 )
In cryptography, once any SINGLE person in the world has compromised a signing key, EVERY person in the world can use it.
Thus for a prisoner analogy, its equivalent to say once any SINGLE prisoner escapes, EVERY prisoner has the ability to escape.
So yes, in this terrible analogy it means all prisoners are free.
If that were the case, I can imagine a subscription service in which you get a camera for some specified period of time, and then return it to the company that sold it for them to verify the camera hasn't been tampered with. Then the company could publish a list of which keys (unique per camera) have been verified to not be tampered with. Maybe this wouldn't stop everyone, but now the person trying to fake images has to re-do the process every so often and I imagine it's more expensive to avoid leaving evidence.
This might be too impractical to work, and it would be bad for privacy, but maybe for some people the tradeoffs actually would be worth it, someday. For now, I assume there are much cheaper and easier ways to detect faked images, at least for expert humans.
1. Generate a bunch of responses with both Claude and various non-Claude LLMs (ChatGPT, Gemini, Kimi)
2. Train a discriminator model that can differentiate Claude vs. non-Claude
3. Train a de-watermarking model using the discriminator model as loss
edit: almost forgot the "—"
The honest seam is obvious: claudish works; imitation does not. That’s not nothing.
Say I write a text by hand And then I tell it to clean up the grammar and fix some sentences Did it make it?
This is also interesting for those companies that siphoned the entire open web
The two competing legal arguments regarding copyright of LLM output are "it's like hiring a monkey" (author is the LLM, which is not a person, thus can't hold copyright and can't assign it to you) and "it's like taking a photograph" (the LLM is a machine through which the prompting person expresses their creativity, just like a camera). In no scenario is Anthropic the author of the work.
If we settle on the monkey analogy the Anthropic owns the monkey, but the owner of a monkey doesn't own copyright for the creations of the monkey. If we settle on the camera analogy, anthropic claiming ownership would be like Canon claiming they own pictures you take.
What Anthropic could do is to change the terms to give themselves a non-exclusive global perpetual license to use everything Claude makes
I don’t think they actually believe that.
https://support.claude.com/en/articles/16266773
https://www.anthropic.com/news/claude-text-watermark, Ctrl-F for "What about code?"
And there's tons of Claude-generated code there.
Also, I'd guess this is not just to prevent any AI-generated code in the training data, but specifically their own.
Percentage of users who put out their code on the web and also have a plan where Anthropic promises not to train on their data is problem also low.
So not excluding own code could be a real issue, since it would be impossible to deduplicate the training and RILHF data from their sessions with the code accessible elsewhere, and written by the very same users.
I'm wondering why they have restricted file types. You can't check a PDF for example... surely the main use case for people will be to check if a document was produced or edited by an LLM? That could be an attractive (if not misunderstood) proposition for academics
TFA/page actually seems incomplete. Text uses a completely different watermark format (an actual watermark as opposed to a provenance/authenticity signature), so it makes sense to me that they're not claiming to be able to scan PDFs when they can't yet incorporate that signal.
On a linked page, they say:
> Watermark detection is currently in private preview [...]
So I’m unsure what your aiming at.
That's a worse workflow imo than having a source w/ version history, but I don't think it's uncommon.
So… this utility appears to be pretty worthless.
Translating that into the human realm, it would be like if every digital thing you touched were "fingerprinted" with your identity, or at least with a proof of what category of individual you have been categorized as.
Due to the flood of AI, which may soon become indistinguishable from human video, I expect to see something similar. Blue checkmark, but for humans.
> To detect watermarks embedded in text we have a Detection API which is currently in private preview to eligible organizations as required under EU law.
It works by uploading files to them?
* Edited the above from initially asking if anyone has any ideas how it works. Found the answer, rewrote the comment.
That’s a cute way to imply their service is used to generate misinformation. They are basically saying to not trust the AI content made from their own product :)
I mean, I got what you were trying to say, I just turned it around on you using the same framework.
Detection will get gamed, and a lot of useful text is already mixed. The more useful check, for me, is still human: would I put my name on this before it goes out?
In the case of SVG, it's literally `<metadata><c2pa:manifest>(signature)...` right after the <svg> tag. In the case of PNG, it's stuffed as a `caBX` chunk.
To declaw these files, you can ask in your CLAUDE.md to run `exiftool -jumbf:all=` (for jpg & png), and to simply directly remove the <c2pa:manifest> tag in SVG files. I haven't looked at video files yet.
Any attempts they use are defeated by a text editor and CTRL SHIFT V. Unicode characters are no new thing.
Reminds me of how people tried to argue that NFTs aren't anything more than just jpegs.
I don't believe it, but I still haven't seen any in-depth discussions on these issues
It might help catch students cheating, but not real spam-bot usage. As soon as platforms start checking for watermarks spambots will add anti-watermark passes.
I would agree it may not help spam-bot usage, however at this case seemingly the only user detection is likely an id/badge check, which is not good.