Модели с искусственным интеллектом Наносят на Текст Водяные Знаки — Вы Заметили?

11 августа компания Anthropic объявила, что все будущие модели Claude будут генерировать текст, содержащий водяной знак, который идентифицирует результаты работы как созданные искусственным интеллектом. Компания не одинока. У Google есть свой собственный текстовый водяной знак (на котором основан Anthropic), который он использует при выводе своих моделей Gemini. OpenAI еще не представила текстовый водяной знак, но планирует это сделать.

Быстрое распространение водяных знаков отчасти является ответом на Закон Европейского союза об искусственном интеллекте, который предписывает использовать водяные знаки для моделей искусственного интеллекта, выпущенных после 2 августа 2026 года, наряду с другими запланированными и предлагаемыми нормативными актами, направленными на сдерживание распространения вводящего в заблуждение или манипулятивного контента, созданного с помощью искусственного интеллекта. Но новые правила могут дорого обойтись пользователям ИИ, которые просто хотят получить наилучшие результаты.

Водяные знаки ИИ могут применяться ко многим формам контента: Закон ЕС об ИИ также требует их для изображений, аудио и видео. Такие мультимедийные водяные знаки используются уже много лет, и, хотя их эффективность как комплексного решения для маркировки с помощью искусственного интеллекта остается предметом споров, уровень обнаружения с их помощью может превышать 99 процентов. Водяные знаки на изображениях и видео уже используются, в частности, OpenAI, Google и Meta. (В Anthropic нет модели создания изображений).

Однако текстовые водяные знаки используются реже, и не все убеждены в том, что создание текстовых водяных знаков может работать без ущерба для качества отклика модели искусственного интеллекта. Джон Грубер, известный специалист по технологиям и один из создателей Markdown Language, называет водяной знак "извращением письменности" и оспаривает утверждение Anthropic о том, что водяной знак не меняет значения или качества текста. Изображения состоят из миллионов пикселей, отмечает он, в то время как текстовые ответы часто охватывают всего десятки или сотни слов. Текст, по-видимому, предоставляет гораздо меньше места для изменения результатов работы ИИ таким образом, чтобы это можно было обнаружить, но не нарушало работу.

Джон Кирхенбауэр, научный сотрудник Института Vector и соавтор статьи 2023 года, в которой одним из первых был описан метод нанесения водяных знаков на текст, не согласен с этим. "[Водяной знак] невозможно было бы обнаружить, если бы не было изменений. Это очень важный момент", - говорит он. "Вопрос в том, волнует ли вас, что это не совсем оригинальный дистрибутив, если, по сути, он не меняет вашей полезности для вас?"

Realistically, the issue comes down to that word, "utility." Does watermarking AI-generated text meaningfully degrade the experience of the person using it? The answer is still under dispute.

The term "watermark" is so familiar that it can cause confusion about how the technology works when applied to AI. A text watermark is not metadata or invisible characters; it is something much more subtle. The exact details vary between methods, but text watermarks are generally impossible for a human (and, in many cases, even a computer) to detect without access to the specific key used to detect a specific watermark. Understanding why requires an understanding of how LLMs work.

An LLM produces a probability for every word that could come next at each step in its response to a prompt. (From here on, I’ll be using "words" interchangeably with "tokens," although tokens also represent numbers, punctuation, and more). A likely word might get a 40 percent probability, a plausible alternative 10 percent, and an unlikely one a fraction of a percent. The model then picks a word at random, weighted by those numbers. The most probable word usually wins, but not always.

"[A watermark] wouldn’t be detectable if there wasn’t a change. This is a very fundamental point." —John Kirchenbauer, Vector Institute

This process provides an opportunity to hide a text watermark by introducing subtle changes to how words are selected.

The 2023 paper by Kirchenbauer and his colleagues provided one of the first examples of how to implement a text watermark, and it remains the most widely cited technique. The researchers describe a watermark which sorts words into a red list and a green list. The red-list words are unaltered, but the green-list words are nudged to be slightly more probable.

"If we sample from this modified distribution, then while any one token choice won’t necessarily come from that preferred set, over many samples, we’ll preferentially pick words from that up-weighted subset," Kirchenbauer says.

The text watermark is embedded in the choice of words used, which is why it is effectively invisible to humans. Kirchenbauer and colleagues reported a detection rate of 98.4 percent, and zero false positives, in responses that contain about 200 tokens. The embedded pattern of word probabilities also means that simple paraphrasing won’t obscure the watermark. The paper reports that removing the watermark from a long response requires changing roughly one quarter of its words or more.

Although AI text watermarking is designed to be invisible to human readers, by definition it influences the word patterns in AI-generated text. That algorithmic meddling is what makes critics like Gruber concerned that watermarking reduces the overall quality of the output.

The strongest evidence that text watermarking doesn’t impact quality comes from a 2024 paper by a team from Google, which introduced the company’s watermarking scheme called SynthID-Text. Anthropic’s watermark is also based on SynthID-Text, though altered in ways that Anthropic hasn’t detailed.

To show that the SynthID-Text watermark doesn’t impact quality, the Google authors randomly routed Gemini user queries to watermarked and non-watermarked variants of Google’s text models. Then they compared overall user feedback on the output. The authors found no significant difference in user feedback across 20 million responses.

Still, some researchers remain skeptical that watermark methods have no impact on the quality of an AI-generated response. Their skepticism stems from edge cases that can make a watermark more difficult to implement.

Vinu Sankar Sadasivan, an AI research scientist at Meta who co-authored a widely cited paper on the detectability of AI text watermarks, says watermarks particularly struggle when the number of potential word choices is small. "For a tweet that is 20 words, I would need to have 50 or 60 percent of the words to be from ‘green list’ for it to be detected well," he says. A basic Python function generated by AI would create a similar tension between the strength of the watermark and the quality of the model’s response.

"This is where I have a disagreement with some of the PR posts from Anthropic, where they say it has no quality change," says Sadasivan. He explains that it’s possible to dynamically increase or decrease the strength of a watermark to preserve the quality of a response in difficult situations, but doing so can also decrease the strength of the watermark. Google’s SynthID-Text paper includes an example of this in a graph that plots detection rates against the number of tokens in a response. The detection rate was up to 95 percent accurate in best-case scenarios, but it fell below 50 percent for short replies. Without more information from Anthropic, it’s difficult to know how the company is walking the line between the quality of an AI response and the strength of its watermark. Anthropic declined to provide additional information for this article.

The dispute over AI text watermarks is not just about how well they work, but also about what kinds of tradeoffs are reasonable in exchange for a clear labeling of AI-generated text. Gruber’s position is that altering the text is not acceptable because it makes an AI model’s output different from what it would otherwise be. The EU’s AI Act, on the other hand, implies that some alteration is acceptable if it informs people that they are reading AI generated text.

"For a tweet that is 20 words, I would need to have 50 or 60 percent of the words to be from ‘green list’ for it to be detected well." —Vinu Sankar Sadasivan, Meta

Further complicating the situation, AI researchers are increasingly focusing on text watermarks for purposes other than labeling individual examples of AI-generated text. In particular, watermarks can be used to track data at scale.

A 2026 paper co-authored by Kirchenbauer shows that an AI model trained on watermarked text will itself produce output bearing the watermark. A content owner who watermarked their documents before publishing them could therefore use those traces as statistical evidence that their text ended up in a model’s training data.

Alternatively, an AI company training a new model could use text watermarks to exclude content generated by previous generations of the model from its training data. Such guardrails could help avoid model collapse, in which AI models keep recycling and amplifying their own errors

These broader concerns shift the entire debate over text watermarking, in Kirchenbauer’s view. "It’s not necessarily about the ‘you used AI’ accusation as the goal. It’s headed into tracing data provenance, model recycling, and things like that," he says. "I think you use [a text watermark] as a general piece of metadata, in some ways more robust, in some ways less robust, that can be attached to content and allows you to trace where it goes."

>