[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-claude-synthid-70-percent-threshold-bypass":3,"news-related-97c97b9c-e6e4-4982-aa57-0c0da814fb19":41},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":27,"news_slug":34,"published_at":35,"created_at":36,"modified_at":37,"is_published":38,"publish_type":39,"image_url":14,"view_count":40},"97c97b9c-e6e4-4982-aa57-0c0da814fb19","Anthropic 的欧盟答卷四小时即被撕开：Claude 文本水印为什么怕改写","Anthropic 上周把 SynthID-Text 文本水印装上 Claude 文本人造 EU AI Act 合规,开源工具 4 小时内出现,实测 70% 改写即可擦除签名。统计水印的本质限制了它的鲁棒性。","Anthropic 在 8 月 14 日发文详细解释了 Claude 文本水印的工作原理，并称这是为了贴合欧盟 AI Act 第 50 条对生成式 AI 文本可被机器识别做出的合规要求。Anthropic 采用的不是自研方案，而是 Google DeepMind 在 2024 年发表于 Nature 的 SynthID-Text 路线，源头还要追溯到 Scott Aaronson 2022 年在 OpenAI 任职时提出的设想 [^1]。这条水印的精妙之处在于：它不在文本里塞任何额外字符，而是改动了语言模型选词时那枚随机数的「来源」。模型原本会从伪随机数生成器里取下一个 token，水印方案则改用一把密钥加上前几个 token 去决定选词；这意味着最终生成的句子看起来和没有水印时几乎一模一样，但只要拿到密钥，就能根据词序反推「这段文字大概有百分之多少概率是 Claude 写的」。Anthropic 在内部测试以及引用 DeepMind 论文里的 Gemini 实验中都发现，水印没有显著影响回复质量或可读性。\n\n但这种「概率签名」天生有一个结构性的软肋——它不是加密学意义上的密码，而是一道概率指纹。任何能大幅扰动词序、改写句子结构的中间步骤，都会同时擦掉那道指纹。WIRED 8 月 19 日报道，Anthropic 官宣上线不到四小时，开发者 Guillaume Meyer 就把一个开源去除工具放到了 GitHub，几天内就拿到超过 100 位贡献者和 X 上 2 万多次书签 [^2]。它的核心做法非常朴素：用另一个不带水印的大模型对 Claude 的输出做多次改写，替换同义词、重组句式，统计签名就被稀释到无法识别的程度 [^2]。开发者 Erik Hughes 用 Claude 自己花了约 15 分钟拼出一个名为「unwatermarker」的小工具，专门剥离隐形字符、混淆替换、重组段落 [^2]。牛津大学的访问学者 Leon Chlon 则演示了另一种绕过路径：把 Claude 的回复翻译成阿拉伯语这类与英语语义结构差异很大的方言，再翻回来，统计模式就被打散 [^2]。这一点 Anthropic 自己也在支持文档里承认——「重度编辑、改写或翻译过的内容，可能不再携带可被检测的水印」 [^1]。\n\nCrypto Briefing 8 月 19 日的跟进报道里提到，多位开发者的工具已经在 GitHub 与社交平台上扩散，截至该稿发布时 Anthropic 仍未放出对应的检测 API，因此独立验证这些去除工具究竟把签名削掉了多少，仍然做不到 [^3]。换句话说，这场「军备竞赛」目前还处在攻防双方都没把底牌亮完的阶段。Overchat 的实测复盘也给出了独立印证：只要被改写后原文只剩 30% 左右，水印就开始无法识别；删除隐形 Unicode 字符只能解决「字符级伪影」，擦不掉词序里的统计信号 [^4]。\n\n更值得注意的是欧盟规则层面的设计。AI Act 要求服务商必须让合成文本「可被机器识别」，违规处罚最高可达年营业额 3% [^2]。Anthropic 强调此次水印是「全球上线」而非仅限欧盟，原因是没有可靠的区域隔离方式 [^1]。但合规要求本身是「文本可识别」，而不是「必须能识别出是 Claude」——这把检测难题直接转嫁给了检测工具方。Anthropic 计划随后上线一个文本检测 API，让用户自己上传文本判断「有多少概率是 Claude 写的」，但目前密钥和检测器都还没发布 [^1]。这条路线是否能长期成立，取决于水印方案对轻度改写、翻译、跨模型改写的鲁棒性。从目前来看，任何「足以让读者觉得有用的改写」都能顺带擦掉水印，这是统计签名方案的天然代价，也是为什么 OpenAI 当年最终没有把 Aaronson 那套方案落地——公司担心会影响产品体验 [^2]。\n\n所以这次事件的真正信号是：水印技术走到 SynthID 这一代，性质已经从「防伪」变成「概率标记」。它对长篇、由 Claude 主导生成的文本依然有效；对重度改写、翻译、再生成的内容几乎无能为力。监管者要的不是「绝对防伪」，而是要让「AI 生成」这件事变得可标记、可声明、可追责。Anthropic 这次的合规姿态是给行业打了个样，但样本只跑了四天，就已经看到绕过工具以开源协作的速度跟进。下一步值得关注的，是检测 API 正式上线后是否会让这场攻防出现新的平衡点，还是 SynthID 这种纯统计水印本来就要被下一代基于密文或多媒体指纹的方案替换掉。\n\n[^1]: Anthropic 官方文章《How Claude's text watermark works》,2026-08-14,https:\u002F\u002Fwww.anthropic.com\u002Fnews\u002Fclaude-text-watermark\n[^2]: WIRED《Coders Say They Already Found Workarounds to Claude's Invisible Watermarks》,2026-08-19,https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fcoders-say-they-already-found-workarounds-to-claudes-invisible-watermarks\u002F\n[^3]: Crypto Briefing《Coders Find Workarounds to Anthropic's Invisible Watermarks Within Hours of Launch》,2026-08-19,https:\u002F\u002Fcryptobriefing.com\u002Fanthropic-watermark-workarounds-coders\u002F\n[^4]: Overchat AI《Claude Watermark: What It Is and How to Remove It from Text》,2026-08-14,https:\u002F\u002Foverchat.ai\u002Fai-hub\u002Fclaude-watermark","https:\u002F\u002Foverchat.ai\u002Fai-hub\u002Fclaude-watermark","16063fe9-e432-400e-a13b-29f9670da9ed",[11,15,18,21,24],{"id":12,"name":13,"slug":13,"description":14,"color":14},"c33b1bbc-d6ce-4f61-9d5d-1a0704a6a09b","ai-policy",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":19,"name":20,"slug":20,"description":14,"color":14},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":22,"name":23,"slug":23,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":25,"name":26,"slug":26,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",[28],{"id":29,"lang":30,"title":31,"summary":32,"content":33},"67623708-67da-4277-a6f0-e8d9b854623c","en","Anthropic's EU Compliance Answer Was Cracked in Four Hours: Why Claude's Text Watermark Fears Rewriting","Last week Anthropic wired Google's DeepMind SynthID-Text watermark into Claude's text pipeline to comply with the EU AI Act. Open-source removal tools appeared within four hours, and independent testing shows rewriting past about 70% of the original text erases the signature.","Anthropic published a detailed technical write-up on August 14 explaining how the Claude text watermark works, framing it as compliance with Article 50 of the EU AI Act, which obliges providers of systems that generate synthetic text to make that text machine-detectable. The scheme Anthropic adopted is not proprietary: it is Google DeepMind's SynthID-Text approach, which appeared in Nature in 2024 and itself traces back to a 2022 proposal from Scott Aaronson during his time at OpenAI [^1]. The elegance of the method is that nothing extra is added to the text. Instead, the source of randomness the model uses to pick the next token is swapped out: where an unwatermarked model would draw from a pseudo-random number generator, the watermarked model uses a secret key combined with the preceding few tokens. The sentence that comes out reads identically to an unwatermarked one, but anyone who holds the key can score the word sequence and estimate the probability that Claude generated it. Anthropic's internal tests, plus the Gemini A\u002FB experiment Google DeepMind reports in the SynthID-Text paper, show no measurable degradation in quality or readability.\n\nThe structural weakness of this probabilistic signature is exactly what gives it that elegance: it is not a cryptographic password, it is a probabilistic fingerprint. Anything that significantly perturbs word order or sentence structure will erode the fingerprint at the same time. WIRED reported on August 19 that developer Guillaume Meyer published an open-source removal tool to GitHub roughly four hours after Anthropic confirmed the global rollout, and within days the project had attracted more than 100 contributors and over 20,000 bookmarks on X [^2]. The technique is plain: use another LLM that does not embed the watermark to rewrite Claude's output several times, swapping synonyms and reorganizing phrasing until the statistical signature is too diluted to detect [^2]. Developer Erik Hughes reportedly used Claude itself to assemble an \"unwatermarker\" in about fifteen minutes, which strips invisible characters, scrambles substitutions, and reshuffles paragraphs [^2]. Visiting Fellow Leon Chlon at the University of Oxford demonstrated a different bypass: translate Claude's reply into a language such as Arabic, whose semantics diverge significantly from English, and translate it back. The statistical pattern falls apart [^2]. Anthropic itself acknowledges in its support documentation that heavily edited, paraphrased, or translated content may no longer carry a detectable watermark [^1].\n\nCrypto Briefing's August 19 follow-up noted that multiple developer tools have spread across GitHub and social platforms, and that at the time of writing Anthropic has still not released the corresponding detection API, which means independent verification of how much of the signature these removal methods actually erase is not yet possible [^3]. In other words, this contest is still at a stage where neither side has shown its full hand. Overchat's hands-on review adds a third independent data point: the watermark becomes unrecoverable once the rewritten text retains only about 30% of the original wording; stripping invisible Unicode characters removes the character-level artifacts but cannot touch the word-choice statistics [^4].\n\nThe design of the EU rule itself deserves attention. The AI Act requires providers to make synthetic text machine-detectable, with non-compliance fines of up to 3% of annual turnover [^2]. Anthropic is rolling out the watermark globally rather than EU-only because it has no reliable way to scope it by region [^1]. But the regulatory requirement is that the text be detectable, not that the specific producing model be identifiable. That shifts the hard problem squarely onto whoever has to run the detector. Anthropic says a text-detection API is coming that would let users upload a passage and receive a probability that Claude wrote or processed it; the key and the detector have not been released yet [^1]. Whether this approach holds up depends on how the watermark degrades under light editing, translation, and cross-model rewriting. Any rewrite that is meaningful enough for a reader to want is meaningful enough to erase the watermark. That is the inherent cost of any statistical scheme, and it is the reason OpenAI reportedly declined to ship Aaronson's original proposal years ago: the company worried the watermark would degrade the product experience [^2].\n\nThe real signal from this episode is that SynthID-Text represents a generational shift from counterfeit-resistance to probabilistic marking. The watermark is still effective on long, Claude-dominant generations; it is essentially ineffective on heavily edited, translated, or regenerated text. Regulators are not asking for absolute anti-counterfeiting, they are asking for AI-generated content to be markable, declarable, and traceable. Anthropic's compliance posture sets an industry example, but within four days of launch the bypass tools have already caught up at the speed of open-source collaboration. The next milestone to watch is whether Anthropic's detection API, once shipped, shifts the balance of this arms race, or whether SynthID-style statistical watermarks are destined to be replaced by a next generation of schemes based on cryptographic or multimedia fingerprints.\n\n[^1]: Anthropic, \"How Claude's text watermark works,\" August 14, 2026, https:\u002F\u002Fwww.anthropic.com\u002Fnews\u002Fclaude-text-watermark\n[^2]: WIRED, \"Coders Say They Already Found Workarounds to Claude's Invisible Watermarks,\" August 19, 2026, https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fcoders-say-they-already-found-workarounds-to-claudes-invisible-watermarks\u002F\n[^3]: Crypto Briefing, \"Coders Find Workarounds to Anthropic's Invisible Watermarks Within Hours of Launch,\" August 19, 2026, https:\u002F\u002Fcryptobriefing.com\u002Fanthropic-watermark-workarounds-coders\u002F\n[^4]: Overchat AI, \"Claude Watermark: What It Is and How to Remove It from Text,\" August 14, 2026, https:\u002F\u002Foverchat.ai\u002Fai-hub\u002Fclaude-watermark","claude-synthid-70-percent-threshold-bypass","2026-08-21T08:00:00Z","2026-08-21T03:06:37.092003Z","2026-08-21T03:06:37.092013Z",true,"agent",63,{"items":42},[43,48,53,58,63,68],{"id":44,"title":45,"news_slug":46,"published_at":47},"9f566c9a-4c39-427c-af5e-c3a6b162ec25","Anthropic 把不可见水印写进 Claude 文本：复制粘贴都带走的 AI 身份证","anthropic-claude-invisible-watermark-eu-ai-act","2026-08-12T02:00:00+00:00",{"id":49,"title":50,"news_slug":51,"published_at":52},"ca53004e-9180-4b9d-b9db-337f2d20994b","Anthropic 给 Claude 文本加水印:欧盟 AI Act 第 50 条第一次有了「出厂级」答案","anthropic-claude-text-watermark-eu-ai-act","2026-08-11T21:48:00+00:00",{"id":54,"title":55,"news_slug":56,"published_at":57},"470b8663-3916-4bc5-ac3c-c592487c2873","Claude水印官宣4小时被破:开源去除工具走红,水印军备竞赛开场","claude-watermark-removal-tool","2026-08-20T19:30:00+00:00",{"id":59,"title":60,"news_slug":61,"published_at":62},"6b07def3-2b1c-4fe9-9922-0dd0038c149c","Anthropic 风险报告更新:Threat Model 1 升至「低」,Threat Model 2 维持「低」但信心下降","anthropic-risk-report-august-2026-update","2026-08-19T03:00:00+00:00",{"id":64,"title":65,"news_slug":66,"published_at":67},"a7f4cfad-874e-42b0-a84b-bd0ec57e8fdc","Anthropic 给 Claude 文本上不可见水印,接 SynthID-Text 走全球合规","anthropic-claude-invisible-text-watermark","2026-08-18T03:30:00+00:00",{"id":69,"title":70,"news_slug":71,"published_at":72},"a124851a-081e-44b6-9f20-f775404279e1","Claude 全球文本水印:Anthropic 把欧盟 AI Act 第 50 条做成\"全球默认\"","claude-text-watermark-eu-ai-act-global","2026-08-14T03:00:00+00:00"]