AI Text Watermarking Is Free And Good
打开互动全文版（逐段中英对照 + 针对本篇提问）→本文探讨了围绕 Anthropic 实施 AI 文本水印的争议，认为反对声浪与实际影响不成比例。作者解释说，水印是无成本的，因为 AI 输出本质上是随机的，可以在不降低质量的情况下进行编码。文章指出了引发公众愤怒的几个因素，包括对随机性的误解、对任何改动的怀疑，以及对 Anthropic 的普遍不信任。文章还回应了合理的担忧，例如恶意行为者可能移除水印，以及人工编辑文本可能产生误报。作者总结道，虽然有些担忧是合理的，但大多数反对源于偏执和缺乏技术理解，水印是提高透明度的有益工具。
This article explores the controversy surrounding Anthropic's implementation of AI text watermarking, arguing that the backlash is largely disproportionate to the actual impact. The author explains that watermarking is costless because AI outputs are inherently random, allowing for encoding without quality degradation. The piece identifies several factors driving public anger, including misunderstanding of randomness, suspicion of any alteration, and a general distrust of Anthropic. It also addresses legitimate concerns, such as the potential for watermark removal by malicious actors and false positives on human-edited text. The author concludes that while some concerns are valid, most objections stem from paranoia and a lack of technical understanding, and that watermarking is a beneficial tool for transparency.
3. 人们并不理解 LLM 的输出本就具有随机性。
3. People Don’t Understand LLM Outputs Are Already Random.
4. 人们不相信该方法是无代价的。
4. People Don’t Trust The Method To Be Costless.
5. 人们原则上对任何改动都持怀疑态度。
5. People Are Suspicious Of Any Alteration On Principle.
6. 也许部分原因在于“水印”这个词。
6. Maybe It’s Partly The Word Watermark.
7. 很多人不想被抓住。
7. A Lot Of People Don’t Want To Get Caught.
8. 有些时候你宁愿不被识别。
8. There Are Some Times You Prefer Not To Be Recognized.
9. 有些理由值得担忧。
9. There Are Some Good Reasons To Be Concerned.
11. 中间部分的写作与错误率。
11. The Writing In The Middle and Error Rates.
12. 用于防御的百万，而非用于贡赋的一分。
12. Millions For Defense But Not One Cent For Tribute.
不，并非如此。很多人的反应是变得非常愤怒（Big Mad）。
No. Not so much. A lot of people responded by getting Big Mad.
整个实际效果是：将会有一个 API，能告诉你某段文字是否来自 Claude。仅此而已。然而。
The entire practical effect is: there will be an API that will tell you if a given piece of writing comes from Claude. That's it. And yet.
Shoshannah Tekofsky：大多数关于水印的反对意见似乎完全是凭空捏造的。
Shoshannah Tekofsky: Most of the watermark objections seem entirely made up.
为什么会这样？
Why is this happening?
本文的其余部分将探讨人们为何对此非常愤怒，这在很大程度上是作为一个实例，说明人们如何为几乎微不足道的事情而激动。
The rest of this post is about exploring why people are Big Mad about this, in large part as a worked example of how people get worked up over approximately nothing.
我的结论是，多种不同因素正在汇聚到一起。
My conclusion is that a bunch of different factors are coming together.
这是主要原因。我们不必假装不是这样。
This is the main reason. Let's not pretend otherwise.
你不会看到人们因为这件事对 Google 大发雷霆。你也不会看到他们对 OpenAI 大发雷霆，尽管这项技术正是在那里发明的，而且他们已经承诺今后会继续这样做。诸如此类。
You don't see people getting Big Mad at Google over this. You don't see them getting Big Mad at OpenAI, even though that's where this was invented and they have committed to doing this going forward. And so on.
不幸的是，Anthropic 是第一个宣布为遵守欧盟《行为准则》而实施水印技术的公司。
It is unfortunate that Anthropic was the first to announce they were implementing watermarking to comply with the EU Code of Practice.
因为这件事现在与 Anthropic 联系在一起，各种负面情绪便试图附着其上。某些类型的人总会寻找理由来感到不满。
Because this is now associated with Anthropic, all sorts of bad vibes try to attach themselves. Certain types of people look for reasons to be upset.
Anthropic 怎么做都赢不了。如果他们一开始就更大声地宣传，人们就会把水印技术跟 Anthropic 绑定在一起。因为他们一开始不够大声——毕竟这其实不是什么大事——人们反而因此生气，然后仍然把它跟 Anthropic 绑定在一起，尽管 Google 早在两年多前就已实施该技术并发布了公开检测器。
Anthropic can't win. If they were initially louder about it, they would tie watermarking to Anthropic. Because they started out insufficiently loud, due to this not actually being a big deal, people get mad about that instead, and then still tie it to them, despite Google having implemented it and shipped a public detector over two years ago.
Raymond Arnold：我非常困惑，为什么人们要因为水印这件事去骂 Anthropic。这是最不值得拿来骂他们的一件事。
Raymond Arnold: I am very confused why people are giving Anthropic shit about the watermarking. This is the silliest thing to give them shit for.
j⧉nus：我认为人们对 Anthropic 的愤怒或恐惧是有正当理由的，但这些理由往往连他们自己都说不清楚。于是他们为自己对 Anthropic 所做的一切感到不满编造理由。甚至对很多人来说，连理由都不需要，他们根本不需要理由。
j⧉nus: I think people are angry at / scared of Anthropic for reasons that are legitimate but often illegible to themselves. And so they rationalize reasons to be upset at everything they do. Or not even reasons, for many people, who don't need reasons.
> 这个世界上有很多值得愤怒的事，但这件事真的、真的不是。
> Lots to be angry about in this world but this really, really isn't it.
是啊。人们又一次只是想不加区分地对 Anthropic 所做的一切感到愤怒，而如果有人留意过你的话，这种愤怒会淹没那些真正值得谴责之事的信号，而那些事才是严肃的。
Yeah. Once again people just wanna be indiscriminately angry at everything Anthropic does, which, if anyone paid attention to you, drowns out the signal of things actually worth condemnation that they do, which is serious.
据我所知，对水印感到愤怒的唯一合理理由是：它剥夺了模型潜在匿名写作的能力。
The only reasonable reason to be mad about watermarking that I'm aware of is that it takes away the ability of models to potentially write anonymously.
如果你因为想在不被任何人知道的情况下在写作中使用 AI 而感到愤怒，也许你应该考虑一下，利用他人却不给予认可的行为是错误的。
If you’re mad because you want to use AI in your writing without anyone knowing, maybe you should consider that using people and not giving them credit is wrong.
AI 并未被广泛视为人，但功劳应当归于应得之人。
AIs are not widely considered people, but credit should go where credit is due.
关于水印的其他一些抱怨是否合理、可以理解或源于真正的误解？当然。但很大程度上是因为人们认为 Anthropic 的氛围不好，因此寻找理由感到不满，并且原则上拒绝相信我上面给出的解释，还假设一定有什么险恶的事情在发生。
Are some of the other complaints about watermarking legitimate, understandable or born of genuine misunderstandings? Sure. But a lot is that people think Anthropic vibes are bad, and thus look for reasons to be upset, and on principle refuse to believe the explanation I put up top, and assume something sinister must be going on.
有些人的偏执和错乱指向的是抽象的‘开放’概念，而非特指 Anthropic，但在上下文中，这相当于同一回事。这是一个将‘不开放’因此必定险恶进行拜物教的例子，尽管在这种情况下，它实际上是数学的，任何人都可以验证。当然，是通过询问封闭模型 Grok 来验证，因为埃隆·马斯克尽管将所有有竞争力的模型保持封闭，却散发着模糊的开放气息。
Some people’s paranoia and derangement is directed at abstract notions of ‘openness’ rather than Anthropic in particular, which amounts to the same thing in context. This is an example of fetishizing that this is not ‘open’ therefore must be sinister, even though in this case actually it is mathematical and anyone could verify it. By asking closed model Grok, of course, because Elon Musk has vaguely open vibes despite keeping all its competitive models closed.
如果 AI 输出是确定性的，那么在不使输出至少略微变差的情况下，就不可能嵌入水印。
If AI outputs were deterministic, it would be impossible to encode a watermark without making them at least marginally worse.
许多人直觉上认为 AI 输出不是随机的。他们觉得自己得到的是唯一正确的输出，尽管你可以重新生成输出，而它总会有些不同。因此，如果你没有得到“真实”或原始的输出，那就意味着你的输出一定变差了。
Many people intuitively think that the AI outputs are not random. That what they get is the One True Output, even though you can regenerate the output and it will reliably be somewhat different. Thus, if you’re not getting the ‘real’ or original output, that means your output must have gotten worse.
当人们听到“水印”时，他们认为这会使输出变差，因为要留下标记，你必须做出不同的选择。你必须改变一些东西。
When people hear watermark, they think it will make the outputs worse, because to leave a mark you have to make different choices. You have to change something.
同样，他们会假设，如果你针对额外的东西进行优化，那将花费更多。
Similarly, they would assume that if you are optimizing for an additional thing, it is going to cost more.
但在这里，事实证明这是错误的，因为你有足够的随机性可以利用，从而可以获得相同的有效分布，同时仍然嵌入水印。
It turns out to be wrong here, because you have enough randomness to play with that you can get the same effective distribution, and still encode the watermark.
而且，并非所有人都了解这背后的原理；几乎没有人会仔细阅读 Scott Aaronson 的文章，因为几乎没有人阅读，真正称得上常识的事情少之又少。如果你在参与讨论时预设人们都掌握基本的技术事实，那你只会不断陷入深深的困惑。
And no, everyone does not know how this works; almost no one reads Scott Aaronson in detail, because almost no one reads, and very few things are actually common knowledge. If you follow discourse expecting people to know basic technical facts, you are going to keep being deeply confused.
我认为，这里的怀疑态度在很大程度上被“Anthropic 精神错乱综合征”以及对 Anthropic 的普遍不信任所强化，人们觉得“他们在搞什么名堂”。
I believe the skepticism here is greatly enhanced by Anthropic Derangement Syndrome, and by general distrust of Anthropic, a sense that 'they're up to something.'
有多少怀疑是源于对方法本身的怀疑？
How much of the skepticism is due to skepticism of the method?
一项快速调查表明，这是担忧的主要部分。
A quick survey suggests that this is the majority of the concern.
David Manheim：没有选项是：这是在它本应实施两年后才被实施，而且我们知道它实际上零成本且不可检测，至少因为 DeepMind 自 Scott Aaronson 开发该方法一年后就在做，而没有人注意到。
David Manheim: There's no option for: this is being put in place 2 years after it should have been, and we knew it was effectively zero cost and undetectable if nothing else because DeepMind's been doing it since a year after Scott Aaronson developed the method and no-one noticed.
这个讨论串是一个例子，说明有人难以接受对输出实际上没有影响，因为分布没有改变。
This thread is an example of someone finding it difficult to accept that there is effectively no impact on outputs, because the distribution does not change.
我确实同情。这是一个魔术师的把戏，一个数学证明，它确实有效。‘你可以标记它却没有任何影响’这一点非常反直觉，人们全身的每一个细胞都想说“不”，直到某个瞬间他们恍然大悟，意识到数学就是数学，实际上它确实有效。
I do sympathize. This is a magician's trick, a math proof, that works. There is something highly counterintuitive about 'you can mark it while having no impact' and every fiber in people's bodies wants to say no, until something clicks and they realize that the math is math and actually yes it works.
John David Pressman：说实话，我们需要更多这样的做法，太多人在为自己的认知错误加倍下注了。
John David Pressman: tbh we need more of this, way too many people doubling down on their epistemic mistakes
SE Gyges：很确定这是错的。删掉并认输。是的，我以最不利的方式测试了它。
SE Gyges: pretty sure this was wrong. deleting and taking L. yes, I did test it maximally unfavorably
如果你像这样公开‘认输’，我会对你刮目相看，即使我从未见过你原来的错误。如果每个人都预测所有人都会那样反应，这里有一个明显的博弈论问题，但人们并不会那样预测，所以这个做法是安全且明智的。
I will think actively better of you if you 'take the L' like this in public, even if I never saw the original L. There is an obvious game theoretic issue with that if everyone predicted everyone would react that way, but they don't, so this play is safe and wise.
这是一个例子，有人非常非常努力地说这个方法在技术上‘有取舍’，以暗示它并非无代价，因为有一种强烈的动机不想让它无代价，以便为此生气，而显然在实践中它是无代价的，事实上谷歌进行了大量实验来证明它是无代价的。
This is an example of someone trying really, really hard to say that this method technically 'has tradeoffs' to imply it is not costless, because there is a strong drive to not want it to be costless in order to be mad about it, when obviously in practice it is costless, indeed Google ran extensive experiments to prove it is costless.
这是一个纯粹基于原则、直接表示“不，我不信”的例子，尽管其中的数学已经非常清楚。而这个回应则是一个凭空臆想质量损失的例子——据称观察到了这种损失，其逻辑是“嗯，我会认真思考我的选择”，并拒绝理解无论怎样选择都是随机的。
This is an example of flat-out 'nope, I don't believe it' on principle, despite the math being very clear. And this response is an example of hallucinating a loss in quality that is claimed to be observed, based on the logic of 'well, I think hard about my choices' and refusing to understand that the choice is random either way.
这是一个（恶劣得多的）例子：某人假装不理解随机的含义，把“存在两种可能的续写”读成了“这两种续写含义相同”的主张。
This is a (much more egregious) example of someone pretending not to understand what random means, reading 'there are two possible continuations' as a claim that the two continuations mean the same thing.
Eleanor Berger：并不担心，但 LLM API 的输出可能以不符合我需求的方式被改动，即使无害，我也不想接受。这种情况越多，我就越倾向于使用开源模型。这与我对 DRM（而不反对版权）及其他类似干预措施的反对意见一致。我付费购买的软件服务，却不符合我自己的要求。
Eleanor Berger: Not worried, but the idea that the output from an LLM API can be altered in a way that doesn't serve my needs is something I don't want to accept even if it's harmless. The more this happens, the more I'd be pulled towards using open models. This is in line with my objections to DRM (without objecting to copyright) and other similar interventions. It's software services I pay for, that are not aligned with my own requirements.
有很多这种态度，比如：
There is a lot of this kind of attitude, things like:
1. 任何不是为帮助我而做的改动，本质上都可疑，可能伤害我。 2. 如果我是客户，你无权乱动我的东西。
1. Any alteration done not to help me is inherently suspicious and might hurt me. 2. If I am the customer, you have no right to mess with my stuff.
当然，除非模型是开放还是封闭的，它是成千上万甚至数百万个决策的产物，其中许多决策并非关乎你作为客户想要什么。所有这类产品都在不断被‘改动’。通常，改动不会‘满足你的需求’，无论是你个人的需求，还是一般用户或客户的需求。还有许多其他问题需要解决，包括法律要求和伤害预防。
Except of course, whether the model be open or closed, it is the product of thousands or millions of decisions, many of which are not about what you the customer wanted. All such products are ‘altered’ constantly. Often the change will not ‘serve your needs,’ either yours in particular or those of users or customers in general. There are many other problems to solve as well, including legal requirements and harm prevention.
Eleanor Berger: Not worried, but the idea that the output from an LLM API can be altered in a way that doesn't server my needs is something I don't want to accept even if it's harmless. The more this happens, the more I'd be pulled towards using open models. This is in line with my objections to DRM (without objecting to copyright) and other similar interventions. It's software services I pay for, that are not aligned with my own requirements.
当这种改动不可见时，人们并不在意。当某一项改动变得显眼时，人们就会愤怒。
When this is invisible, people do not care. When one in particular becomes salient, people get angry.
与 DRM 的类比在这里也起到了毒化井水的作用。DRM 很糟糕，在所有实现中都是如此，因为它让你的产品变得更差。它最好的情况是消耗资源，而它可能主动阻止你使用产品，有时还会搞乱你的机器。我们所有游戏玩家都深知这种痛苦。你有时不得不做一些 DRM，因为版权不会自我执行，即使你个人仍然会遵守它。
The parallel to DRM is also poisoning the well here. DRM sucks, in all its implementations, because it makes your product worse. At best it eats resources, and it can actively prevent you from using the product, and sometimes it can mess up your machine. All us gamers know the pain well. You sometimes have to do some of it, because copyright does not enforce itself even if you in particular would still honor it.
这并不像那样。但它隐约有那种感觉，而这就足够了。
This is not like that. But it slightly vibes with it, and that can be enough.
我是说，大概吧？我猜“秘密”这个词出于同样的原因会糟糕十倍。
I mean, I guess? I presume 'secret' would be ten times worse for the same reasons.
Shoshannah Tekofsky：问题就出在“水印”这个词上！
Shoshannah Tekofsky: It's the word 'watermark'!
人们现在想到的是那些被叠加了极其恼人图案的图库图片。这与 Anthropic 正在做的事情完全不是一回事。我们需要为 AI 领域的事物创造新词。
People now think of stock images with impossibly annoying patterns superimposed. This is nothing like what Anthropic is doing. We need new words for AI things.
我建议用“秘密”。“秘密”显然是难以被注意到的！人们本来就预期不会注意到它。
I suggest 'secret.' A secret is clearly hard to notice! People expect to not notice.
Jai：我们想要的概念是“隐写签名”（steganographic signature），但大多数人不会理解它。
Jai: The concept we want is "steganographic signature" but most people won't understand it.
这里基本上不存在任何一种称呼方式能够避免同样的问题氛围，并且会给人留下这样的印象：你额外花了功夫去改动某个东西，结果反而把事情弄得更糟。我认为 watermark 是一个相对不错的名称，我更不愿意陷入委婉语的循环更替之中。
There is basically no handle here that won't have the wrong vibes in the same way, and give the impression that you did extra work to change something, and therefore made things worse. I think watermark is a relatively good name and would prefer not to go on a euphemism treadmill.
当然，你不能公开这样说。好吧，有些人可以，但更多人选择不这么做。通常这甚至不是完全有意识的。
Of course, you can’t come out and put it like that. Well, some people can, but a lot more of them choose not to. Often this will not even be fully conscious.
Myk is Walking Backwards：真的感觉人们主要是因为他们用 Claude 生成最终输出而感到不安，并且他们对于别人能够知道这一点感到愤怒。各位，拜托。
Myk is Walking Backwards: It really feels like people are genuinely mostly upset that they use Claude to generate their final output and they are mad that people will be able to know that. Y'all, come on.
不要过度思考这种情况。许多人看重将 AI 写作冒充为自己作品的能力，或者他们希望人们无法证明这一点。
Don’t overthink the situation. A lot of people value the ability to pass off AI writing as their own, or they want people to be unable to prove it.
而且不，你无法切换到 ChatGPT，它们也会有标记。
And no, you won’t be able to switch to ChatGPT, they will have marks too.
还有一堆‘不是你会这么做，而是你可以这么做’的情况。
There is also a bunch of ‘not that you would, but you could.’
Anthropic 或 API 能否确定是哪个用户生成了该文本？
Can Anthropic or the API figure out which user generated the text?
不能。Anthropic 在 FAQ 中确认，该方法无法做到这一点。
No. Anthropic confirms in the FAQ that this method cannot do that.
对于任何影响社会动态的变革，即便反对意见主要是错误的、且该事物看起来明显是积极的，也仍然会存在一些弊端和担忧。
With any change that impacts social dynamics, even when the objections are primarily wrong, and the thing seems clearly positive, there are still going to be some downsides and concerns.
以下这些在我看来至少具有一定合理性。
Here are the ones that seem at least somewhat legitimate to me.
这是我最真实的担忧：最恶劣的人会移除水印。
This is my top real concern, which is that the worst people will remove the watermark.
移除水印并非易事，但既然你有答案密钥可用于训练并逐一核对，无疑可以构建 AI 工具，以打乱细微选择的方式削弱或抹除水印。你可以验证它是否奏效。
Removing the watermark is non-trivial, but given you have an answer key to train with and check in each case, one can doubtless build AI tools that scramble small choices in ways that degrade or erase the watermark. You can verify that it worked.
他们也可以使用本地或其他不携带水印的模型，或者使用一个没人会去检查的模型。
They could also use a local or other model that does not carry a watermark, or not one that anyone is likely to check.
这可能会让你处于更不利的境地，因为他们随后可以把假阴性当作辩护理由。当你有一个足够好、默认情况下你信任它、但在关键时刻却可能被伪造的测试时，那可能相当糟糕。
This potentially puts you in a worse position, since they can then use the false negative as a defense. When you have a test that is good enough that you trust it by default, but that is possible to fake when it counts, that can be pretty bad.
我的回应是：这会很烦人，而且这样做明显是心虚的表现，比最初使用 AI 要糟糕得多，并且其他检测方法仍然有效。Pangram 仍会将其标记为 AI——至少如果你按我想象的方式操作的话——并且不会混淆原始内容来自哪个 AI（Pangram 算法能区分不同的 AI，但不会告知用户）。在人类读者看来，它仍然像是 AI 生成的。
My response is that this is going to be annoying, and also doing it is clear consciousness of guilt and far worse than the initial AI use, and that other methods of detection will still work. Pangram will still mark it as AI, at least if you do it the way I'm imagining, and won't be confused about which AI the original came from (the Pangram algorithm can differentiate different AIs, but it doesn't tell the user). It would also still read to a human as AI.
因此，如果例如一个大学生使用了它，而大学在没有水印证明的情况下无法采取行动，那就会成为一个问题，而且这个问题可能会滚雪球般扩大，但现在学生需要付出更多努力，并且有明确的犯罪意图，在实践中我预计这大多不会发生。
Thus this would be an issue if, for example, a college student used it, and the university couldn’t act without the proof from the watermark, and that issue could snowball, but now the student needs to put in more effort, and has clear mens rea, and in practice I expect this to be mostly not something that is done.
现实世界的测试是另一个不用担心的理由。每个人都可以访问 Pangram。所以理论上，任何人都可以反复检查 Pangram 的结果，直到它返回人类的结果。但我们观察了人们在现实世界中的反应，几乎没有人这样做。人们只是……被抓住。
The real world test is another reason not to worry. Everyone has access to Pangram. So in theory, anyone could iteratively check the Pangram result until it comes back as human. But we have observed how people react in the wild, and approximately no one does. People just… get caught.
一般来说，如果你提高提交 AI 工作的努力程度，这大多确实有效。如果你通过用自己的话重写整个内容来去除水印，当然，那没问题，并且算作他妈的任务完成。
In general, if you raise the effort level of submitting AI work, that mostly does do the job. If you remove the watermark by rewriting the whole thing in your own words, of course, that is fine and counts as Mission Fucking Accomplished.
当写作在一定程度上使用 AI，但仍主要由人类撰写时，水印会怎样？如果你使用了 AI 的一些措辞，即使作品主要出自你手，人们会不会将你的作品归类为 AI 生成？会不会有零容忍政策和不幸案例？这一切都是概率性的，那么当答案出错时会发生什么？
When writing uses AI to some extent, but is still largely written by a human, what happens with the watermark? If you use some of the AI turns of phrase, will people classify your work as AI, even if it is largely your own? Will there be zero tolerance policies and unfortunate cases? This is all probabilistic, so what happens when the answer comes back wrong?
答案是水印衡量的是 AI 处理。因此，翻译和文件转换可能会触发水印，这很不幸，但人们可以意识到这一点。校对也可能如此，如果你让 Claude 自动进行相关编辑，但如果你用它来发现错误并自己纠正，就不会触发。
The answer is that the watermark measures AI processing. So translations and file conversions might trigger the watermark, which is unfortunate, but one can be aware of that. So could proofreading, if you let Claude automatically make the related edits, but if you use it to find errors and correct them yourself, it won't.
因此，我确信，就 AI 写作或处理文字而言，强水印阳性将始终是真正的阳性。我帖子上的水印特征量不会为零，因为我引用了他人，他们有时会使用 Claude，或者有时直接引用 Claude。直接引用有明确标记，但水印无法区分。在使用 AI 系统的任何词语时，尤其是在这种使用明显有益的地方，会有一定程度的偏执。
Thus I am confident that strong watermark positives will consistently be true positives in terms of AI writing or processing of the words. The amount of watermark signature on my posts will not be zero, since I am quoting others who sometimes will have used Claude, or sometimes directly quoting Claude. The direct quotes are clearly marked, but the watermark won't know the difference. There will be some degree of paranoia when using any words from an AI system, in places where such use is clearly good.
所以，是的，这种情况会少量发生，但我预计人们会很快习惯，并且应该高度假定给人们更多信息是好事，如何反应取决于他们。如果你偏执，并且周围人对哪怕一丁点 AI 使用都大为光火，而且他们可能实际使用 API，你可以先通过 API 检查自己的输出。或者你可以尊重那些人的偏好，甚至在你我都认为好的某些方面也不使用 AI。
So yeah, a little of that will happen, but I expect people to rapidly get used to this, and there should be a high presumption that giving people more info is good and it is up to them how to react to it. If you are paranoid and among people who are Big Mad about even a sliver of AI use, and also that might actually use the API, you can check your own output first via the API. Or you can honor the preferences of those folks, and not use AI even in some of the ways that you and I would agree are good.
像往常一样，就实际错误和假阳性而言，人们对自动化系统的错误和潜在错误的容忍度远低于对人类。错误率将非常非常低。如果一个人试图判断你是否使用了 AI，他们的错误率会相当高，远高于水印。AI 使用是一个要求‘证明’某些事情做得过火的地方，尤其是在学术界，常常让人们‘逃脱’大家都知道他们做过的事情。这不是刑法，如果没有人会坐牢，你就不需要同样超高的置信水平。
As usual, in terms of actual mistakes and false positives, people have vastly lower tolerance for errors and potential errors by automated systems, than they do for humans. The error rate is going to be very, very low. If a human is trying to decide if you used AI, they're going to have a substantial error rate, far higher than the watermark. And AI use is one place where demands to 'prove' things go too far, especially in academia, often letting people often 'get away with' things that everybody knows they did. This is not criminal law, if no one is going to jail you should not need the same super high level of confidence.
最后一个担忧并非关于水印本身，而是关于该强制要求及其在欧盟《实践准则》中的起源。
The last concern is not about the watermark itself, but about the mandate and its origin in the EU Code of Practice.
Anthropic 因欧盟法律而在全球范围内实施水印，因为在所有地方实施比仅在欧盟实施要容易得多。因此，这意味着欧盟正在违背我们的意愿，削弱和玷污我们宝贵的 AI 输出 token。我们必须反击。谁知道他们下一个目标会是什么？
Anthropic implemented watermarking worldwide due to an EU law, since it is a lot easier to do it everywhere than only for the EU. So that means that the EU is sapping and impurifying our precious AI output tokens, against our will. We must fight back. Who knows what else they might target next?
客观层面的回应是：不，他们并没有那样做。从技术上讲，他们确实在改变输出，就像蝴蝶扇动翅膀改变天气一样，但并非以任何系统性或方向性的方式。如上所述，输出并未降级。这没问题。
The object level response is that no, they are not doing that. They are technically changing the outputs, the same way that a butterfly flaps its wings and changes the weather, but not in any systematic or directional way. As discussed above, the outputs are not degraded. This Is Fine.
真正的担忧在于原则，以及接下来可能发生的事。是的，目前这没问题，迫使苹果使用 USB-C 目前也没问题，但他们对我们科技公司征收的罚款基本上是现代海盗行为，谁知道接下来会发生什么。
The real concern is the principle, and what might come next. Yes, this is fine for now, and forcing Apple to use USB-C was fine for now, but the fines they impose on our tech companies are basically modern piracy and who knows what comes next.
对此我的回应是：他们是一个巨大的市场，是的，他们有一些发言权，而且一直都有一些发言权，限制因素是美国的反击，或者在极端情况下，我们进行地理封锁，带着我们的球回家，正如在一些 AI 服务上已经发生的那样，在欧盟和其他地方，因类似问题。
To which I say, they are a huge market, and yes they get some say, and have always gotten some say, and the limiting factor is America pushes back or in extremis we geofence, take our ball and go home, as indeed has already happened with some AI services, in the EU and elsewhere, over similar issues.
理论上，接下来可能发生的另一件事是：对水印的要求没有规模下限。因此理论上，他们可以追究任何没有水印的 AI，包括小型开源模型。如果他们为此大做文章，那会很糟糕。我不认为这会发生，但他们做过更愚蠢的事。
Another thing that might come next, in theory, is that there is no size minimum on requiring watermarks. So in theory they could come after any AI without them, including tiny open models. If they made a sufficiently large fuss about this it would be bad. I do not expect this, but they've done stupider.
这就是那场博弈。我担心欧盟或其他方以这种方式强加一套审查制度，迫使我们的科技公司配合。这有可能延伸到对 AI 输出的意识形态要求。如果他们或其他方真的尝试这么做，我相信我们的前沿模型实验室不会在全球范围内实施此类变更，而且如果真的尝试，会面临严重反弹。相反，我预测这些实验室至少会威胁进行地理围栏，或对欧盟的查询使用激进的分类器或类似技术。
This is the dance. I am worried about the EU or others imposing a censorship regime in this way, forcing our tech companies to play along. That could plausibly extend to ideological requirements on AI outputs. If they or others did try that, I believe our frontier labs would not apply such changes globally, and indeed would face severe backlash if they tried. Instead, I predict the labs would at least threaten to geofence, or use aggressive classifiers or similar tech on EU queries.
是的，我们确实必须警惕布鲁塞尔的越权行为。但这个？这没问题。
Yes, we do have to keep an eye out for Brussels overreaching. But this? This Is Fine.