Could a classifier crack Claude's token-bias watermark without the secret key?
US0RIS · reddit · 2026-09-07
A Reddit discussion proposes attacking Anthropic's Claude watermark, which reportedly works by subtly biasing token selection via a secret key rather than embedding hidden characters.
The idea: collect many Claude and non-Claude responses to identical prompts and train a classifier to distinguish them. Key challenges:
- The classifier might learn Claude's writing style rather than the watermark
- A stronger design: feed Claude repeated similar prefixes and see if next-token choice patterns are learnable
The open question: can enough black-box examples approximate Anthropic's secret-key detector without ever knowing the key? Speculative, no experiments yet.
More from Safety
- PHP2Shell exploits confirmed in the wild, attackers may use agentic AI for post-exploitation — AravSrinivas · 2026-10-27
- php2shell exploit benchmark: only 2 of 5 frontier models can port the bug — xeophon · 2026-10-27
- Interactive 32-slide AI security & privacy lecture for lawyers, now public — chrisrohlf · 2026-10-27
- Two CVSS 9.9 Wasmtime flaws allow sandbox escape, one ARM64-only since 2020 — basedjensen · 2026-10-27
- Free prepare.aiendgame.com site guides users through locking down accounts amid AI cyberstorm — harris_edouard · 2026-10-27
- Cisco routers trust eMudhra CAs whose private keys were numbers under 256 — murat_kocaoglu_ · 2026-10-27