Claude's Steganographic Watermark Is Live — and the False Positives Are Already Here

I spent the weekend watching the r/LocalLLaMA thread about Claude’s new steganographic watermarking blow up. The title alone was enough to make me spit out my coffee: “Claude now officially ‘marks’ AI-generated content… steganographically, apparently… and there are false positives already.”

Yeah. Already.

What Anthropic Actually Did #

This isn’t the soft, probabilistic watermarking they’ve been toying with for years. This is the real deal — a steganographic signal embedded in the token distribution itself. Invisible to the naked eye, but detectable by their classifier. The paper’s been floating around, and the implementation details are genuinely clever. They’re modulating the probability of certain token sequences in ways that survive paraphrasing, translation, even some light editing.

Here’s the thing though: clever doesn’t mean safe.

The thread’s top comment from u/quantum_foam_fingers nailed it: “Great, so now I can’t tell if my own writing got flagged because I happen to write like a language model.” That’s not paranoia. That’s the actual failure mode we’re seeing.

The False Positive Problem Is Real #

Someone in that thread posted a screenshot of a student’s essay getting flagged as AI-generated. The student swore it was hand-written. The teacher ran it through Anthropic’s detector. Flagged. The kicker? The essay was written before Claude even existed.

I’ve seen similar reports popping up on HN and Twitter. People running legitimate content through the detector and getting false positives at rates that would make a spam filter blush. The community is genuinely split on whether this is a bug or a feature — some folks think Anthropic is being deliberately aggressive to make a point, others think the steganographic signal is just too fragile and collides with natural language patterns.

I haven’t tested this on ARM, and I’m not about to claim I’ve reverse-engineered their classifier. But the pattern is clear: when you embed a signal into something as variable as human language, you’re going to get collisions. Lots of them.

Why This Kills Closed Models for Me #

Look, I’ve been running local models since the llama.cpp days. I’ve got a box with a 3090 that’s been through more reflashes than I care to admit. And every time someone asks me “why not just use Claude or GPT-4?”, I used to have to give a wishy-washy answer about privacy and cost.

Not anymore.

The argument is now dead simple: if I can’t verify what’s in my own output, I can’t use it. When I run Llama 3.1 70B or Qwen 2.5 locally, I know exactly what’s happening. No hidden signals. No invisible metadata. No corporate entity deciding that my writing style matches their watermark pattern and flagging me.

The cost argument is getting stronger too. A 70B model on a used 3090 (you can grab one for ~$600 on eBay these days) runs at maybe 15-20 tokens per second with the right quantization. That’s not Claude-fast, but it’s fast enough for most real work. And the marginal cost per token is basically zero. Compare that to API pricing that keeps creeping up.

The Practical Workarounds #

If you’re stuck on Claude for whatever reason — and I get it, the coding abilities are genuinely good — there are things people in the thread are trying:

• Paraphrasing tools that restructure sentences aggressively. Mixed results. The watermark survives light editing, so you need something heavy-handed.
• Translation round-trips (English → Japanese → English). This breaks the signal more often, but it also mangles your prose. Your mileage may vary.
• Running your own detection with open-source classifiers to check if your output looks watermarked before you ship it. This is the most practical approach, honestly.

None of these are great. The whole situation is a mess.

The Bigger Picture #

Here’s what gets me about this whole thing: Anthropic’s stated goal is transparency. They want to help people identify AI-generated content. That’s a noble goal on paper. But the implementation is turning into a surveillance tool that punishes legitimate users.

The false positive rate alone should be disqualifying. When a detector can’t distinguish between a student’s honest essay and AI output, it’s not a detector — it’s a random number generator with extra steps.

I’m not saying open-source models are perfect. They’re not. They hallucinate, they’re slower, and setting up a decent local stack takes an afternoon. But at least when they screw up, I can see exactly why. I can read the code. I can check the weights. I can verify the output.

With Claude, I’m just supposed to trust them.

I don’t.

Running Qwen 2.5 72B on a dual-3090 rig as I write this. Zero watermarks detected. Just saying.