NOPE創業者、AIテキストのウォーターマークがコピーで残り書き換えで薄れる仕組みを説明

Why it matters

Text watermarking is becoming compliance infrastructure for frontier models, but its output remains probabilistic, key-gated and vulnerable to editing. Declaude shows the market forming around removing those signals.

James Padolsey (@padolsey), the founder of NOPE, has published an AIテキストのウォーターマーキングに関するインタラクティブなガイド that explains where an invisible mark can hide in plain text, how its owner detects it and why rewriting can make it disappear.

The timing gives the tutorial a sharper purpose. In an 8月12日の発表, Anthropic said new Claude models would mark AI-generated content from launch. Anthropicによると、2026年8月2日以降にEUで導入されるClaudeモデルは、立ち上げ時から機械判読可能なマーキングに対応する、生成テキストに埋め込まれたウォーターマークを伴って。Anthropicは、対応モデルのマーキングはClaudeが提供される世界中のすべての場所に適用されると述べている。Padolseyのガイドは、彼の「Declaude」ツール(Declaude)に付随するもので、「AI風テキスト」を意味を保った書き換えに変えるためのものだ。新しい出自（provenance）仕組みがどのように動くかを教えると同時に、Declaudeの全再構成アプローチの技術的根拠を示している。

Padolsey comes to the problem from platform integrity and AI evaluation. NOPE's team page lists previous roles at Meta, Stripe and Twitter, followed by work as a founding engineer at the Collective Intelligence Project. His personal site also credits him with writing "Clean Code in JavaScript" and building open evaluation tools. He founded NOPE with his sister Alice Padolsey in 2025 to measure risks that emerge across ongoing human-AI conversations, including dependency, sycophancy and systems that keep accommodating users when they should introduce friction or human support.

Text watermarking is a different part of the stack, though it fits Padolsey's broader fixation on signals that software can detect even when people cannot see them.

マークはトークンの選択に宿る

A text watermark does not require hidden characters, formatting or metadata. It is introduced while a language model chooses each successive token.

At any point in a response, a model usually has several plausible continuations with different probabilities. The method described in the guide, based on the John Kirchenbauerらによる2023年のウォーターマーキング論文, uses a secret key to divide possible next tokens into groups. The generation process gently favors one group, often described as "green" tokens, without making the alternatives impossible.

One choice reveals little. Across hundreds or thousands of tokens, the favored group appears more frequently than chance would predict. A detector holding the same key can reconstruct which tokens were favored at each position, count the results and calculate whether the accumulated pattern is statistically persuasive.

The secret coloring can depend on the words immediately preceding a token. A word might be green after one phrase and red after another. That prevents readers from identifying the watermark through a fixed vocabulary list and allows ordinary-looking prose to carry the signal through copying and pasting.

Google DeepMind's SynthID Text uses a more elaborate method, though the operating principle remains similar: generation choices carry a statistical pattern that a detector can score. Googleは2024年からGeminiアプリとウェブ体験でテキストにウォーターマークを付けている and later released a reference implementation on GitHub.

製品上の議論はウォーターマークが破綻する地点から始まる

Padolsey's guide is unusually direct about the weaknesses. Watermark evidence grows with length, leaving short answers, quotations, code and factual lists with fewer opportunities to carry a reliable signal. Light editing can dilute a mark while preserving enough original sequences for detection to recover across a longer document.

A full rewrite attacks the dependency between neighboring words. When a model reconstructs prose from its meaning rather than editing individual phrases, the original token windows vanish. The detector is then left counting choices that bear no relationship to the original key pattern.

Declaude says it routes submitted text through other models and checks the result with an evaluation harness. In tests cited in Padolsey's guide using open KGW and EXP watermark implementations, Declaude's full-rewrite route left about 0.5% of the original detector windows intact and reduced detection accuracy from near certainty to roughly chance.

That result should not be generalized to Claude. Anthropic has not published its production algorithm, key structure, thresholds or detector performance. Padolsey states that boundary prominently: his measurements cover open implementations that NOPE can test, while Anthropic's mark remains inaccessible to outside evaluation.

The distinction matters because some watermark designs survive same-meaning rewrites better than others. A tool that defeats one open implementation has not established that it can erase every provider's mark. Declaude's present claim is narrower and defensible: complete recomposition can collapse schemes whose evidence depends on surviving runs of original wording.

規制がウォーターマーキングを実運用へ押し進めている

Anthropic's deployment follows the European Union's 欧州連合のAI規則（AI Act）第50条, which requires providers of systems generating synthetic text, audio, images or video to make outputs machine-readable and detectable as artificially generated or manipulated, where technically feasible.

Anthropic says supported models will add watermarks across Claude, Claude Code, Claude Cowork, its API and cloud partners, wherever those models are offered. Generated files can also receive signed provenance metadata under the C2PA standard. Earlier Claude models are being moved toward the same marking requirements.

Detection access remains a central constraint. A statistical mark built around a secret key can only be verified by the key holder or a service the provider authorizes. Anthropic says third-party detection support is forthcoming. Until then, outsiders cannot independently test Claude's production watermark, verify its false-positive rate or measure how it performs after different kinds of editing.

検出されたマークは著作者を確定しない

Anthropic's own documentation says a mark indicates that content may have been processed by Claude. Human-written copy can acquire the signal when Claude proofreads, translates, summarizes or reformats it. A detected mark therefore cannot establish who supplied the ideas or wrote the first draft.

The reverse conclusion is equally unsafe. Claude-generated text may lose a detectable signal after heavy editing, translation, excerpting or combination with other material. Very short passages may never contain enough evidence for a confident result.

OpenAIは2024年に関連する懸念を示した、その研究されたテキストウォーターマーキング手法は局所的な言い換えには耐性がある一方で、翻訳や別モデルによる再生成には脆弱であるとした。OpenAIはまた、たとえ偽陽性率が低くてもインターネット規模では大量の誤判定を生み得ること、AIを執筆支援として使う非ネイティブ英語話者に不利に働く可能性があることを警告した。

Padolsey's guide gives founders and product teams a useful mental model for the technology arriving inside major AI systems. Watermarks can supply evidence about a model's processing history. They cannot settle authorship disputes, replace editorial judgment or survive every transformation.

That is also the commercial opening behind Declaude. As model providers add hidden provenance signals under regulatory pressure, rewriting tools can sell control over the final prose. Padolsey has turned that tension into a clear technical lesson, while leaving the decisive Claude question where it belongs: inside an undisclosed Anthropic system that independent researchers cannot yet measure.