Anthropic announced Claude.ai will watermark every AI-generated text from now on. And online communities are having a complete meltdown over it. Freelance writers fear clients mistake human-written copy as AI slop, just because they used a grammar or spell checker. Software engineers are afraid AI-generated code will contain hidden cryptographic markers and customers will reject their product. And on X and Reddit, users are discussing subscription cancellations of Anthropic’s Claude. Ultimately, the anger boils down to the uncomfortable realization that AI-generated data will be as easy to spot as a forged banknote. And the great applause from data protection agencies and the EU for complying with the AI Act is not helping matters either. Has Big Brother moved into Anthropic’s offices? Or is it just another tempest in a teapot? Just because you’re paranoid doesn’t mean they aren’t out to get you.

To separate fact from fiction, let’s take a walk through history. The mutiny looks like a sign of our times, but it is not. As it turns out, there is very little new about this controversy. In 1891, Sherlock Holmes solved a mystery in “A Case of Identity” by analyzing the letterforms produced by a typewriter. According to the story, the typewriter betrayed its owner through its flaws. The “e” was worn and the “r” was lame. Holmes deduced the case by applying the fundamentals of forensics: uncovering the hidden signatures and clues. While the story is fictional, the forensic science behind it is real. In 2017 an NSA contractor was caught after mailing a printed classified intelligence report to a news outlet. Faint yellow tracking dots (Machine Identification Codes) placed by her office color laser printer encoded the exact date, time, and printer serial number. Invisible to the naked eye, but detectable by forensic experts, these dots were originally added at the behest of governments to prevent money forgery. It turned out that every printout was traceable. The flaws in the letterforms were accidental, but the microscopic yellow dots secretly placed by a printer across every page were not.

And when the stakes are high, statistical anomalies can even win wars. During World War II German communications were encrypted by the supposedly “unbreakable” Enigma code. A three-rotor Enigma machine with plugboard had on the order of 10^23 possible key settings. This was far beyond any conceivable brute-force key-breaking methodology of 1940. But “unbreakable” was only true against the attacks the designers imagined, not against the attack they actually got. Bletchley Park was the secret British codebreaking center where Allied cryptanalysts, including Alan Turing, broke the German Enigma code. What broke the Enigma encryption above all were cribs: fragments of predictable plaintext whose position in an encrypted message could be guessed. Stereotyped German signals discipline in broadcast messages made cribs plentiful. Routine filler such as “Keine besonderen Ereignisse” (“nothing to report”) were sent by quiet outposts, famously by Italian and North African stations that used the same phrase daily. Numbers spelled out (“eins” appeared so often Bletchley even built an “eins catalogue”) were also exploited.

And once Bletchley Park could decipher intercepted German naval communications, the Admiralty could track U-boats, divert shipping convoys, and make the hunters the hunted. German U-boats that had terrorized Allied shipping increasingly became steel coffins.

German officers could not know that their communication habits left statistical signatures in encrypted messages.

And more than eighty years later, AI companies decided to do it on purpose, driven by EU legislation.

The archvillain of our story? SynthID. And the way it works is as clever as it is surreptitious.

Let’s look under the hood of your LLM. As a last step, the final transformer layers produce numbers called logits. From these logits, the transformer conjures a list of possible words and assigns each a probability. And here is where SynthID diverges. Your friendly transformer rolls the dice and selects the next word from the list for output. But not your transformer with SynthID, as it plays by different rules. With SynthID, the game is rigged. SynthID loads the dice, changing probabilities in subtle ways. And it does it not to win any game but to create a signature of the generated text hidden in plain sight.

And like the German U-boat captain broadcasting the position inadvertently, your AI-generated text broadcasts its origin. The signature is not human-detectable, so not even Sherlock Holmes would find the clues. And nothing is encoded by scattering yellow dots that could be removed. It is a riddle, wrapped in a mystery, inside an enigma. The statistical signature is a telltale sign for AI-generated text, that can be recognized by any entity in possession of the right detector. As for the rest of us? The SynthID signature stays invisible.

That leaves only one question unanswered: who is running the modern Bletchley Park?

P.S. I am working on an alternative transformer with full transparency. Apertura is my experimental project where the generation process is fully observable, from logits to sampling decisions. It is hosted on GitHub.

The development of SynthID is further motivation for me to keep working on Apertura.