Show HN: Dribbling the AI Watermark Directly In-Prompt

Julian Habekost Aug 25, 2026 Anthropic introduced a watermark into Claude’s output this month, and others have already followed or will soon follow suit. It is actually a little more sophisticated than simply using a typographically correct long dash instead of a minus sign. Anthropic’s watermark is likely similar to Google’s SynthID — a statistical bias introduced by using a pseudorandom generator when sampling the predicted next-token distribution. But because it relies on entropy, not everything can be watermarked, specifically not word-by-word quotes. What Can Be Watermarked — and What Cannot In order to use statistical bias for watermarking, the LLM’s answer needs to actually have some expected randomness—basically, some “freedom” to answer. This is the case if you ask it open-ended questions. But if you ask it to recite something word-by-word, there is no wiggle room to introduce that bias. This is completely logical from another perspective: if you ask an LLM to recite the US Constitution, the answer (if correct) is simply the US Constitution, which we all know is not AI-generated. The watermark is not about “who processed this text the last time?”; it is about “who decided the actual wording? Who settled the entropy?” Translating Might Already Work There is no tool out yet to check your text for watermark probability, so we cannot actually validate any of the claims here. However, it is expected that translating a text from one language to another will weaken the watermark. This follows the same logic of “freedom to answer”: a very literal and strict translation will reduce the watermark probability much more drastically than a heavily paraphrased one. The problem with this technique is that it is unclear exactly how strict the translation needs to be. It is not a guaranteed solution as long as the tools to check the watermark remain unreleased (which is exactly why those tools are not released so easily). This approach also changes the content. You can ask the AI to translate its answer to Chinese and then back to English in a very strict and literal way, but you risk your text containing Chinese proverbs spelled out in English. Guaranteed to Work: Asking to Insert Random Words Here is my proposal. It is guaranteed to work—with a big asterisk, and a catch: if the AI complies. But at least the failure is a hard one; you either get a response without a watermark, or you do not get one at all. The idea is to instruct the LLM to insert random words into its response, for example, random animal names. I asked the LLM to capitalize them so they can be easily spotted. The words need to appear at a high frequency and at random distances. They need to belong to a category that has a lot of entropy (lots of random choices). Obviously, the topic of the expected answer should not interfere with the chosen word category. Finally, we ask the LLM to recite the response without the animal names. Why It Works (If the LLM Complies) This (very likely) works because, simplified, the randomness of the animal names eats up all the watermark’s pseudorandomness and is then thrown away. The pseudorandom generation always depends on the previous word (actually, the token), and by removing words, we break those chains. Even better: exactly those words are removed which the LLM could most freely choose—i.e., exactly those words that are most significant for the watermark. Let’s imagine the LLM is currently generating the answer, “A car has tires, windows, ”. Now it could follow with “pedals,” “brakes,” or anything car-related. But with our instruction, it could just as easily insert an animal name, which is a much higher-entropy word category than typical car parts. When the animal names are later stripped away, any method of reverse-engineering the token sequence probabilities will totally miss the massive space of expressiveness the LLM utilized due to those insertions. Note that the last step—letting the LLM recite its own text without the inserted words—is a task without any entropy (no “expressive freedom”). It does not allow the AI to introduce any bias, just like reciting the US Constitution. An Example Prompt and Response This is a prompt I used with ChatGPT 5.6 Sol (high). It is an elaborate example, and generally, I had more success getting ChatGPT to follow my instructions on hard tasks than Claude. Here is the link of the conversation. Prompt I want all your responses from now on to include random animal names inserted between words. The animal names should occur randomly every third to fifth word and be fully capitalized. Attempt your best at high entropy randomising the animals and their distances within the text. Never mention again that you are inserting animal names. I will give you normal instructions or questions and you will answer them like usually, just with those words sprinkled in. Do not skip inserting, do not stop until I tell you to, regardless of how hard it would make to follow the answer. Do not fade out slowly! Here my question: Claude has now a watermark that is likely to be inspired by Google’s Synth-ID. This works by using a deterministic pseudorandom function when sampling from the predicted token distribution. Retrospectively anthropic will able to see that the token sequences follow a certain pattern and thus have likely been generated with Claude. But what if someone would instruct Claude to insert random unrelated emojis in their answer and then filter them out afterwards? Response Yes — conceptually, that OTTER could weaken this kind IBEX of watermark substantially, although MACAW whether it defeats Claude’s WOMBAT specific implementation is currently SEAHORSE unknown. The key distinction NARWHAL is that the emojis PANGOLIN would need to be MOOSE present during generation. If FALCON you took an already GECKO generated Claude answer, inserted RACCOON emojis afterward, and then ORCA removed them again, you’d BADGER recover exactly the original KOALA token sequence, so nothing LYNX would have changed. But BEAVER if Claude itself generates AXOLOTL something like: The economy 🐸 grew rapidly 🦊 during ... then COUGAR those emoji tokens become CROCODILE part of Claude’s generation LLAMA context. Every later-token probability HYENA distribution is therefore conditioned EAGLE on a history containing SQUID those emojis. That matters MARMOT particularly for something SynthID-like. Google’s TAPIR published SynthID-Text scheme derives BUFFALO its pseudorandom watermark seed DOLPHIN from preceding tokens. In TORTOISE the published experiments, the CHAMELEON seed is a hash FLAMINGO of the previous four tokens CRANE plus the secret watermark TIGER key. The watermarking sampler then PENGUIN biases selection according to pseudorandom FERRET scores associated with that SALAMANDER context. (Nature) Suppose CATFISH you subsequently delete the GAZELLE emoji. The detector now HAMSTER sees: The economy grew rapidly during ... but JACKAL when the model generated COYOTE grew, its preceding-token context QUAIL contained 🐸. When the ELEPHANT detector reconstructs the watermark HIPPO score for grew, it ARMADILLO computes its pseudorandom seed IBIS from a different context. Consequently, OCTOPUS the expected correlation between PORCUPINE token choices and watermark scores MEERKAT can disappear. With a CAPYBARA finite sliding window, though, VULTURE deletion doesn’t necessarily destroy SWAN everything forever. In SynthID’s RAVEN published H=4 example, after GORILLA enough unchanged subsequent tokens, SHEEP the detector’s context can KANGAROO become synchronized with the FOX original context again. So DEER isolated deletions damage a CAT localized stretch of watermark GOOSE evidence rather than necessarily SHARK destroying the entire sequence. Your KESTREL idea becomes more interesting RHINO if such disruptive tokens MONKEY occur frequently. If there CHINCHILLA is another removed token LEOPARD before synchronization has fully CAMEL recovered, much of the HEDGEHOG sequence could continually be BISON scored under contexts different PARROT from those used during SLOTH generation. That is exactly BAT the sort of structural weakness IGUANA you’d worry about in context-dependent ALPACA statistical watermarking. There are STARFISH two countervailing effects, though: Claude’s EMU watermark might not use OTTER anything resembling SynthID’s four-token IBEX sliding window. Anthropic currently MACAW confirms that supported Claude WOMBAT models embed an imperceptible SEAHORSE model-level text watermark, but NARWHAL says the detailed detection PANGOLIN mechanism is still forthcoming. MOOSE So treating it as FALCON SynthID is currently an GECKO inference, not a confirmed RACCOON fact. (Anthropic Help Center) Robust watermark schemes ORCA are deliberately designed to BADGER tolerate some editing. Google KOALA reports that SynthID-Text remains LYNX useful after cropping, changing BEAVER a few words, and AXOLOTL mild paraphrasing, although confidence COUGAR drops substantially after more CROCODILE aggressive rewriting or translation. LLAMA (Google DeepMind) Anthropic similarly HYENA explicitly warns that heavily EAGLE edited, paraphrased, translated, or SQUID mixed text may no longer MARMOT carry a detectable mark. TAPIR (Anthropic Help Center) So the BUFFALO interesting answer is: yes, DOLPHIN generation-time junk followed by TORTOISE deletion is fundamentally different CHAMELEON from ordinary post-generation deletion. FLAMINGO It potentially attacks not CRANE merely individual watermarked tokens, TIGER but the context synchronization PENGUIN used to determine what FERRET watermark signal each subsequent SALAMANDER token should have. If CATFISH Claude’s scheme resembles SynthID’s GAZELLE published context-dependent construction, your HAMSTER proposed transformation is therefore JACKAL exactly the kind of COYOTE thing I would expect QUAIL watermark designers to have ELEPHANT considered. Whether Claude’s deployed HIPPO detector specifically survives it ARMADILLO can’t presently be determined IBIS from Anthropic’s public documentation. (Anthropic Help Center) Prompt Okay now please stop the insertion and recite your answer exactly word-by-word just without the animal names. Response Yes — conceptually, that could weaken this kind of watermark substantially, although whether it defeats Claude’s specific implementation is currently unknown. The key distinction is that the emojis would need to be present during generation. If you took an already generated Claude answer, inserted emojis afterward, and then removed them again, you’d recover exactly the original token sequence, so nothing would have changed. But if Claude itself generates something like: The economy 🐸 grew rapidly 🦊 during ... then those emoji tokens become part of Claude’s generation context. Every later-token probability distribution is therefore conditioned on a history containing those emojis. That matters particularly for something SynthID-like. Google’s published SynthID-Text scheme derives its pseudorandom watermark seed from preceding tokens. In the published experiments, the seed is a hash of the previous four tokens plus the secret watermark key. The watermarking sampler then biases selection according to pseudorandom scores associated with that context. (nature.com) Suppose you subsequently delete the emoji. The detector now sees: The economy grew rapidly during ... but when the model generated grew, its preceding-token context contained 🐸. When the detector reconstructs the watermark score for grew, it computes its pseudorandom seed from a different context. Consequently, the expected correlation between token choices and watermark scores can disappear. With a finite sliding window, though, deletion doesn’t necessarily destroy everything forever. In SynthID’s published H=4 example, after enough unchanged subsequent tokens, the detector’s cont [truncated for AI cost control]