{"slug": "show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one", "title": "Show HN: WMTrace – See how LLM text watermarks work (Anthropic just adopted one)", "summary": "WMTrace, a new open-source forensic workbench for LLM text watermark detection, launched on Hacker News, offering scheme-aware analysis with evidence grades and abstention rather than opaque AI scores. The tool, which Anthropic recently adopted a watermark scheme from, includes detectors for KGW-style, unigram, zero-width, and lexical-codebook watermarks, and reports calibrated statistics such as z = 16.1 and Holm-adjusted p = 3.5e-48 in its demo.", "body_md": "Forensic detection, benchmarking, and explainable analysis of LLM text watermarks, provenance signals, and hidden-payload channels.\n\nWMTrace is a scheme-aware forensic workbench, not a monolithic \"AI detector\". It answers narrow, honest questions — *does this text carry calibrated evidence for a declared watermark scheme, key, and configuration?* — and it states, with every result, exactly what that result does **not** prove.\n\nImportant\n\nA negative watermark result does **not** mean text was human-written. A recovered payload does **not** prove who embedded it. No result here supports provider attribution without trusted key provenance.\n\n```\npip install -e \".[dev]\"     # from a clone; Python 3.10+\nwmtrace serve               # polished web UI at http://127.0.0.1:8177\n```\n\n*The Analyze tab on a generated watermarked sample: summary pills per detector, calibrated statistics (z = 16.1, Holm-adjusted p = 3.5e-48), and the keyed green-token heatmap. Reproduce it locally with wmtrace serve → http://127.0.0.1:8177/?demo=1.*\n\n**Evidence, not verdicts.** Results are versioned evidence bundles with categorical grades (E0–E5) and mandatory scope statements — never an opaque \"97% AI\" score.**Four problems, four namespaces.** Watermark detection, generic AI-text detection, model attribution, and provenance verification stay separate in code, API, and UI, and are never averaged together.**Abstention is an answer.** Detectors declare`unsupported`\n\n(E0) or`insufficient`\n\n(E1) before scoring rather than guessing on short, low-entropy, or incompatible input.**No guessed provider secrets.** There is no`anthropic`\n\nor`openai`\n\ndetector here and never will be until an official verification API or reproducible public specification exists. All keys in this build are published research keys.**Executable documentation.** Every worked example in the[research spec](/gtesei/llm-watermark/blob/main/docs/RESEARCH.md)is reproduced exactly by golden tests — the docs cannot drift from the code.\n\n| Detector | Scheme | Claim status | Keyed? | Max grade | Round-trip demo |\n|---|---|---|---|---|---|\n`kgw-toy` |\nContextual green-list (KGW-style), γ=0.25, 2-word context | `[ILLUSTRATIVE]` |\n✔ published demo key | E3 | ✔ green-biased generator |\n`unigram-toy` |\nFixed keyed green-list | `[ILLUSTRATIVE]` |\n✔ published demo key | E3 | ✔ green-biased generator |\n`zero-width` |\nInvisible Unicode payload (U+200B=0, U+200C=1) | `[ILLUSTRATIVE]` |\n✘ unkeyed | E2 | ✔ encoder |\n`lexical-codebook` |\nSynonym-pair payload bits | `[ILLUSTRATIVE]` |\n✘ public codebook | E2 | ✔ encoder |\n`unicode-inspector` |\nZero-width / bidi / unusual-space / mixed-script indicators | `[IMPLEMENTATION]` |\n✘ keyless | E2 | — |\n\nModel-based detectors (SynthID-Text reference, Fast-DetectGPT, Binoculars), C2PA verification, and provider adapters are roadmap items — see the [research spec](/gtesei/llm-watermark/blob/main/docs/RESEARCH.md) for the full plan and the reasoning.\n\n`wmtrace serve`\n\nopens a responsive, dark/light, mobile-friendly interface:\n\n**Analyze**— paste text, get evidence cards per detector: grade badge, decision, exact statistics (N, green count, z, exact binomial p, Holm-adjusted p), a per-token green heatmap, Unicode findings, and a \"what this result means\" scope statement.**Embed**— generate green-biased sample text under the demo key, or hide zero-width / lexical payloads in your own text, then round-trip it into the analyzer with one click. Invisible characters can be revealed inline.**About**— evidence-grade table, detector manifests, and responsible-interpretation guidance.\n\nQuery parameters: `?demo=1`\n\nauto-loads a watermarked sample and analyzes it; `?theme=light|dark`\n\nforces a theme (used for the screenshots above).\n\n```\n# Run all detectors (Holm-corrected across the run)\nwmtrace scan document.txt\nwmtrace scan document.txt --json          # full evidence bundles\n\n# One declared scheme\nwmtrace detect --scheme kgw-toy document.txt\n\n# Unicode and formatting inspection only\nwmtrace inspect document.txt\n\n# Demo embedding: generate a watermarked sample, reproducibly\nwmtrace embed --scheme kgw-toy --length 150 --seed 11 > marked.txt\nwmtrace detect --scheme kgw-toy marked.txt\n\n# Hide an ASCII payload in invisible Unicode\necho \"Meet at the usual place.\" | wmtrace embed --scheme zero-width --payload Hi --ascii\nphp\nflowchart LR\n    I[Input text] --> H[Hash + explicit representations<br/>raw / NFC / NFKC]\n    H --> C[Capability check<br/>E0 unsupported · E1 insufficient]\n    C --> D[Detector plugins<br/>score → calibrate → explain]\n    D --> S[Statistics<br/>exact binomial · z · Holm]\n    S --> E[Evidence bundles<br/>grade + scope statement]\n    E --> O1[JSON] & O2[Terminal] & O3[Web UI]\n```\n\nEach detector implements the five-method plugin contract (`manifest / capabilities / score / calibrate / explain`\n\n); the shared statistics layer owns significance testing, so no detector rolls its own. Normalization is never silent — every bundle names the representation it analyzed.\n\n| Grade | Meaning |\n|---|---|\nE0 |\nUnsupported: required key, tokenizer, or configuration unavailable |\nE1 |\nInsufficient: compatible, but too little usable signal |\nE2 |\nHeuristic: indicator-level, unkeyed or uncalibrated channel |\nE3 |\nScheme evidence: calibrated evidence for a declared scheme/key/config |\nE4 |\nProvider-bound: trusted key provenance binds the result (no detector in this build can reach E4) |\nE5 |\nCryptographically verified (reserved for future provenance adapters) |\n\nA grade is an evidence category, **not** a posterior probability of authorship.\n\n```\ngit clone https://github.com/gtesei/llm-watermark && cd llm-watermark\npython -m venv .venv && . .venv/bin/activate   # or: uv venv\npip install -e \".[dev]\"                        # or: uv pip install -e \".[dev]\"\n\npytest                    # 41 tests: golden examples, calibration, round-trips, API\npytest tests/test_golden_examples.py -v   # the research spec's examples, executable\n\nwmtrace serve             # web UI\n```\n\nLayout: `src/wmtrace/{core,statistics,detectors,web}`\n\n+ `cli.py`\n\n; tests in `tests/`\n\n; the full research spec (taxonomy, provider status, benchmark methodology, roadmap) in [ docs/RESEARCH.md](/gtesei/llm-watermark/blob/main/docs/RESEARCH.md); release and design history in\n\n[.](/gtesei/llm-watermark/blob/main/CHANGELOG.md)\n\n`CHANGELOG.md`\n\n- Never use a detector score as sole evidence for punishment or accusation.\n- Watermark evidence indicates compatibility with a declared scheme — not authorship, intent, factual accuracy, or provider identity.\n- The demo keys in this repository are published and illustrative; results under them bind nothing to any provider.\n- Prefer abstention over a forced binary answer; report minimum length and effective sample size.\n\nRecommended report scope statement:\n\nThis result provides evidence compatible with watermark scheme X under configuration Y. It does not by itself prove human or machine authorship, provider identity without trusted key provenance, factual accuracy, ownership, or intent.\n\nThe repository began as a research design document; it is preserved in full at [ docs/RESEARCH.md](/gtesei/llm-watermark/blob/main/docs/RESEARCH.md), covering the watermarking technique taxonomy (KGW, unigram, unbiased reweighting, ITS/EXP/Gumbel, SynthID-Text, semantic and multi-bit schemes, cryptographic marks), provider status as of 2026-08-14 (Anthropic, OpenAI, Google, Meta), attack and robustness analysis, benchmark methodology, and the P0–P6 implementation roadmap with citations.\n\nApache-2.0.", "url": "https://wpnews.pro/news/show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one", "canonical_source": "https://github.com/gtesei/llm-watermark", "published_at": "2026-08-15 02:15:26+00:00", "updated_at": "2026-08-15 02:42:21.045654+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "ai-research"], "entities": ["WMTrace", "Anthropic", "KGW", "SynthID-Text", "Fast-DetectGPT", "Binoculars", "C2PA"], "alternates": {"html": "https://wpnews.pro/news/show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one", "markdown": "https://wpnews.pro/news/show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one.md", "text": "https://wpnews.pro/news/show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one.txt", "jsonld": "https://wpnews.pro/news/show-hn-wmtrace-see-how-llm-text-watermarks-work-anthropic-just-adopted-one.jsonld"}}