From San Digital, who run live AI courses for engineers and business teams.Live AI training from San Digital. See the courses

declawd

Six word changes against our published watermark

Published ; updated

Declawd publishes a small statistical watermark with its seed and detector. With those details public, we can change selected words, score the whole passage after each change and record exactly when it crosses the published cut-off. Claude's undisclosed mark cannot be tested this way. This is an attack on Declawd's educational method, not Claude's watermark.

Fixed starting point

Profile declawd-v1 scans ASCII word tokens and scores distinct pairs of the previous and current token. A published seed determines which pairs are green. The expected green fraction is one quarter, the verdict cut-off is 1.80, and a passage needs at least 120 distinct scored pairs before it receives a verdict. Repeated pairs count once.

The prepared flow-meter passage contains 398 raw tokens and 358 distinct scored pairs. Of those pairs, 114 are green. Its score is 2.9904, above the cut-off. The profile, passage template, authored candidate slots and scoring rules were frozen before this removal experiment was designed.

The exercise uses a symmetric keyed hash with a published seed, not asymmetric cryptography. The published value is the seed.

Six substitutions cross the cut-off

Each replacement below comes from the same authored candidate slot as the word it replaces. We selected changes with access to the detector, then reviewed the result as an ordinary piece of technical writing. The table reports scalar offsets in the original passage, before any replacement changes later positions.

Scroll horizontally to see all columns

Detector-aware substitutions applied to the prepared passage
StepOriginal scalar offsetChangeGreen pairs after changeScore after change
StartNoneNo change1142.9904
175sample to measure1122.7463
2175first value to figure1102.5021
3295holding to resting1082.2580
4371first passes to repeats1062.0139
5631falls to comes1041.7698
6994lies to sits1021.5257

The repeated words matter. A second "value" begins at original offset 327 and a second "passes" at 1030; neither is changed. The last replacement begins at offset 997 at the moment it is applied because the first five changes have added three characters. Recording original offsets makes every target unambiguous.

After five changes, the score is 1.7698, only 0.0302 below the 1.80 cut-off. With 358 effective pairs, one green-pair change moves the z score by about 0.1221 here, so the margin is less than one scoring step. The sixth change reaches 1.5257, leaving 0.2743 below the cut-off.

One word can affect two pairs

The detector scores a previous-token and current-token pair. Replacing one word can alter the pair ending at that word and the pair beginning there. For that reason, each selected change above reduces the green count by two even though only one visible word changes.

A guided editor has to recompute the entire passage. A replacement can change neighbouring contexts, and the detector counts a repeated pair only on its first occurrence. A local highlight is a place to investigate, not a promise of a fixed score reduction.

The cleaner asks the user to supply a replacement, previews the new whole-passage score and applies nothing until the user confirms. The editor does not generate synonyms or silently rewrite text. After an edit, the context table is rebuilt rather than pretending that the previous ranking still holds.

Measured result

Reproduced observation. Six human-reviewed, detector-aware substitutions move this fixed passage from 2.9904 to 1.5257 while keeping 358 effective pairs. The registered candidate slots constrain the available wording, and the exact result is reproducible from the published profile and reference implementation.

The experiment does not establish that meaning is mathematically unchanged. Semantic review is a human judgement recorded for this fixture. Nor does the experiment show that six edits will clear another passage, another seed, another detector or Claude's mark. A different word can increase the score, change the effective pair count or damage the writing.

Crossing the cut-off does not make the result "human". In the frozen evaluation, 2 of 96 passages by named public-domain authors crossed this site's threshold. The score answers one narrow question about one published pattern. It does not answer who wrote a passage or how they worked.

Two modes, two purposes

The controlled fixture makes every choice inspectable. Its registered passage, existing candidate slots and fixed expected result form the reproducible experiment.

The guided mode lets a person explore their own sufficiently long text, with fewer guarantees. Below 120 distinct pairs there is no verdict and no attack table. Above that minimum, the editor can show contributing contexts and preview a user-authored replacement. The editor cannot promise that an acceptable alternative exists or decide that a semantic change is harmless.

Publishing a detector makes detector-aware research possible. An automatic rewriting service would be a different product with a much broader claim.

Try the controlled experiment and guided editor, or read what current cleaners can and cannot change.