Hostile Engineering and Space Exploration
How to Embed Data in Text Without Anyone Noticing
Claude will now embed fingerprints in every piece of content it generates.
Anthropic has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both generative AI models and generative AI systems
…
New models will mark AI-generated content from day one.1
This was also independently found more than a month ago by Brian Roemmele.
Everyone asked naturally: how AI output gets fingerprinted? Stasi typewriters offer an interesting historical case. Catalogs came first. A die flaw was stored. Pressed keys repeated it. Every page whispered which machine.
The words stayed clean. Hidden dents stayed loud. Every machine had a signature.
Typing left it behind. Escape meant swapping hardware. Changing machines helped. However, rogue typewriters still looked guilty. No registry entry was a clue. Officials noticed that absence. Comparisons narrowed suspects. Really, flaws became identity. AI watermarks copy that idea. Clever edits can blur it. Yet detectors may still smell machines.
Copy the lesson: words hide; marks name. One badge can expose tools. Mostly, patterns accuse.
(Modern printers do the same btw, with yellow dots)
That raises the obvious question: can you do this in plain English? Can you hide data inside an otherwise normal-looking text? Surprisingly, yes. The simplest, lowest-level method is to make the initial letters do the work. I asked an AI to rewrite the opening paragraph with a secret message embedded that way; read the first letters in order and you get a classic acrostic, a trick used countless times. It is a little awkward, and I could have polished it more, but you get the point.
So does it survive copy-pasting? Surprisingly, yes: as long as the initial letter of each word is left intact, the message can endure through repeated copying. A naive approach would be to encode your full name into the first letters of everything the AI generates. But that would be awkward, conspicuous, and trivial to detect and even if it survives copy pasting, light editing would totally mess it up.
The real problem with an acrostic is that each initial letter has to carry an entire alphabet character, which constrains the opening of every sentence far too much. There is also a frequency problem: letters like E have many natural candidates, while Z is almost never a normal starting letter. If your name is Zoe, every AI-generated message will start awkwardly with Z. And most of the text is wasted: after the first letter, the rest of the sentence is padding that stores no data.
We need to encode the payload in the simplest possible form.
Binary is enough, and there is no real math involved; I will keep it simple. We can use an ASCII-style table to map each character to a binary code. In this example, the user we want to rat out is ZOE.
Z = 0101 1010
O = 0100 1111
E = 0100 0101
That gives us the sequence 0101 1010 0100 1111 0100 0101. But how do we hide it in an ordinary English sentence? A naive approach is to split the entire English dictionary into two list green and red. We can use word-length parity: if a word has an even number of characters, it is green and encodes 1; if it has an odd number, it is red encodes 0. This has another benefit: it ignores capitalization, punctuation, and other superficial changes that could add noise to the signal.
ZOE asks her favorite AI for a beef jerky recipe, and the AI responds:
Slice lean beef thin (¼ inch, partially frozen for easy slicing), then marinate 4+ hours or overnight in soy sauce, Worcestershire, and seasonings. Pat dry and dehydrate or bake at 160°F (71°C) with the door cracked for 4–8 hours until it bends without snapping, then cool and refrigerate in an airtight container.
Then it goes through our rules for ratting her out:
Use lean cut then trim fat take one jar with dry herbs keep oven door open jerky firm not raw moist cool dry well
This looks a bit weird: the words are suspiciously short. We can adjust the choices to sound more natural, and to match the length of the original recipe we can simply encode ZOE in every sentence. That not only enables us to have longer text but also adds a crude form of error correction through repetition.
You might naturally ask: how do we decode this? The answer is refreshingly simple. There’s no need for complicated AI — a few lines of Python are enough. The decoder looks something like this, and it can be shared publicly without compromising anything.
def text_to_bits(text):
“”“Map each word to ‘1’ (even length) or ‘0’ (odd length).”“”
bits = []
for word in text.split():
word = word.strip(string.punctuation) # ignore .,!? etc.
if word:
bits.append(”1” if len(word) % 2 == 0 else “0”)
return “”.join(bits)
Victory: we can now embed arbitrary data in an English text. But we still have almost no resilience. The problem is closer to deep-space communication than it first appears. Probes travel millions billions of miles through the ether, and while they can technically talk both ways, the hours-long delay makes the link effectively one-way. The AI is doing something similar: it encodes the user’s name into text that must survive the corporate obstacle copy—pasted into a PowerPoint bullet, screenshotted, printed, scanned, forwarded as final_v7_FINAL.pdf, and read aloud by a Big Four consultant pointing at the wrong slide—and still decode cleanly.
First problem: delimiters.
Repeating ZOEZOEZOE throughout the text is not enough—not even close. A decoder needs to know where the payload starts, where it stops, and how to resynchronize if characters are lost or mangled. The fix is simple: add control markers for the beginning and end. Pick a character that will never appear in a username, then frame the payload with S for start and E for end: #S ZOE #E. After that, convert everything to binary as before, starting with # = 00100011.
Second problem: delimiter loss.
If we send #S ZOE #E #S ZOE #E but receive only #S ZOEZOE #E, the decoder may conclude the user is ZOEZOE. Worse, damage could produce a different valid-looking name, such as #S ZOO #E. The fix is a small integrity field; I will keep it simple and just send the username length with the message. So the payload becomes “#S3 ZOE #E”.
In plain English: start message; three characters, “ZOE”; end of message.
Third problem: no error correction
So far, our approach has been to crudely copy the message several times. But we can do better: with error-correcting codes. This is deep-space technology, and it can get complicated fast, so let’s keep it at an “explain like I’m five” level.
The idea: encode every binary value as a three-character code.
For every 1, write 111
For every 0, write 000
The attentive reader will object: this triples the length of the message! How is it any better than our basic repetition of ZOEZOEZOE?
The answer is simple: it survives moderate degradation. Plain repetition lets you notice that something went wrong, but not fix it. With this encoding, we can. Suppose we receive “011”. The odds are that the original value was a 1 that lost a bit, not a 0 that gained two — so we decode it as 1. Majority rules.
That means we can now detect, correct, and recover the original message, even if roughly one character in three gets corrupted along the way.
Fourth problem: the language fights back
Some slots in a sentence admit exactly one word. “United States of ___” has a single acceptable completion — America, seven letters, odd, a 0 — and if the payload needs a 1 there, your only options are to corrupt the message or write something visibly wrong. The fix is to stop demanding one bit per word. Let each word cast a vote instead, tipping green or red only where the model had a genuine choice; the forced words simply abstain.
GPS already works this way. Every satellite broadcasts on the same frequency, its signal spread so thin it sits beneath the noise floor, and each one is multiplied by its own pseudorandom code. A receiver tries the codes in turn: the wrong ones average out to noise, the right one piles up into a spike, and your smartphone locks on and decodes. Treat Zoe’s identifier as her code and text behaves the same way. Scored against her key, the small nudges accumulate into a signal; scored against anyone else’s, they cancel. No single edit can remove it — and without the key, there is nothing to see.
But what about code? What if Zoe is vibe coding something?
We can do the exact same process by tweaking the function or adding comments. Really any text output can be fingerprinted unless it’s too short or is totally void of meaning
But how would the machine know Zoe’s real name? And what if there are two Zoes? Well, Anthropic’s own support…
We only use your verification data to confirm who you are and not for any other purposes.
How are we verifying?
We selected Persona Identities as our verification partner based on the strength of their technology, privacy controls, and security safeguards. Follow the steps below to complete your identity verification process.
So the machine knows who Zoe is, and the push toward KYC-style checks is relentless across every tech industry. I won’t even get into image fingerprinting here, since that’s easier to implement and has been done countless times before the advent of AI. As for a second Zoe, simply use a random identifier and put that in the fingerprint instead of the full name. Zoe One is ISNXGsIB38, and Zoe Two is xggxx2SIG0.
Another point is that splitting by odd versus even letter counts isn’t ideal. You could realistically use any discriminator to divide the entire English dictionary into two red/green lists — the easiest approach would simply be a hash function. You could even take it a step further and do it per user: each person gets their own list of words. That would make the scheme almost undetectable. I won’t explain that in detail here; all you need to know is that it’s trivial to do.
It’s worth pointing out that none of this is new. Error correction such as Low-density parity-check (LDPC) codes has been in use for decades — it powers deep-space probes, but it also sits quietly inside your Ethernet cable and fiber-optic connection. It’s everywhere. The idea of fingerprinting English text through synonym choice isn’t new either — it was discussed by Atallah et al. (2001). It’s modern variant (the green / red) filter by Kirchenbauer et al. (2023).
What if Zoe is a relentless force of life? Can this be defeated?
Zoe has several paths forward when dealing with AI watermarking, ranging from total avoidance to active weaponization. At the extreme end, Zoe could adopt a Neo-Luddite stance: boycott AI companies that disregard fundamental liberties, unplug her computer, and simply go outside to touch some grass.
A more moderate step is to only use AI models that do not fingerprint their output. However, this is easier said than done. Many software applications silently outsource their backend processing to large, proprietary models that invariably apply watermarks. Non watermarked models can be tweaked to add one just like I used Grok to inject fingerprints in the earlier examples.
If avoiding fingerprinted AI is impossible, she can attempt to scrub the hidden data. To disrupt the careful encoding, she needs to introduce noise into the text:
Local Rewriting: She could use a locally hosted AI to rewrite the generated content. While tedious, this alters the specific word choices enough to break the watermark.
Round-trip Translation: She could translate the text into another language and then translate it back, which naturally degrades and erases the hidden fingerprint.
The most intriguing strategy is for Zoe to turn the tables and fingerprint her own texts. By inverting the technique, she can use it for steganography—hiding secret messages inside perfectly normal-looking writing. She could safely transmit these messages over unencrypted, heavily monitored chat applications, or embed hidden signatures to catch plagiarists stealing her work.
The Broader Context
To be fair, the current goal of corporate AI fingerprinting is relatively modest: it generally aims to prove that a text was produced by a specific language model (like Claude), rather than identifying the exact individual who wrote the prompt.
However, bridging the gap between identifying a model and identifying a specific user requires no theoretical breakthroughs. The necessary technology to track individuals through text is already available, and the foundational concepts have been proven in daily use for decades.
https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content