“So the feature mostly punishes the exact people who are easier to fingerprint: normal developers doing weird but legitimate things” What’s the punishment here exactly?
For being flagged as possibly a competitor? They nuke your account.
Claude Code is steganographically marking requests
221–230 of 817 posts
Re: Claude Code is steganographically marking requests
#222The conclusion of this blog post is a bit hysterical. The intent of this steg is excruciatingly clear (identifying usage by Chinese firms that may be conducting model distillation). It's unclear on how this "punishes normal developers" in any shape or form.
> hysterical. The intent of this steg is excruciatingly clear
Even good goals do not excuse malicious or reckless execution. The ends do not always justify the means.
Whether or not it harmed you this time, it's a violation of trust and autonomy.
Surely you'd be angry if someone secretly installed a rootkit onto your computer, even if--at least for now--it only had code to try to detect and snitch on Public Enemy #1.
Re: Claude Code is steganographically marking requests
#223Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering. (This field is known as "underhanded code", coined by the Underhanded C contest: https://www.underhanded-c.org . It's a little-known "art"; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving o…
I've seen Eve Online corporations that do a better job of steganographic marking than this.
That would actually be an interesting thing to read about
Re: Claude Code is steganographically marking requests
#224Headline is, frankly, awful. This isn't the AI secretly doing stuff and hiding it. This is the very human Anthropic engineers trying to detect Chinese scraping via some frankly hamfisted and unimaginative URL trickery.
Defence in depth isn't hamfisted. They're only noobs if this is all they do.
FWIW: Defense in depth is a security technique, and abuse detection isn't part of that domain. Security starts from the premise that the system is supposed to be undefeatable but might have holes, and then asking where the holes might lie to decide where to put backstops.
Here the system is "insecure" by design (literally they're trying to get the whole world to sign up for Claude Code for $200/month!) and they're trying to plug the hole that results from a "Except for Chinese Scrapers!" add-on requirement. That might be possible as an arms race kind of thing. But it's very unlikely to work by (as in the linked article) doing stuff like checking the system time zone.
Re: Claude Code is steganographically marking requests
#225I don't understand the privacy concerns the author is trying to highlight. Granted, doing anything "sneaky" will always raise suspicious once caught, but on the other hand, there would be no point in implementing these "security features" if they were upfront about how they work. And no, IMO stenography isn't security by obscurity, in the same that using RSA and keeping the private key private isn't security by obscu…
Anthopic choosing to delay their models' invevitable distillation by competitors is their prerogative.
That they choose to implement it by fingerprinting my access patterns without first disclosing is where they shit the bed. It isn't "sneaky" it's straight up sneaky (and dishonest and unscrupulous while we're at it). That this particular instance is harmless doesn't give me much comfort. Who's to say they aren't harvesting PII?
That their actions make sense for their business isn't any reason for people to accept their deceitful, customer-hostile decisions.
Re: Claude Code is steganographically marking requests
#226Earlier quoted context omitted.
Almost all ways of creating programs are effectively just using tools to produce code. Compiling, transpiling, interpreting byte code, etc.
again, that's not what we are talking about here. we have humans writing code using an IDE. we have LLMs generating code that is placed in the IDE. why are people obtuse to this? why are bots obtuse to this?
We have humans writing code using prompts. We have interpreters generating byte code that is placed in the JVM. I don’t think it’s obtuse to look at it this way.
Re: Claude Code is steganographically marking requests
#227Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn't this "marked" system prompt being sent to that provider's API rather than Anthropic's? I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where "hostname contains deepseek" would never be sen…
Seems like a pretty straightforward approach to collecting session logs from a bunch of different people/devices would be to have them all set their base url to proxy.deepseek.whatever which logs the data and forwards to the real API.
Re: Claude Code is steganographically marking requests
#228Earlier quoted context omitted.
This catches Claude resellers. Meaning companies who proxy Claude traffic for users in, say, China. https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...
"Catch" as in made a list?
Of the accounts involved, yeah. So they can lock them out.
Re: Claude Code is steganographically marking requests
#229The question is, what do they do when they see a tagged prompt? Do they flag/ban the account, or serve a degraded response? Are there some well-documented methods of serving a response that is still somewhat useful for what the prompt asks for, but really bad for distillation attempts?
Re: Claude Code is steganographically marking requests
#230The conclusion of this blog post is a bit hysterical. The intent of this steg is excruciatingly clear (identifying usage by Chinese firms that may be conducting model distillation). It's unclear on how this "punishes normal developers" in any shape or form.
False positives, we've seen them before when they degraded Fable silently based on the prompt/session