Live data from Hacker News

Claude Code is steganographically marking requests

thereallo.dev

441–450 of 817 posts

Re: Claude Code is steganographically marking requests

#441
post #45

This was already discovered during the source map leak. > This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust. They already tell you they scan for malicious prompts, and they have no ZDR guarantees for consumers. Why do signatures like this matter at all?

There has been an anti anthropic propaganda push by bad actors across social media sites especially Reddit and twitter. This started a few months ago when anthropic started beating openai.

Altman is also exactly the kind of person who would resort to tactics like this.

Re: Claude Code is steganographically marking requests

#442

Earlier quoted context omitted.

> distilling the model with another model is not illegal per se. Just because it is legal, that doesn't mean Anthropic wouldn't reasonably want to prevent that from happening (which, from my understanding, isn't illegal either).

I love the asymmetry. When small fish tries to protect itself, big fish hits small fish with "It's not illegal" pole. When small fish points out that what the big fish is crying about is "not illegal", big fish has the right to be above the law to prevent the problem themselves. Having values requires equality. They have lost the right to cry foul when they trained their model with "but it's fair use" card. Life work…

> I love the asymmetry.

Much as I hate to defend companies climbing to success and pulling up the ladder afterwards, this asymmetry you note is kind of the whole point a company would want to grow big. Growing an organization has some super-linear costs and generally sucks for most individuals living through it - including the management - but it's still considered worth it, precisely because big entities can do things small entities cannot, and escape the threats from smaller competitors.

It's so basic it's actually part of the reason we exist, and animals of various sizes exist, and generally why evolution didn't stop at single-cellular life.

> They have lost the right to cry foul when they trained their model with "but it's fair use" card. Life works by reaping what you sow. Now they are at the reaping stage.

Yup. Except what they're reaping is insane cashflow and ability to pull stunts like these. We can call out the hypocrisy until our throats run dry, and in ideal fantasy land this would've meant something, but here in the real world, they sow the seeds of success, and now are reaping the right to be hypocritical and continue to get away with it.

Re: Claude Code is steganographically marking requests

#443

The conclusion of this blog post is a bit hysterical. The intent of this steg is excruciatingly clear (identifying usage by Chinese firms that may be conducting model distillation). It's unclear on how this "punishes normal developers" in any shape or form.

If you want to proxy Claude for a legitimate reason, you’ll have potentially nerfed responses. edit: Legitimate reasons include: - analyzing what Claude Code is sending to Anthropic to verify its not exfiltrating data; - selecting a model dynamically based on prompt difficulty, or enforcing a particular model; - switching between multiple Anthropic accounts based on the project; - filtering out credentials, PII and c…

I guess I can see why they might nerf detected clients server side, but without evidence I would not assume it. Could also be so that 1) they can identify sus client IPs, 2) do a statistical analysis on distilled models to prove that their system prompts were clearly using unique tokens from Anthropic’s API.

Re: Claude Code is steganographically marking requests

#444

Anthropic must think that their moat isn't very large if they're this worried about distillation.

That's...a good thing. A "moat" is an anticompetitive practice. You don't want companies to have moats.

Meanwhile, if you mean "Anthropic must think their technical advantage isn't very large..." then your conclusion is literally disproven by your premise.

Re: Claude Code is steganographically marking requests

#445
post #279

There are some commentors in this thread downplaying the severity of a service provider being less than transparent about exactly what their shipped tooling does on customer's machines. That the provider's business needs necessitate the this behaviour doesn't justify their lack of honest disclosure. That honest disclosure would render the solution to their problem useless isn't my problem. If anything, that they thou…

Whether or not you find Anthropic's behavior bad, theybhave been very loudly stating the foreign labs have been distilling their models for a while now. This seems like an obvious response to me that would be a mechanism to make that obvious.

>very loudly stating the foreign labs have been distilling their models

Help! Someone else is blatantly ripping off my plagiarism machine!

Re: Claude Code is steganographically marking requests

#446
post #279

Earlier quoted context omitted.

Whether or not you find Anthropic's behavior bad, theybhave been very loudly stating the foreign labs have been distilling their models for a while now. This seems like an obvious response to me that would be a mechanism to make that obvious.

From my understanding, distilling the model with another model is not illegal per se. Also, the output of the LLM is public domain by law, too. So, why all this "effort" to protect the model? This is a free market, and moving fast and breaking things is the norm. If they are so adamant on protecting their IP, maybe they can start by respecting others' IP, so we can start talking about ethics, equality and playing fai…

> If they are so adamant on protecting their IP,

What they are trying to protect doesn't qualify as intellectual property. Only 4 categories of IP exist: (1) copyrights; (2) patents; (3) trade secrets; (4) trademarks.

The capabilities embedded in model outputs don't qualify. Machine-generated outputs are ineligible for copyright. They aren't covered by patents. They aren't trade secrets, because the model companies are selling them rather than keeping them secret. And of course, trademarks are conceptually inapplicable.

This leaves the model companies with contract law (ToS) which is pretty inept because it can't bind third parties. And technical measures, like the ones being discussed in the article. And, of course, politics.

Frankly, I think it's pretty ridiculous to even think that models can be protected from being learned from. I feel the Stanford Alpaca team demolished that idea 3 years ago.

Re: Claude Code is steganographically marking requests

#447
post #332

There are some commentors in this thread downplaying the severity of a service provider being less than transparent about exactly what their shipped tooling does on customer's machines. That the provider's business needs necessitate the this behaviour doesn't justify their lack of honest disclosure. That honest disclosure would render the solution to their problem useless isn't my problem. If anything, that they thou…

So they’re watermarking requests according to your environment variables and maybe changing a string format if you’re in a certain time zone? Am I missing something here? Where’s the five alarm fire?

[dead]

Re: Claude Code is steganographically marking requests

#448
The timezone checks for Shanghai and Urumqi, but not Hong Kong. All of these are the same actual time (China does not use time zones internally), not sure how these three were picked (why not Beijing or Macau etc). And all of them are prohibited by ToS, so not sure why they only flag mainland time zones.

Interestingly, my device is in Shenzhen right now, but macOS has assigned Shanghai as the "closest city" rather than Hong Kong which is geographically closer. I am curious if there is any documentation on how that is assigned.

Re: Claude Code is steganographically marking requests

#449
post #349

Earlier quoted context omitted.

Are Chinese programmers really prohibited from accessing American models?

By the terms of service: https://www.anthropic.com/supported-countries

I think they were asking about the Chinese companies/programmers being "legally prohibtied" from accessing Anthropic's product.

Re: Claude Code is steganographically marking requests

#450

Earlier quoted context omitted.

If you want to proxy Claude for a legitimate reason, you’ll have potentially nerfed responses. edit: Legitimate reasons include: - analyzing what Claude Code is sending to Anthropic to verify its not exfiltrating data; - selecting a model dynamically based on prompt difficulty, or enforcing a particular model; - switching between multiple Anthropic accounts based on the project; - filtering out credentials, PII and c…

Half of those don't actually require proxying Claude. Also, Claude has made it apparent time and time again that it does not want people using Claude Code as a "tool" in a workflow. If you want to select a model dynamically based on the prompt difficulty, Anthropic wants people to use the API for this. It was the whole issue Claude had with OpenClaw.

Why does the Agent SDK or even claude -p exist then?
Post reply on HN