The Invisible Ink Problem
Anthropic says it has begun watermarking Claude's output. I went looking for the mark — and found a better story instead. On invisible ink, provenance nobody can inspect, the asymmetry that should worry us more than the cryptography — and, by way of demonstration, an article that watermarks and signs itself, with the full toolkit to check it. Amended 17 August 2026 with the mechanism Anthropic finally published, the argument of mine it demolished, and a provenance statement for this essay itself.
*On watermarks you cannot read, provenance you cannot trust, and the peculiar business of trying to catch a machine leaving fingerprints.*
Amended 17 August 2026. Published 12 August, and overtaken two days later: on 14 August Anthropic published the mechanism, which turns out to be a variant of SynthID-Text. That disclosure confirmed one of my hedges, demolished the argument I was proudest of, and answered two open questions this investigation had left hanging. All of it is now in the text below, with the demolished argument left standing beside what replaced it. This edition also carries a provenance statement for the essay itself — How This Was Made — because an article arguing that a binary mark cannot report what happened during authorship ought to publish the account a mark cannot carry. The page has been re-marked and re-signed as of today; the earlier signature no longer verifies against it, which is exactly what a signature is for.
We are building a global provenance system whose invisible half cannot currently be inspected by anybody expected to trust it.
I didn’t realise that was the story. I thought I was investigating Claude’s changing vocabulary.
It began, as these things do, with a suspicion. The words had changed — nothing so vulgar as a new accent, but something in the choosing of them felt different, the way a familiar room feels different when somebody has moved a chair three inches to the left. And there was a perfectly good reason to be suspicious: Anthropic had just announced it would start watermarking Claude’s output. So the hypothesis assembled itself more or less unbidden. They’re swapping the words. That’s the mark. That’s what I’m hearing.
It was a good hypothesis. It was testable. And it was, on the evidence, wrong.
What follows is the investigation, including the parts where I was wrong, because those turned out to be more instructive than the parts where I wasn’t.
Summary, for the impatient
Anthropic has begun implementing machine-readable marking under the EU AI Act’s Article 50 Code of Practice. Models launched on or after 2 August 2026 are intended to support marking from launch; older ones are still transitioning. Two mechanisms: an imperceptible watermark woven into generated text, and C2PA provenance metadata attached to generated media files.
| Mechanism | Marking status | Independent verification |
|---|---|---|
| Text watermark | SynthID-Text variant, models launched on/after 2 Aug 2026 | Detection API announced, not yet available; interoperability due 2 Feb 2027 |
| C2PA on files | No claim found on the file tested | Mature open-source tooling, available today |
Look at that table for a moment, because the joke is buried in it. The two halves are precisely inverted. The component everyone frets about — text — is the one nobody outside the company can currently interrogate. The component that is fully, freely checkable turned out to be emitting nothing at all.
That asymmetry, and not the cryptography, is the story.
A declaration, which this article of all articles ought to make
I use these tools constantly. I build platforms on them, I code with them, and I use them as an ideas board — pulling in research, arguing with a position until it holds, sketching an essay out until it has a shape worth keeping.
Then I write it. Then I tweak it. Then I hand it back for a tidying pass, partly because it saves a considerable amount of time and partly because I’m dyslexic and always have been, and a machine that catches what my eyes slide over is not a shortcut so much as a pair of glasses. Then I proofread it, change my mind about several things, and quite possibly ask for another pass.
This piece went through exactly that. Several times.
What that process is not is asking a machine to produce something while I sleep and putting my name on it in the morning. I put a great deal of effort into what I write, and when it’s written for other people to read and rely on, that effort is the entire point. The judgement about what is worth saying, which argument survives contact with the evidence, and which of my own confident claims had to be withdrawn — all of that is mine, including the parts I got wrong further down.
I mention it because I am precisely the person this marking scheme handles worst. My work would carry a mark. The mark would be accurate: a machine touched it, repeatedly. And almost everyone reading that mark would draw a conclusion from it that isn’t true.
The Commission, to its credit, anticipated people like me and wrote an exemption for exactly this. Whether the architecture can reach it was, until 14 August, the sharpest argument in this essay. It is now the most instructive wreck in it.
Part 1: What Is Actually Being Built
The legal scaffolding
Article 50’s transparency obligations apply from 2 August 2026. There are three dates, and conflating the first two is responsible for most of the confusion currently in circulation.
- 2 August 2026 — systems placed on the market from this date must mark from day one. No grace, no quarter.
- 2 December 2026 — generative systems already on the EU market before August get a transitional window, compressed from six months to three by the Digital Omnibus agreement.
- 2 February 2027 — and here is the one nobody talks about. Signatory providers must have a watermark-detection interoperability solution in place, so that marks can be read across different providers’ systems.
Hold onto that third date. It quietly reframes everything else.
Two further points, both regularly misreported. The Commission’s Guidelines are non-binding — they set out an interpretation, and only the CJEU can hand down an authoritative one. And the AI Act never names C2PA anywhere in its binding text. The regulation is deliberately technology-neutral. C2PA is the industry’s chosen answer to the question, not the question itself.
Text: the watermark you cannot see
The text mark is applied at the model level, meaning it rides along regardless of which door the output came through — API, Claude, Claude Code, Claude Cowork, Claude Tag. It survives copy-paste, and may survive some editing.
On mechanism, we now have an answer. On 14 August 2026 Anthropic published a detailed explainer, and it is a version of SynthID-Text, the approach Google DeepMind published in Nature in 2024 — itself descended from a proposal by Scott Aaronson in 2022.
The design principle is more elegant than the “green list” framing usually reached for. The watermark does not bias the model toward particular words. It changes the source of the randomness. When Claude reaches a point where two continuations are equally good — “the weather was cold and overcast” versus “grey” — the choice is normally settled by a random number. Watermarking replaces that arbitrary random number with one derived from a secret key and the preceding few words. The choices remain random; they are simply now reproducible by anyone holding the key.
It is a genuinely lovely piece of engineering, and worth pausing on. No single word is unusual. Not one. Every sentence looks exactly as it would have looked anyway. But across a few thousand tokens the distribution drifts into a shape that is astronomically improbable unless you hold the key — a bias so slight it is invisible at any single point, and unmistakable in aggregate. It is steganography by statistics: hiding a message not in the words but in the faint, patient accumulation of preferences across all of them.
How Tournament sampling actually works
The paper is open access, and the mechanism is worth stating precisely, because it is more elegant than the summaries suggest.
At each step, a seed is derived by hashing the last four tokens together with the secret key (the paper uses a sliding window of H = 4). That seed feeds m independent pseudorandom functions, each assigning every token in the vocabulary a g-value — in the paper’s implementation, a 0 or 1 drawn Bernoulli(0.5).
Then the tournament. Rather than sampling one token, the system draws several candidates from the model’s own distribution, pairs them off, and in each match keeps whichever scores higher on that layer’s g-function. Winners advance; the next layer uses a different g-function. The last token standing is emitted. The paper generally uses m = 30 layers in its experiments.
Detection then computes the mean g-value across the text. Watermarked text scores above 0.5; unwatermarked text hovers at it. The paper explores several scoring functions and finds a learned Bayesian one performs best.
The property that matters most is easy to miss. With exactly two competitors per match, Tournament sampling is single-token non-distortionary: averaged over the random seed, the output distribution equals the original model distribution. Put precisely: the watermark changes the sampling procedure while preserving the model’s marginal token distribution. This is not “close enough to unnoticeable” — it is a guarantee, and it cleanly separates watermark signal from model-quality distortion. A distortionary configuration with more competitors trades that guarantee for stronger detectability, and Anthropic’s public description matches the non-distortionary posture.
Two caveats on those numbers. H = 4 and m = 30 are the paper’s experimental settings, not necessarily Anthropic’s — Claude’s mark is described as “a version of” SynthID-Text, and the parameters are configurable. And the scheme includes repeated context masking: if the same four-token window has already been used to watermark, the step is skipped and sampled normally, which prevents the repetition artefacts that plagued earlier schemes.
Anthropic’s own analogy is a good one. Imagine a game of Monopoly in which, instead of rolling dice, players take successive digits of pi starting from some randomly chosen point. The game plays identically. No player could tell. But someone who knows pi can look at the sequence of moves afterwards and work out that this game was probably not played with dice.
Three corollaries follow, and all three matter:
- Nothing is added to the text. No hidden characters, no zero-width tricks, no extra tokens. This rules out an entire family of techniques people assume is in play — including, with some irony, the one this article uses on itself at the end.
- It carries no identifying information. The mark cannot be traced to a person, an organisation, or a conversation. There is nothing in the key that recovers user data.
- It costs nothing. No additional tokens are produced, so the model is no slower and no more expensive to serve.
On whether any of this is perceptible, there is published evidence rather than assurance. The SynthID-Text paper reports a live experiment across roughly 20 million Gemini responses, splitting traffic between watermarked and unwatermarked models: the thumbs-up rate differed by 0.01% and the thumbs-down rate by 0.02%, both statistically insignificant and well within confidence intervals. A separate controlled study had raters compare watermarked and unwatermarked answers side by side on grammaticality, relevance, correctness, helpfulness and overall quality; no significant preference emerged on any of the five. Perplexity and standard benchmarks showed no difference either. Anthropic reports the same from internal testing — no impact on content, creativity or readability.
That is the standard any claim of hearing the watermark has to clear, and it is a high one. It does not make such a claim impossible, but it does mean the burden sits with the claimant and that a blind test is the only thing that could settle it. Part 2 is what happened when I put my own claim through one.
What holds regardless of scheme:
- Detection is key-dependent. If it is statistical, it cannot be read by inspection — not by you, not by a third party, not by the model itself.
- It needs room to breathe. Short passages simply don’t contain enough material. The Code of Practice concedes the point outright: content under 200 tokens is waived entirely.
Documented failure modes: heavy editing, paraphrase, translation, brevity.
Files: signed metadata
For supported media — .svg, .png, .jpg and friends — a C2PA manifest is attached: cryptographically signed metadata recording origin and edit history.
Documented failure modes: format conversion, re-saving, screenshots, and any editor that doesn’t know to preserve it.
Worth noting: marks can land on files Claude merely processes, not only those it authors, because people constantly use these tools to proofread, translate, summarise and convert work that is entirely their own.
Provenance is not authorship, and this will cause trouble
This deserves rather more emphasis than it usually receives. A C2PA manifest does not say:
Claude wrote this.
It says something considerably narrower and less satisfying:
This assertion was signed by this participant in the processing chain.
C2PA’s trust model is built on cryptographic signers and certificate chains. It answers what touched this file, and is the record intact — not whose work is this. The two questions feel adjacent. They are not. And conflating them will produce confident, wrong conclusions in precisely the settings where being wrong costs somebody something.
What a mark is not
Two corrections, because the fear here is widely aimed slightly off-target.
Article 50(2) requires machine-readable marking. It does not put a visible badge on anything. Nothing in the Act stamps “Made with AI” across your work. Visible labelling is a separate duty under Article 50(4), it applies to deepfakes and to text published on matters of public interest, and it falls on deployers rather than on authors. The badge most people are actually picturing — the one that appears under a post — is a platform decision: a social network reading a C2PA manifest and drawing its own conclusion. Platforms have already demonstrated they will do that bluntly. Aim the complaint at the labelling policy, not at the marking obligation.
And a provenance mark asserts nothing whatever about ownership. Copyright is untouched by it. The genuine intellectual-property question sits elsewhere — in the separate and very live argument about how much human authorship is required for copyright to attach at all — where a mark might one day be pressed into service as evidence. That is a different fight, and worth not conflating with this one.
The line the law draws — and the line the architecture cannot see
The Commission was careful here, and deserves credit for it. There is a standard-editing exemption from the marking obligation, and the final Guidelines widened it. It covers grammar correction, spellchecking, minor stylistic polishing, formatting, technical compression and minor image adjustments — provided they do not change the substance, meaning, style or message. AI-generated summaries, substantive paraphrasing and rewriting fall on the other side. Translation moved into the exempt category in July, having previously sat outside it.
That is a thoughtful line, drawn roughly where most working writers would draw it themselves. A practical heuristic has emerged for reading it: if the output could be presented as the human author’s own work without misleading the audience about the nature of the assistance, the assistive-function exception likely applies. Polish is exempt. Ghostwriting is not.
Now consider where the mark is actually applied — and here I had an argument I was rather pleased with, which Anthropic’s 14 August explainer has substantially demolished. It is worth setting out both, because the demolition is more interesting than the argument.
What I thought. Model-level watermarking operates at the point of token production, before anyone knows whether the tokens will become a substantive rewrite or a corrected comma. It has no view of the workflow. So the exemption would exist on paper and be unreachable in practice, and the fix would be to move marking downstream to the AI system layer, where the workflow is visible.
What is actually the case. The mark attaches only to words Claude chooses. When it proofreads your text, nearly all the words are yours, so there is almost nothing for the watermark to attach to — and depending on length and the weight of the edit, the result may carry no detectable mark at all. The same holds wherever the text is constrained: after “2 + 2 =” there is no equally good alternative to “4”, so no nudge is applied. Watermarking is sparser on factual passages for exactly this reason.
So the mechanism tracks the legal line surprisingly well — not because it can see the workflow, but because polish and generation differ in how many free choices they contain, and the watermark can only live in free choices. The law’s distinction and the mechanism’s constraint happen to point the same way.
What survives of the criticism, and it is thinner but not nothing: the alignment is emergent rather than designed. Nobody specified it, nobody guarantees it, and an author cannot rely on it. The threshold is probabilistic and undisclosed — heavy editing still marks, light editing may or may not, and you cannot find out which side of the line your document fell on because there is no detector. An exemption you cannot verify you qualify for is a weaker thing than an exemption. But it is a great deal better than an exemption the architecture actively defeats, which is what I claimed.
The source-code wrinkle
A genuine divergence between what the law requires and what Anthropic appears to do. The Commission’s final Guidelines of 20 July 2026 substantially expanded the exclusions from the Article 50(2) marking obligation, which now explicitly cover AI-generated translations, source code, short outputs, machine-to-machine outputs, and closed-loop workflow outputs at intermediate stages (final outputs must still be marked). Anthropic nevertheless states that embedded watermarks apply to generated text across supported products — Claude Code among them. If code is being marked, that appears to be an implementation choice or a broader compliance architecture, not an Article 50 requirement.
The boundary is pleasingly unresolved. On one reading, the exemption covers source code proper — inline comments and docstrings included, since they form part of the artefact — but stops short of standalone documentation such as README files. Which means a single Claude Code session can produce exempt and non-exempt output side by side, in the same commit, with the line running somewhere between a docstring and a README. Nobody has yet had to argue that one in front of a regulator. Somebody will.
C2PA on code files: structurally impossible. The standard needs a container with a metadata segment — JPEG APPn, PNG chunks, XMP in SVG. A .py or .ts file has nowhere to put a manifest. There is no shelf to leave it on.
Text watermarking on code: technically miserable regardless of legality. Statistical watermarking needs entropy in token selection, and code is the most entropy-starved text we produce:
- Long stretches of syntax are effectively deterministic — imports, closing braces, type annotations
- Identifiers are dictated by the surrounding codebase, not freely chosen
- Formatters (
prettier,black,gofmt) re-tokenise the lot - And the ordinary workflow — paste a function, rename the variables, run the linter — is precisely the “heavy editing, short passage” failure case, with much of it under the 200-token waiver anyway
You could hardly design a worse substrate if you tried — and this is not merely Anthropic’s assurance but a property the paper analyses directly. Detection performance depends on the entropy of the model’s distribution: where the model almost always returns the same continuation, Tournament sampling has nothing to choose between, and no watermark can be embedded. The paper notes the effect compounds unhelpfully, since larger and more capable models tend to be lower entropy, and RLHF reduces entropy further.
But there is a wrinkle inside the wrinkle. Where code does contain arbitrary choices — comments, chiefly — the watermark can attach. And on one reading of the Guidelines, the source-code exemption covers inline comments and docstrings as part of the artefact. So the one place in a code file the watermark can live is a place the law appears to exempt.
And translation is now the cleaner example. The Commission moved AI-generated translation into the exempt standard-editing category in July. Anthropic states plainly that translations are watermarked, because every word in a translation is chosen by Claude. There is no ambiguity to argue about here and no emergent alignment to rescue it: the law exempts it, the mechanism marks it fully, and marking is applied globally at launch because Anthropic does not yet have a durable way to scope it by region.
And yet code is the most marked thing Claude produces
Here is the irony, and it deserves its own moment. The one category of output the law explicitly excuses from marking is the one that arrives, in practice, plastered with attribution — just not in the tokens, where watermarking is miserable, but in the metadata around them, where it is free.
Start with the commits. By default, Claude Code signs its work like a painter:
Co-Authored-By: Claude <noreply@anthropic.com>— and pull-request descriptions arrive with a robot emoji, a “Generated with Claude Code” credit, and a link back to the session that produced them. The model does not merely write the code; it commits the code, under its own name, with its employer’s email address, into a public ledger designed to be searched. Git history is the one place in software where provenance is the entire product — and the agent ships with autographs switched on.
Then there is the code itself, which carries tells no cryptographer needed to design. The narrating comment, explaining the line to the person who just watched it being written:
# Iterate over the users and check whether each one is active
for user in users:
if user.is_active:The comment addressed to a reviewer who will never exist — # As requested, this now handles the empty case — conversational shrapnel from a chat that ended weeks before anyone reads the file. The apologetic hedge. The suspiciously comprehensive docstring on a three-line function. None of this is a watermark in any technical sense. All of it is attribution, and rather louder than a statistical nudge in the sampling loop.
I keep a standing instruction in every repository I own telling the model, in effect, to stop signing my commits — which rather proves the strippability point. The visible marks on code are opt-out, and the opt-out is a paragraph of configuration. The population of marked commits is therefore self-selected in exactly the way Part 4 worries about: presence means the author didn’t mind; absence means nothing at all.
Now the cynical reading, and I will own it as mine. Every one of those trailers is greppable. GitHub is public. Counting Co-Authored-By: Claude across the world’s repositories is the cheapest usage dashboard ever built — third-party verifiable, independently auditable, impossible to accuse of being marketing because it sits in other people’s git history. Anthropic does not need the trailer to know its own usage; it has billing data for that. The trailer tells everyone else — researchers, journalists, analysts, and anyone assembling a growth story ahead of, say, a public offering. Reach, notarised by strangers, one commit at a time.
The fair-minded reading is also real, and I will give it its paragraph: attribution in commits is genuine transparency, of precisely the kind this essay keeps demanding. git blame pointing honestly at the robot is useful in a way a hidden statistical mark never will be — it answers who wrote this line at the moment someone actually asks it. The two readings are not in tension. A transparency feature that doubles as a distribution metric is not a conspiracy; it is a well-aligned incentive, which is the most durable kind. But it does mean the marking landscape is exactly inverted from where the regulation points: the prose, which must be marked, carries a mark nobody can read — and the code, which is exempt, carries one anybody can grep.
Part 2: A Hypothesis, Tested — And a Test That Didn’t Hold
The suspicion, stated properly:
Claude’s word choices have visibly changed. The watermark is applied after the output stream, as post-generation word substitution — which is exactly why the model itself wouldn’t know about it.
The architectural instinct here is sound, and deserves credit. A downstream layer would be invisible to the model. Generation happens upstream of whatever handles the stream afterwards. That is a real limit, and no amount of introspection gets around it.
First, an error of mine
The original version of this investigation argued that since Anthropic says the marking doesn’t change meaning, word choice cannot be the carrier.
That argument is wrong. It was also load-bearing, which is worse.
Generation-time statistical watermarking works precisely by changing which tokens get preferentially sampled. Swap “large” for “substantial” and you have altered the token sequence while preserving the meaning entirely. Semantic preservation and lexical carriage are perfectly compatible bedfellows. I had them fighting.
Which forces a distinction the original cheerfully collapsed:
| Proposition | What the evidence says |
|---|---|
| A crude post-hoc synonym-substitution layer, applied downstream | Evidence reasonably against |
| Generation-time statistical token biasing | Nothing decisive. These methods cannot touch it |
Everything below concerns the first row only.
Test 1: does the mechanism even cohere?
The hypothesis wants a mark that is simultaneously covert and noticeable by ear. For a crude downstream rewriter, those pull against each other. A layer without generation context desyncs idioms, breaks register mid-sentence, and mangles long dependencies. That isn’t covert marking; that’s visible damage.
Note the narrower claim than I originally made. This argues against a clumsy substitution layer. It says nothing whatever about generation-time biasing, which is designed to be lexical and imperceptible at once.
Result: coherent only as a visible, low-quality mechanism — which is not what was proposed.
Test 2: three documents, three genres
A formal philosophy explainer, a personal disaster-tech blog post, and a strategy paper on trust, compared for substitution signatures.
What varied tracked genre and intent: register, person, concrete versus abstract diction, British spelling in two of the three. None of it localised to a repeatable word-level swap.
What held constant across all three: the antithesis construction, triadic lists, em-dash asides, “it’s worth…” openers, single-line aphoristic closers.
That distribution is the diagnostic. A recently-installed substitution layer predicts divergence between older and newer samples. What turned up was the opposite: the tics were the constant, and the variation was explained entirely by what each piece was for.
Two further observations, both awkward for the hypothesis:
- The drift ran backwards. The oldest document carried the most generic AI patterning; the newer ones had the more idiosyncratic voice. Exactly wrong, if something new had been bolted on.
- Long-range coherence survived. Sustained periodic sentences with idioms intact across ninety-odd words — the first thing a context-blind substitution layer breaks.
Result: no crude substitution signature.
Test 3: the test I got wrong
The original called this “the strongest test.” It was nothing of the sort, and the confounder is fatal.
The corpus ran 21 July to 11 August 2026, straddling 2 August. Matched-genre exchanges either side showed an identical structural fingerprint — the same numbered-caveats preview, the same framing, the same closing offer. Stable hedges, antithesis constructions, aphoristic closers, all present on both sides. Nothing appeared. Nothing vanished.
But 2 August is a regulatory date, not a model boundary. If the model serving both conversations predated August — and it did — then nothing was ever expected to change. Worse still, that model sits inside the transitional window running to 2 December, so no marking obligation had even attached to it yet.
Which makes the honest statement of the result:
**No user-visible stylistic discontinuity occurred across the regulatory date. This is not a watermark test, because the underlying model never changed.**
I’ve kept it, because a null result is still a result and the confounder is instructive. But it’s been demoted from evidence to anecdote, which is where it belonged all along.
The word that illustrates the whole confusion
The term “load-bearing” turned up in both an older document and a recent conversation. It is cited elsewhere as a recognisable Claude tell, and it is — I use it constantly, apparently without noticing.
But look carefully at what that proves, because it is almost exactly backwards from what it feels like it proves. A recognisable tic is evidence of style. It is not evidence that the hidden mark has been located. Catching Claude reaching for load-bearing for the fourth time tells you something true about its voice and nothing at all about its watermark. A watermarking system could produce aggregate distributional effects visible over an enormous corpus — but that is a claim about millions of tokens and a statistical test, not something you infer from noticing a favourite adjective.
The thing you can hear is, by construction, not the thing that was hidden.
Anthropic has since confirmed this directly, and with an unexpected flourish. Distinguishing their watermark from commercial AI-detection software, they note that detectors work by spotting phrasing tells — and give as their example that models are fond of the construction “this isn’t X, it’s Y”, and reach for the word “quietly” far more than you would expect. That antithesis construction is the very tic this investigation found running through all three sample documents. The vendor and the stylometry agree: it is a tell, it is recognisable, and it is emphatically not the watermark.
So what was actually being noticed?
Something real, attributed to the wrong cause. Three unglamorous factors cover it:
- A genuine stylometric fingerprint. The tics exist. They’re identifiable. They were always there.
- The frequency illusion. Once you go looking for a mark, an existing pattern leaps out of the page at you. This is not a failure of attention; it’s what attention does.
- Ordinary model-update drift. Real, but diffuse, and stubbornly refusing to align with any date on the calendar.
Confidence: reasonably high against a crude, readable, post-generation substitution layer. Explicitly agnostic on generation-time statistical watermarking, which none of these methods can test.
Part 3: Getting Your Hands Dirty
The tooling exists, and I was wrong about that too
An early assumption here — that no public verifier existed — was wrong, and applies to the text watermark only. C2PA verification has been available for years:
brew install c2patool # or: cargo install c2patool
c2patool file.svg --detailed # full manifest JSONAlongside it: official and third-party web verifiers, a Content Credentials browser extension for Chrome, Edge and Brave, and JS/Python SDKs. The CLI hands you raw manifest JSON; the official web verifier validates without showing the plumbing. CLI for debugging a pipeline, web tool for a quick look.
What “valid” actually means
Run c2patool trust --help and you find no bundled trust store. Every option — --trust_anchors, --allowed_list, --trust_config — expects PEM files you supply yourself.
Sit with that, because it is the most misunderstood thing in the whole standard. Verification walks a chain:
File
└─> Manifest what is claimed
└─> Signature was it altered
└─> Certificate chain who signed it
└─> Trust anchor do you accept themThe first three links are mathematics, and the tool does them for you flawlessly. The fourth is a judgement, and it is yours. Out of the box, c2patool will cheerfully confirm that a signature is cryptographically intact — which is a completely different sentence from this came from someone you trust. Verifying an Anthropic manifest properly means fetching the CAI known-certificate list and passing it in explicitly.
The tool does not do your trusting for you.
It is faintly to its credit that it doesn’t pretend to. Rather a lot of security software fails at exactly this point, quietly supplying a trust anchor nobody chose and presenting the result as though the mathematics had settled a question it never touched.
The experiment
An SVG generated in a Claude session, downloaded, inspected:
$ c2patool claude-output.svg --detailed
Error: No claim foundThree words, and the honest thing is to let them mean exactly what they say and not a syllable more.
What this establishes: that particular SVG, produced through that particular model and product path on 11–12 August 2026, contained no C2PA claim.
What it does not establish: that Anthropic’s C2PA implementation is inoperative.
The result agrees with the documentation rather than contradicting it. Anthropic’s material is written in the future tense throughout and qualified at every turn — supported models, supported file types, supported surfaces, pre-August models still in progress. The model used predates the cutoff and sits inside the window running to 2 December. File signing may well hook into image generation rather than arbitrary file writes.
A negative result is still a data point. It is simply a smaller one than it feels like at the moment it appears on your terminal.
On the geography question
A reasonable thought: perhaps marking is skipped outside the EU, to save the overhead. Two things argue against it.
Anthropic has since answered this directly: watermarking is applied globally at launch, because they do not yet have a durable way to scope it by region — with a note that they continue to evaluate approaches. The reasoning below stands, but is now superseded by the vendor’s own statement.
The incremental runtime cost is negligible, and this is now confirmed rather than inferred. Watermarking produces no extra tokens, so the model is no slower and no more expensive to serve.
The original inference, for what it is worth. Signing a manifest is one hash and one signature over a file that has already been generated, set against an inference call that took seconds and cost orders of magnitude more. Statistical watermarking is a bias inside a sampling loop that is already spinning. Neither looks like the sort of per-request cost anybody would geo-optimise, and the genuinely expensive parts — engineering time, key management, detector infrastructure — are fixed, and you pay them once.
And territorial scope makes geo-gating actively unwise. Obligations attach irrespective of whether the provider sits inside the EU or in a third country, and extend to non-EU providers whose system output is used in the EU. Since output has legs — text generated in Bangkok is pasted into a Brussels newsroom without asking anyone’s permission — conditioning on user location buys you detection logic, divergent code paths and legal exposure, in exchange for very little. Marking everything uniformly is both cheaper and safer, which is a rare and happy alignment.
Testable, though: run the same check against a post-cutoff model from a non-EU location. A null result revives the hypothesis; a manifest kills it.
Part 4: The Asymmetry That Should Worry Us
The durability complaint is well-rehearsed and largely correct. The more serious problem sits downstream of it, and gets far less airtime.
Where the criticism lands
Anthropic’s own limitations list reads rather like a confession. Metadata dies to format conversion, re-saving and screenshots. Text marks die to heavy editing, paraphrase, translation and brevity. Open-source C2PA removal tools already exist and are not hard to find. And the coverage is asymmetric in the least helpful direction available: open-weight models do none of this, so the parties most reliably marked are, almost by definition, the ones least likely to be the problem.
Where it overreaches
“Regulators don’t understand the technology” is the intuitive read, and it is largely wrong. The mechanism wasn’t handed down from a great height by people who’d never seen a tokeniser. The Code of Practice was negotiated with the labs and assessed as adequate by the Commission and the AI Board. C2PA came out of Adobe, Microsoft, Intel and the BBC. If the approach is fragile, that is the state of the art being fragile, not a drafting error. The Guidelines qualify the obligation by technical feasibility, content characteristics, cost and state of the art — which is not the language of people who think they’ve solved it.
Presence means something. Absence means almost nothing.
Here is the part that actually matters, and it has nothing to do with cryptography.
The interesting question is not can the watermark be defeated. Of course it can. The question is:
What evidential weight should we attach to the presence or absence of a mark, in a system that knowingly permits a great many false negatives?
The logic the technology supports is asymmetric:
- Mark detected → strong evidence of machine provenance
- Mark not detected → indeterminate
And human beings, faced with a binary detector, collapse that into something tidier and false:
- Detected = AI
- Not detected = human
The second line is unsupported, and the exemption list makes it worse than unsupported. Content under 200 tokens: waived. Source code: excluded. Translations: excluded. Machine-to-machine output: excluded. Systems on the market before August: until December. Open-weight models: nothing at all, ever. Every one of those is a category of unmarked-but-machine-generated text, and the list is now long enough that “no mark” tells you very nearly nothing about where something came from.
And the defeat is trivial, which is the part that should settle the argument. Anthropic says so themselves: light editing probably will not remove the watermark, but a complete rewrite where every word is replaced will. No expertise is required. No tooling. One prompt, one pass through a second model, and the mark is gone.
Except it is not quite gone, and the wrinkle is instructive. Around 190 signatories signed the Code of Practice, and the other major developers are implementing their own watermarks. Rewriting through a second compliant model does not produce unmarked text — it produces differently marked text, because every word in the output was chosen by that second model. It is the same condition that makes translations fully watermarked. You have swapped one key for another.
Genuinely unmarked output requires a non-signatory or an open-weight model, which is no obstacle whatsoever to anyone who wants one. So the scheme reliably marks people using compliant tools openly, and does nothing at all to anyone motivated to avoid it. Which inverts the intuition rather neatly: if evasion costs one prompt, then carrying a mark is closer to evidence of not having tried to hide anything than evidence of wrongdoing.
None of this is a hostile reading. The SynthID-Text paper says it plainly in its own limitations section: generative watermarks require coordination between the actors running the services, the rise of open-source models presents a challenge because enforcing watermarking on decentralised deployments is difficult, and the schemes remain vulnerable to stealing, spoofing and scrubbing attacks. Among the paper’s own citations is a result whose title states the position with admirable economy — Watermarks in the sand: impossibility of strong watermarking for language models.
The people who built this are not claiming what institutions will shortly claim on their behalf. That gap is the whole problem, and the paper lets us locate it precisely.
Three questions are routinely collapsed into one:
| Question | Answer | |
|---|---|---|
| Generation integrity | Does watermarking alter what the model produces? | No — formally non-distortionary in the relevant configuration, confirmed across 20 million responses |
| Detection | Can text be identified as statistically consistent with the watermark? | Yes — given the key and sufficient length |
| Provenance | Does that establish who produced this text, from where, unaltered, and authentically? | No |
The first two are engineering questions, and SynthID-Text answers them well. The third is not an engineering question at all, and no amount of cryptographic rigour in the first two produces an answer to it.
Which yields a sharper thesis than “watermarks don’t work” — a claim that is both crude and false:
**A watermark can be mathematically sound as a detector while remaining insufficient as a provenance system.**
That is a much harder proposition to dismiss, because it concedes everything the builders actually claim and disputes only what will be inferred on top. The irony of the whole exercise is not that the watermark is bad. It is that the watermark may be rather good at answering a far narrower question than the world will want it to answer.
This is not a new failure. It is the same asymmetry that has embarrassed every detection system we have ever built — DNA, radar, fingerprints, spam filters. The mathematics is rarely the weak point. The weak point is what people conclude from the output, and how quickly a probabilistic instrument becomes, in institutional hands, a verdict.
The consequences are not hard to foresee, which is what makes them depressing. A university disciplinary panel. An employment tribunal. A moderation queue at three in the morning with four hundred items in it. A court. Somebody reaches for a detector and receives a binary, and the nuance — absence is not evidence of human authorship — is precisely the sort that erodes under workload, procedure, and the entirely human wish for a clean answer.
Two failure modes follow, pointing in opposite directions.
Over-trust in presence: a mark survives into a context where it is read as proof of authorship, when all it ever asserted was that one participant in a processing chain signed something. The person who used a model to translate their own work, or to catch the spelling their dyslexia hides from them, finds it reclassified by a piece of metadata that never made the claim now being read into it. Note who that catches first. Not the person outsourcing their thinking — they have every incentive to strip the mark and the means to do it. It catches the person using assistance openly, for the ordinary reason that it helps, and who never thought to hide anything because they had nothing to hide.
Over-trust in absence: a student, a journalist, a defendant is treated as the author because nothing was detected — when the passage was merely short, or translated, or edited, or produced by a model outside the scheme entirely.
The first harms whoever is wrongly attributed. The second harms whoever is wrongly cleared, and everyone whose honest work is weighed against a false clearance. Neither is a failure of the watermark. Both are failures of inference about the watermark — and no improvement in marking robustness, however clever, touches either.
There is a fair objection to all this, and the argument is stronger for meeting it. A reader does have some legitimate interest in knowing how a thing was made. Somebody publishing a thousand words they never read is doing something to their audience, and the audience is entitled to mind. The objection is not illegitimate — it is simply not what a binary mark delivers. A mark cannot distinguish an essay argued into shape over a week and then spellchecked from a prompt fired off and posted unread. It reports that a machine was present. It cannot report what the machine did, or what the human did around it, and the exemption the Commission carefully drafted to capture that distinction is precisely the one the architecture cannot honour. The complaint is not that readers want to know. It is that the mark answers a question nobody asked while appearing to answer the one they did. What that reader is owed is a different artefact entirely, which is why this edition carries one — How This Was Made, further down.
Which brings us back to that third date.
2 February 2027 matters more than the marking deadlines, and for an uncomfortable reason. A mark nobody can read cannot be misread. It also cannot be relied upon, which is why the present situation is merely useless rather than dangerous. The moment detectors become widely available is the moment the asymmetry acquires teeth — because that is the moment institutions start acting on results.
The window between now and then is exactly when we ought to be settling what a negative result means, before anybody’s job or degree or liberty depends on the answer. There is, as far as I can see, almost no sign of that conversation happening. We are building the detector and postponing the epistemology, which is the wrong order.
Worse than nothing?
Which raises the uncomfortable possibility that a cryptographic mark could leave us worse off than no mark at all. I think that is true, but only conditionally, and the condition is the whole argument.
Consider what it displaces. Without watermarking, institutions reach for commercial AI detectors, which are unreliable and known to be — they work by spotting phrasing tells, they produce false accusations, and crucially everybody understands them to be contestable. Their flimsiness is their own limiting principle. A student can argue with a hunch.
A keyed watermark changes the character of the evidence, not merely its accuracy. It arrives with a signature, a probability, and a vendor behind it. It looks like DNA rather than like a hunch. And evidence that looks rigorous is far harder to argue with than evidence that looks flimsy — regardless of whether the rigour extends to the inference being drawn from it. Here it does not. The false-negative profile is dreadful: short passages, exemptions, light editing, one-prompt evasion, open-weight models entirely outside the scheme. What reliability the mark has is concentrated almost precisely on the people who were never hiding anything.
That is the danger, stated properly. A weak signal wearing the costume of a strong one is worse than no signal, because the costume defeats scrutiny.
But the case for the defence is real and should be met rather than talked past. Anthropic’s stated semantics are unusually modest — the detector answers only how likely is it that Claude was involved; it explicitly cannot confirm that text was human-written; it cannot distinguish writing from heavy editing. Those are honest limits, more honest than any commercial detector advertises. If they travel intact alongside every result, a keyed mark is a genuine improvement on the status quo, and may displace worse tools.
So the question is not whether the technology is dangerous. It is whether caveats survive transmission. A probability becomes a finding; a finding becomes a fact; a fact becomes a decision — and each step sheds qualification, because qualification is what institutions strip in order to act. The evidence on this is not encouraging. It is the same erosion that turned fingerprint comparison into certainty and bite-mark analysis into testimony, in both cases for decades after the underlying science stopped supporting it.
And note what this rules out as a remedy. “Make the watermark more robust” is the instinctive answer, and it addresses none of it. Robustness helps a mark survive editing. It does nothing about the exemptions, the short passages, the open-weight models outside the scheme, or the rewrite that costs one prompt. You would end up with a mark that holds better while its false-negative profile stays structurally unchanged — a stronger costume on the same body.
Which is why the caveats need to be published, loudly, before the detector is, and why shipping the detection API without a false-positive study on human-written and lightly-edited text would be the single worst available sequencing.
A mark that barely holds is a very dangerous one indeed. Uselessness would be harmless; it is the partial reliability that does the damage, because partial reliability is indistinguishable from full reliability at the moment somebody acts on it.
So: good idea or bad idea?
“Is watermarking a good idea” is four questions wearing one coat, and collapsing them is why most commentary on this is unsatisfying. Separated, they get different answers.
The mechanism: good
Non-distortion is a genuine mathematical guarantee rather than a marketing claim. Detection without model access is elegant and cheap. Latency overhead of 0.57%, no additional tokens, validated across roughly 20 million live responses. The designers anticipated repetition artefacts and handled them. They published the algorithm, the code and the limitations.
Judged as engineering, this is the strongest result in its field, and almost none of the criticism in this essay touches it.
The mandate: defensible, and genuinely contested
For: most AI content is not laundered by an adversary — it is simply posted. A default that survives copy-paste shifts the baseline from nothing knowable to something checkable, and moves stripping from accidental to deliberate. This is the same modest logic as SPF and DKIM in email, which likewise do not stop a determined attacker and are worth having anyway.
Against: it imposes real costs on identifiable individuals to purchase a diffuse and unmeasured benefit — and those costs land on the compliant rather than the evasive. That is an unattractive shape for a regulation.
This is a values question about how much friction is worth how much transparency, and it is not one a technical investigation can settle.
The sequencing: bad
Marking shipped in August. Detection arrives later. Interpretation guidance does not exist. That is backwards.
The period in which nobody can read the mark is precisely the period in which norms about reading it ought to be established. It is being spent instead on marking more things. Shipping a detection API without a published false-positive study on human-written and heavily-edited text would be a serious error — and it is the one element of this picture that is both plainly wrong and plainly fixable.
The reception: unmanaged, and decisive
This is where the risk actually lives, and where the counterfactual matters more than it first appears.
The alternative to watermarking is not a clean world. It is commercial AI classifiers — and the SynthID-Text paper itself cites the relevant finding: GPT detectors are biased against non-native English writers. Those tools are already deployed in institutions, already producing false accusations, and already doing so along a demographic axis.
A keyed detector with a known and published false-positive rate is categorically better than a classifier with a hidden and discriminatory one. So the question is not whether watermarking is imperfect. It is whether it displaces those tools or merely supplements them.
- Displacement would be a substantial gain, particularly for the people currently most harmed.
- Supplementation — institutions running both, treating either positive as damning — is a net loss, adding a failure mode without retiring one.
Nothing in the current rollout makes displacement more likely than supplementation. That is the omission that matters.
Verdict
**Good mechanism. Defensible mandate. Bad sequencing. Unmanaged reception risk that will decide whether the whole thing helps or harms.**
It is not a bad idea. It is a good idea being deployed in an order that maximises the chance of it doing damage, while the single intervention that would prevent that — publishing interpretation guidance and false-positive data before the detector — appears to be on nobody’s roadmap.
What would move this toward “good idea, well executed”: a published false-positive study on human-written and heavily-edited text; guidance stating plainly that absence proves nothing; and evidence that institutions are retiring classifier-based tools rather than stacking watermark detection on top of them.
What would move it toward “bad idea”: the first documented case of a watermark result treated as authorship evidence in a disciplinary or legal proceeding. That is the failure mode, and it should be expected within a year of the API shipping.
The instinct that this is dangerous is sound. But it is dangerous in the way a good instrument used badly is dangerous — which is a different problem from a bad instrument, and it has a different fix.
Conclusions
-
The mechanism is now published, and it is SynthID-Text. It changes the source of randomness in low-stakes word choices rather than adding anything to the text. No hidden characters, no extra tokens, no identifying information. A detection API is announced but not yet available.
-
The evidence does not support a crude, readable, post-generation substitution layer. Three documents and three weeks of history showed a stable voice and no substitution signature.
-
Recognisable stylistic tics are not the watermark. Detectable style is style. The mark, if it’s there, is by design not the thing you noticed.
-
C2PA is independently testable today; no claim was found on the SVG tested here. One file, one path, one date. Not a verdict.
-
2 August 2026 is a regulatory date, not a model boundary. Before-and-after comparison proves nothing without knowing the model underneath — an error made here and corrected.
-
What Anthropic marks and what the EU requires are not the same set. Source code is explicitly excluded from Article 50(2). Anthropic appears to mark it anyway.
-
The standard-editing exemption is reachable, but by accident rather than design. The watermark can only live in free choices, and polish contains few — so a light edit may carry no detectable mark. Law and mechanism happen to align. Nobody specified that alignment, nobody guarantees it, and without a detector no author can confirm which side of it their document fell on.
-
Where the law and the mechanism diverge, translation is the clearest case. The Commission exempted AI translation as standard editing in July. Anthropic watermarks translations fully, because every word is Claude’s.
-
Evasion costs one prompt, which inverts what a mark implies. A full rewrite through a second model removes it — though if that model is also a signatory, it applies its own. Genuinely unmarked output needs a non-signatory or open-weight model. Carrying a mark therefore indicates openness rather than concealment.
-
The greatest risk is evidential asymmetry. Presence may become persuasive; absence proves almost nothing; institutions will forget the second half.
-
A cryptographic mark may be worse than none — conditionally. It replaces contestable evidence with evidence that looks rigorous, while its false-negative profile stays dreadful. Anthropic’s stated limits are honest; the danger is that caveats do not survive transmission into institutional use. Publishing the detection API before a false-positive study would be the worst available sequencing.
-
Obligations do not transfer downstream. The Article 50(2) duty rests with the provider of the AI system, not the upstream model provider. Building on Claude does not discharge it.
-
The verdict is not “bad idea” but “wrong order”. Good mechanism, defensible mandate, bad sequencing, unmanaged reception. Whether this helps or harms turns on a single unaddressed question: does watermark detection displace biased commercial classifiers, or merely stack on top of them?
Reproducing This
# install
brew install c2patool
# inspect a generated file
c2patool output.svg --detailed
# durability — which of your pipeline steps shreds the manifest?
cp output.svg copy.svg && c2patool copy.svg
rsvg-convert output.svg -o output.png && c2patool output.pngThe sharper test: generate a file with a model launched on or after 2 August 2026, through Claude Code or the API where the model string is yours to choose, and run the same commands. That is the one configuration that could plausibly produce a manifest today.
For text there is no equivalent test yet. Anthropic has announced a watermark detection API, with implementation details still being worked out, and its own drop-a-file checker for C2PA credentials. Under the Code of Practice, cross-provider detection interoperability is due by 2 February 2027.
Note also how cheap detection is. Scoring requires only the tokenised text, the key and the seed generator — no access to the model at all. That is what makes deployment at institutional scale trivial once a key holder offers the service, and it is why the interpretation question becomes urgent the moment the API ships rather than gradually thereafter.
Note what the detector will and will not answer. Using the key, one can ask only: what is the likelihood this was partly written by Claude? It cannot confirm text was human-written. It cannot identify a different model’s output, watermarked or not. And it cannot distinguish “Claude wrote this” from “Claude heavily edited this.”
When that API opens, a harness for it goes into the kit below, so that the claims in this section can be tested rather than taken on my word — which is, after all, the entire complaint this essay has been making.
The Experiment, Turned On Itself
An article that spends four parts complaining that nobody can inspect the marks has exactly one honest way to end: by marking itself, with tools you can inspect. So this page carries three marks — all voluntary, all verifiable, and all of them, together with the tooling that made them, in a kit that arrives by email alongside the PDF edition. The wall at the end of this essay collects the toll; the toll is your email address, and I am at least charging it in the open.
One. The text you are reading is watermarked, right now. The published source of this article carries the payload jj:invisible-ink:2026-08-12 — encoded as zero-width characters and tucked into paragraph breaks by a fifty-line Python script. The payload has not changed across the 17 August amendment — it identifies the article, not the edition, so the two editions share a payload and differ only in signature. There are 116 copies of it woven through the source, of which 115 survive into the page you are reading — the marking script, the markdown parser, the static-site generator and the minifier carried them through without noticing. The single casualty is instructive, and I have left it dead rather than tidy it away: one marker was appended to a markdown table, and the table parser discards anything sitting after the final pipe. A mark that survives four processing stages can still be eaten by a formatting convention nobody was thinking about. Everywhere else, select-all, copy, paste into a file, and it travels with you:
curl -s https://justinjames.agencie.io/journal/the-invisible-ink-problem/ \
| ./mark-text.py read /dev/stdinAnd removing it is one command — ./mark-text.py strip — which is not a bug in my tool but the entire thesis wearing a smaller coat. A text mark survives the honest path and evaporates on the dishonest one. Mine is merely honest about it.
Two. The title image is signed. The SVG at the top of this page is the very file from Part 3 — the one that arrived from a Claude session carrying no claim at all. The copy published here now carries a C2PA manifest that I signed myself, with my own key, chained to a one-man certificate authority whose trust list has a population of exactly one. The manifest records what actually happened to this article, step by step: human conceived and structured it, a model assisted with research and drafting, the human rewrote and rejected, the model ran an assistive spelling pass — I am dyslexic, and that pass is recorded in the manifest with its own IPTC vocabulary term — and the human signed off on every claim. Run the verifier three ways and you get the whole argument of this article compressed into three results:
c2patool claude-output.svg → Error: No claim found
c2patool claude-output-signed.svg → validation_state: Valid
(signingCredential.untrusted)
c2patool claude-output-signed.svg trust \
--trust_anchors ca.pem → validation_state: TrustedThe middle line is the one worth framing. Valid but untrusted is not a failure state — it is the system saying, correctly, that the mathematics has done its part and the judgement is now yours. Supply my certificate as an anchor and the verdict becomes Trusted; but nothing about the file changed between those two readings. Only your decision did.
Three. The markdown is signed from the outside. Plain text has no container for a manifest — there is, as Part 1 put it, no shelf to leave it on — so the article’s source ships with a detached signature instead:
openssl dgst -sha256 -verify signer.pub.pem \
-signature the-invisible-ink-problem.md.sig the-invisible-ink-problem.mdThere is a moral in the contrast, incidentally, and it is not flattering to my method. Anthropic’s mark adds nothing to the text and survives copy-paste; mine adds invisible characters and dies to a single command. Theirs is the better engineering by a distance. Mine has the one property theirs lacks: you can read it yourself, today, with a fifty-line script and no permission from anybody. That is the whole trade, and it is worth being honest that it is a trade.
Everything above is reproducible from the kit — the marking script, the signing and verification scripts, the manifest, the trust-anchor certificate, both SVGs, the provenance statement below as its own file, and the watermarked, signed source of the article you are reading. Request the PDF from the wall below and both arrive in the same email; the zero-width marks ride along into the PDF edition too.
Mark your own work. Sign your own work. It takes an afternoon, it costs nothing beyond the email address you were about to spend anyway, and it teaches you more about what these systems can and cannot promise than any amount of reading — this article included.
Method and Corrections
Revised after review, then again after the vendor answered. Four substantive changes, recorded rather than quietly absorbed:
- A semantic-preservation argument was withdrawn. The claim that meaning-preservation rules out lexical carriers was invalid — token-biasing schemes change wording while preserving meaning, which is rather the trick of them.
- The history test was demoted. Originally billed as the strongest evidence; it is confounded by the absence of any model change at the regulatory date.
- Mechanism attribution was softened, then confirmed. The first draft asserted a green/red-list scheme as though identified. That was reduced to “one plausible family” — correctly, since Anthropic had disclosed nothing. Their 14 August explainer then confirmed a SynthID-Text variant. The hedge was right at the time it was made, which is the only sense in which a hedge can be right.
- The central criticism was substantially demolished by the vendor, two days after testing. This investigation argued that model-level marking could not reach the standard-editing exemption because it cannot see the workflow. Anthropic’s 14 August explainer shows the mark attaches only to words Claude chooses, so a proofreading pass leaves almost nothing to mark. The argument survives only in a much weaker form: the alignment is emergent, unguaranteed, and unverifiable without a detector. It is recorded here in full, along with what replaced it, because an essay that quietly deleted its best argument on being proved wrong would not deserve the trust its method is meant to earn.
An earlier claim that no C2PA verifier existed was corrected mid-investigation, which was embarrassing at the time and useful now.
The wrong turns are kept deliberately. An article reporting only its conclusions would be a worse guide for anyone re-running this — and a slightly dishonest one, given that its credibility rests entirely on having reported a negative result in the first place.
Amendment history. Published 12 August 2026. Amended 17 August 2026: the mechanism disclosure of 14 August folded in throughout, the four changes above recorded, the provenance statement below added, and the page re-marked and re-signed on the day of amendment. Nothing was removed; the superseded arguments are still in the text, marked as superseded.
How This Was Made
A voluntary provenance statement for this essay — the sort of thing a mark cannot carry.
This section exists because everything above argues that a binary mark cannot report what actually happened during authorship. Rather than assert that, it seemed better to demonstrate it — by publishing the account a mark cannot carry. It ships in the kit as PROVENANCE.md, signed alongside the article, so it travels with the artefact rather than living only on this page.
The process. The subject, the argument and the conclusions are mine. So were the wrong turns.
The work ran roughly as follows. A suspicion, examined. Research, much of it delegated — locating primary legal sources, fetching the Nature paper, pulling out the passages that mattered. Testing, with real commands producing real results, including the negative one that made the essay worth writing. Drafting, in both directions: passages I wrote, passages drafted against my direction that I then rewrote or discarded. Editorial review, twice, which demolished two arguments I was attached to. A final pass for spelling and grammar, because I am dyslexic and a machine that catches what my eyes slide over is not a shortcut so much as a pair of glasses. Then proofreading, further amendments, and a last tidy.
Every substantive claim was checked against a primary source. Every conclusion is one I hold. Four positions were reversed during the work, three of them mine, and all four are recorded above rather than quietly removed.
What a mark would say about this. If this document were assessed under Article 50, the honest answer is some marking, probably weak, and unmeasurable by anyone without the key — the mechanism attaches only where the model has free choice among equally good words, and a document dense with cited figures, legal dates, technical parameters and code has comparatively little of that. Much of it would in any case fall inside the standard-editing exemption the Commission drafted in July.
But that is not really the point, and it would be dishonest to hide behind it.
Suppose a mark were found. It would be accurate: a machine was involved, repeatedly and substantially. And it would still be misleading, because what it reports is presence, not authorship. It cannot distinguish an essay argued into shape over many hours from a prompt fired off and posted unread. It flattens a distinction that took the entire work to earn. That is this essay’s argument, and this section is the case in point.
What this statement claims:
- The judgement about what was worth saying is mine.
- The decision about which arguments survived contact with the evidence is mine.
- The responsibility for every claim in the published text is mine.
- AI assistance was used throughout, openly, and is described above.
What it does not claim. This is a self-signed, voluntary assertion. It is not issued by, endorsed by, or verifiable against any trust list. The signature on it proves only that the file has not changed since it was signed — nothing more. Whether the author’s account is worth anything is a judgement for the reader, not a property of the cryptography.
Anyone could write a statement like this and claim a rigorous process. That is precisely the limitation, and stating it is part of the point: a provenance statement that concedes its own limits is more credible than one that does not.
Why bother. Because the alternative is silence, and silence is what a misread mark fills.
The people most exposed by content marking are not those hiding anything — evasion costs a single prompt, and anyone motivated has open-weight models available. The exposed are those using assistance openly, for ordinary reasons, who never thought to conceal anything because there was nothing to conceal.
This essay argues that marking belongs at the layer that can see the workflow. For a hand-authored document, that layer is the author. So here is the record, published in advance, so that it exists before anyone needs it rather than after.
Coda
We tend to imagine transparency as a property of technology: build the right mechanism, and the truth becomes visible.
It isn’t, and it doesn’t. Transparency is a property of institutions, and of the evidence they are prepared to accept. The watermarking systems now being deployed solve a technical problem, and solve it with real ingenuity. They do not solve the human one, which is deciding what ought to follow from finding a mark — and, far more importantly, from not finding one.
Until detectors are public and their limits are widely understood, certainty remains the one thing no watermark can provide.
Sources
- Anthropic, How Claude’s text watermark works (14 August 2026) — https://www.anthropic.com/news/claude-text-watermark
- Anthropic support documentation on marking AI-generated content — https://support.claude.com
- Dathathri et al., Scalable watermarking for identifying large language model outputs (SynthID-Text), Nature, 2024 — https://www.nature.com/articles/s41586-024-08025-4
- European Commission, Article 50 transparency FAQ — https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
- Final Commission Guidelines on Article 50 (20 July 2026); Code of Practice on Transparency of AI-Generated Content (10 June 2026)
- Bird & Bird, on the draft and final Article 50 Guidelines — https://www.twobirds.com
- Reed Smith, on the expanded content exclusions — https://www.reedsmith.com
- Liang, W. et al., GPT detectors are biased against non-native English writers, Patterns 4, 100779 (2023) — https://doi.org/10.1016/j.patter.2023.100779
- Zhang, H. et al., Watermarks in the sand: impossibility of strong watermarking for language models, ICML 2024
- C2PA standard and Content Credentials — https://c2pa.org
c2patool, maintained by Adobe’s Content Authenticity team — https://github.com/contentauth/c2patool- Official C2PA verifier — https://verify.contentauthenticity.org
Testing performed 11–12 August 2026 on macOS with c2patool 0.27.10. Amended 17 August 2026 following Anthropic’s mechanism disclosure of 14 August; the page was re-marked and re-signed on that date. Legal position current as of 17 August 2026; the Commission’s Guidelines are non-binding, and only the CJEU can deliver an authoritative interpretation.