Anthropic's Watermark, Not The AI Act, Is The Spec You Now Ship Against

Anthropic has published more detail on how its text watermarking works, and the argument about it has escalated accordingly ^[1]. Techdirt reports that Google already appears to be doing something similar with Gemini output, which means the practice is spreading across the model layer rather than sitting with one vendor ^[12].

The mechanism matters because it determines who carries the cost. Generative models pick the next token probabilistically rather than deterministically, so the same prompt yields slightly different text each run ^[5]. Vendors can deliberately bias that choice so the model is marginally more likely to select certain words ^[6]. Given a long enough passage and the key to the bias, a checker can see that enough of those small nudges line up to suggest the text came from a model carrying that watermark ^[7]. Techdirt describes the result as far from foolproof but capable of flagging text likely generated with that specific bias ^[2].

The part operators should read twice: editing the output afterwards may or may not remove the mark, depending on whether the edits change enough of the biased words ^[3]. That makes the marker state of any human-in-the-loop pipeline indeterminate by design ^[8]. You cannot tell a client, an examiner, or a compliance reviewer whether your final draft is still carrying provenance signal, because the answer depends on how much of the vocabulary your editors happened to replace.

Techdirt's central point is that Anthropic chose to comply with the law in a way that looks broader than what the law requires, for reasons the piece treats as more understandable than critics allow ^[11]. Practically, that shifts the governing spec. If the vendor's implementation is wider than the statute, then the thing constraining a downstream product is the implementation, not the legal text a compliance team read ^[9]. Reading the AI Act tells you your obligations. It does not tell you what your model provider has already stamped into your output.

The second cost is expressive range. Techdirt notes the REAL Rating site uses a one-to-five scale to distinguish degrees of AI involvement, and argues a watermark collapses all of that into a single binary question: did this use AI at all ^[10]. Any product that wants to disclose honestly and precisely, say, model-assisted editing versus model-authored prose, now discloses into a detection regime that cannot represent the difference. Techdirt's related worry is that this will be used to attack and denigrate people using the technology reasonably, who will be falsely accused of cheating ^[13].

The threat model that produced this is, by Techdirt's account, the deepfake panic. The EU rushed out its AI Act because it did not want to be slow to regulate, in the way it believes it was slow on social media ^[4]. Techdirt argues the deepfake fear has been largely overhyped, that it has not really materialised to date, and that most AI-modified content has been correctly identified as such ^[14]. The publication's conclusion is that the costs land hardest on people using the tools properly ^[15].

Watch whether other providers document watermarking breadth, and whether any of them expose the marker state to the customer instead of leaving it to be discovered downstream.