In partnership with
A text watermark can only live where several words are roughly equally likely.
Everywhere else the model has no real choice, and forcing its hand would wreck the sentence.
That constraint is the whole reason the mechanism works, and it's also the only thing you need to know to undo it.
I'll come back to it at the end.
Domain Names + Web and Email Hosting Done Right
Tired of overpaying GoDaddy or Namecheap? There's a smarter option with Porkbun!
Porkbun is the domain registrar trusted by creators, developers, entrepreneurs, and anyone who wants low prices without the nonsense or the forced upsells.
Here's why so many people are making the move to the Bun:
• Most domains sold at cost
• Low, transparent registration and renewal pricing
• Free features like WHOIS privacy and SSL certificates
• Powerful web and email hosting options
• Real human support 24/7, 365 days a year
• Named the #1 domain registrar by Forbes Advisor and USA Today
Whether you're launching a business, building a personal brand, starting a side project, or creating your very first website, Porkbun makes the whole thing easy.
This week
Anthropic shipped a statistical watermark on Claude's output.
No invisible character, no hidden tag: a quiet bias in which tokens get picked during generation, invisible to the eye, detectable if you hold the key.
The family of attacks that neutralizes it (SIRA, BIRA, RLCracker) has been published for eighteen months, at NDSS, ICML and ACL, building on the 2023 founding paper.
The research that breaks the mechanism landed before the product did.
Instead of commenting on it, I spent the weekend writing it.
Sixty lines of TypeScript, zero dependencies, zero API calls: a toy vocabulary of eight words and their synonyms, a deterministic hash that decides which words count as "green" at each position, a generator that prefers green whenever it has a choice, and a detector that counts greens and computes a z-score.
On my test text, 21 high-entropy positions: the neutral text scores z=-0.65, the watermarked text scores z=+2.84, comfortably past any detection threshold.
Then I added seven more lines that redraw each synonym at random, no model, no clever rewriting, just dumb substitution.
The z-score drops to 0.22, statistically indistinguishable from text that was never marked, and the meaning of the sentence doesn't move.
The verdict fits in one line: the watermark identifies text nobody tried to launder.
That's worth something, but it isn't a foundation for policy.
Your decision this week, if you publish content or filter it: don't build an editorial rule, a client process, or a commercial promise on top of "we detect AI."
You'll detect the honest people.
Do this tomorrow morning, twenty minutes: write the detector before you write the remover.
Take a page you just published and count the positions where you could have used a different word without changing the meaning.
In my 60-word test, there were 21 of them, a third of the text, and that's exactly the surface a watermark can live on.
After that you'll know, without taking anyone's word for it, how much hidden information fits in a page.
In the news
Anthropic turned on a watermark for Claude's output, including on text you then edit by hand, with no separate consent step.
The method builds on the token-biasing scheme published in 2023, whose robustness has been contested in the literature ever since.
This week on the blog
- Anthropic Just Shipped a Text Watermark. The Research That Breaks It Already Existed.: the mechanism, the three attacks, and why the timeline is the real problem.
- AI Labs Encrypted Their Models' Thoughts. Weaker Models Can Read Them Anyway.: same lesson, different layer: hiding isn't protecting.
- I Switched Databases Twice in 10 Days. The Engine Was Never the Problem.: two migrations to discover I was fixing the wrong part.
Revenue Stack: August 2026
What kept this weekend down to one afternoon wasn't technical: it was writing the smallest thing that proves or breaks the claim, instead of reading ten takes on it.
Sixty lines settled a question people have been arguing about all week.
The book covers exactly that framing reflex, before you point an agent at anything.
When a tool claims it detects AI, what do you do?
Phil
PS: reply and tell me the last thing you took on faith because you never spent the afternoon writing it yourself.
Back to that constraint from the top.
The watermark only survives in positions where several words are equally good, because that's the only place you can bias the draw without damaging the sentence.
Those are also the first positions any paraphrase replaces, including a stupid paraphrase that picks at random.
The mechanism and its breaking point are the same property seen from two sides: this isn't a bug some patch is going to close.
You're receiving this because you signed up at rentierdigital.beehiiv.com.