Edition history
Reading- 2Edition 2
Published content updated
- 1Edition 1
Baseline recorded from existing publication
Baseline captured from an existing publication. Earlier history has not been reconstructed.
The Calendar Catches Up · Edition 2
SHA-256: 20d5cfae9e079ff1658249e9ad72661778cc7954ab1326cb28e7d01d3d0b661e
In August 2026, Anthropic announced that Claude would begin leaving something behind.
Not a visible label. Not a line saying *written by AI*. Not metadata that disappears when someone copies a paragraph into another document.
A statistical signal inside the text itself.
The words remain ordinary. The sentences remain readable. But the choices made while generating those words can collectively carry an imperceptible watermark: a pattern designed to survive copying, pasting and at least some editing, and to allow the text to be identified later as machine-generated.
The reaction was immediate. Developers debated what this meant for privacy, authorship and code. Others wondered how the watermark could be detected. Almost inevitably, tools appeared promising to remove AI provenance signals.
It felt like the arrival of a new technical problem. It wasn't. We had been here before — and for me, rather personally.
## A problem from 2023
In 2023, at my former startup MachinaLabs, we were building *Kurz Notiert* for Basler Kantonalbank and Bank Cler.
Generative AI was very different then. ChatGPT had only been released publicly at the end of 2022. Companies were experimenting. Policies were uncertain. Search engines were adapting. Nobody really knew where the boundaries would eventually settle.
For a system producing text intended for actual publication, one question mattered to us:
**What traces does the machine leave behind?**
We were concerned that machine-generated text might be identified downstream and that this could become a problem for published content, particularly in search.
So our pipeline contained a small piece of engineering concerned with exactly that problem: generated text should not simply leave the machine and proceed directly into publication. It passed through transformation intended, among other things, to reduce characteristics by which generated text could be recognised as generated text.
It was one component among many.
A nut. A bolt.
At the time, it certainly did not feel like a product category.
Three years later, I watched the technology industry become excited about AI text watermarks and open-source tools designed to remove AI provenance signals. My first reaction was predictable: *Wait. This is new?*
The answer turns out to be neither a clean yes nor a clean no.
## The watermark was there before the LLM
The idea of hiding information inside language is much older than ChatGPT.
Researchers were studying natural-language watermarking at least as far back as 2001. Two decades later, work such as the Adversarial Watermarking Transformer explored neural approaches for tracing the provenance of generated text.
Then came large language models. And almost immediately, watermarking became part of the conversation.
In December 2022 — less than two weeks after ChatGPT's public release — Scott Aaronson, then working with OpenAI, described work on statistically watermarking the output of models such as GPT.
The basic insight was elegant. A language model does not normally decide that only one word can come next. It produces a probability distribution.
After:
> The cat sat on the...
*mat* may be probable. So might *floor*, *chair* or *sofa*.
There is freedom inside that probability distribution. A watermarking system can exploit it.
Instead of choosing among plausible tokens entirely according to the model's ordinary sampling process, the generator can subtly favour particular tokens according to a secret rule. No strange Unicode character is required. No hidden field has to accompany the document. Nothing needs to be appended to the sentence.
The watermark is distributed across the choices the model makes. One word tells you almost nothing. Hundreds of choices can form a statistical signature.
## By 2023, the arms race had already started
On 24 January 2023, John Kirchenbauer and colleagues published *A Watermark for Large Language Models*.
Their proposed system divided possible next tokens into pseudorandom sets and subtly increased the probability of tokens from one of them. Given enough generated text, a detector could determine statistically whether the pattern was unlikely to have appeared by chance. The watermark was designed to be invisible to the reader.
That already sounds familiar in 2026. What followed matters more.
Researchers did not merely invent watermarking in 2023. They immediately began trying to break it.
In March, Vinu Sankar Sadasivan and colleagues published *Can AI-Generated Text be Reliably Detected?* They tested detection systems against recursive paraphrasing — taking machine-generated text and repeatedly rewriting it — and included watermark-based detection among the systems under attack. The conclusion was uncomfortable: detection could be degraded substantially while retaining much of the quality of the original text.
By May, Miranda Christ, Sam Gunn and Or Zamir were working on something stranger still: cryptographically inspired watermarks designed to be **undetectable without possession of the secret key**.
In June, Kirchenbauer and colleagues published another study specifically investigating what happens when watermarked text is rewritten by humans, paraphrased by another language model or mixed into human-written documents.
In July, researchers at Stanford proposed distortion-free watermarks designed to survive significant perturbation.
Consider what had happened within roughly six months. The field had already progressed from **Can we mark machine-generated text?** to **Can somebody remove the mark?** to **Can the mark survive paraphrasing?** to **Can we construct a watermark whose very existence cannot be detected without the key?**
The fundamental contest that appears new in 2026 was already underway in 2023.
## What we actually knew
It would be tempting for me to say:
> We were removing AI watermarks at MachinaLabs in 2023.
That would make a wonderful story. It would also claim more than the surviving evidence currently establishes.
A deliberate watermark and an AI fingerprint are not necessarily the same thing. A deliberate watermark is intentionally inserted by the generator. A fingerprint can arise simply because machine-generated language has statistical characteristics that distinguish its distribution from human writing. Early AI detectors attempted to exploit precisely these differences. There can also be metadata, formatting artefacts and other provenance signals.
What I can say is that, in 2023, we were already treating **machine detectability as an engineering concern** in a production publishing system. Whether the upstream models we used were deliberately watermarking their output is a separate historical question, and one that should be answered from evidence rather than memory.
History becomes less useful when we improve it retrospectively.
## We were also wrong about something
Our concern was search. At the time, there was widespread anxiety that publishing AI-generated material could lead to penalties from search engines.
Google's actual public position was more nuanced. On 8 February 2023, Google published explicit guidance stating that its ranking systems were intended to reward high-quality content regardless of how it had been produced. AI itself was not the offence. Using automation primarily to manipulate search rankings was.
That means I would no longer describe what we built as a response to a known Google penalty against AI-generated text. There was no such simple rule. We were responding to **risk under uncertainty**.
That is an important difference. But it also captures something about building with generative AI in 2023 that is difficult to reconstruct now. There was no settled operating manual. The technology was moving faster than corporate policy, search policy, regulation and social convention. A production team had to make decisions before anyone could tell it which decisions would later prove necessary.
Sometimes that produced unnecessary engineering. Sometimes it produced surprisingly prescient engineering. Usually, we did not yet know which was which.
## Then the calendar moved
Google brought the idea into industrial deployment with SynthID. In 2024, Google DeepMind announced SynthID Text for Gemini. Like earlier academic approaches, it operates during generation by adjusting token probabilities to create an imperceptible statistical signal. Google subsequently released a reference implementation. The obscure research problem was becoming infrastructure.
Then regulation arrived. Article 50 of the European Union's AI Act requires providers of systems generating synthetic text, images, audio and video to ensure that their outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, as far as technically feasible.
The transparency obligations became applicable on 2 August 2026. Nine days later, Anthropic's implementation was making technology headlines. Claude would watermark generated text at model level; the mark would travel with copied text and tolerate at least some modification; Anthropic would eventually provide mechanisms for detecting it.
Suddenly the problem had users, regulation, headlines, opposition — and, naturally, watermark removers.
## The old problem becomes new
There is a recurring mistake in technology. We date an idea from the moment we notice it.
A research problem becomes a *new technology* when a major company deploys it. A technical capability becomes a *new market* when regulation makes somebody care about it. A vulnerability becomes a *new problem* when enough people encounter it simultaneously.
But invention, relevance and recognition are different events. AI text watermarking illustrates this unusually well.
Natural-language watermarking existed before modern generative AI. LLM watermarking was being publicly developed by the end of 2022. By early 2023 there were practical statistical watermarking schemes. Within months, researchers were already attacking them with paraphrasing, designing more robust alternatives and considering cryptographic constructions. In 2024, Google was deploying the idea at scale. In 2026, European law helped turn it into an industry requirement.
Nothing magical happened to the underlying idea in August 2026.
**The calendar caught up.**
## The uncomfortable lesson from MachinaLabs
MachinaLabs failed.
Our team had delivered the AI-powered Kurz Notiert financial-news platform for Basler Kantonalbank and Bank Cler. MachinaLabs ceased operations in early 2026 after we were unable to secure the financing needed to continue. The [historical work record](/work#past-work) describes the delivery and our roles.
That sentence matters.
There is a dangerous way to tell stories about failed companies in which every abandoned feature becomes evidence that the founders were secretly visionaries and the market simply failed to understand them. I don't want to tell that story.
A company does not succeed by accumulating technically interesting predictions about the future. It succeeds by turning something people need into something they will adopt, at a moment when they are prepared to adopt it. Those are very different skills.
At MachinaLabs, we built many small pieces of infrastructure because we thought they would be necessary for serious production use of generative AI. Some undoubtedly weren't. Some may have been wrong. Some may simply have been overengineered.
And then there are moments like this one. A small technical concern from a publishing pipeline in 2023 suddenly appears, three years later, as an industry conversation involving Anthropic, Google, open-source developers and European regulation.
That doesn't mean MachinaLabs should have succeeded. It means something more useful.
**Being right about the future is not the same thing as having a business in the present.**
## Technology has two clocks
I used to think being ahead was an advantage. I am less certain now.
Technology seems to run on two clocks.
The first is the engineering clock. It starts when something becomes technically possible. Researchers see it. Engineers experiment with it. A few strange companies build around it. Problems emerge and countermeasures follow.
The second is the market clock. It starts when enough people understand why they should care. Sometimes years separate the two.
Capital must survive those years. Teams must survive them. Founders must survive them. And the product must somehow survive long enough for the language surrounding it to become obvious.
This is why marketing is not merely decoration around technology. Marketing, at its best, synchronises the two clocks. It gives a technical capability a comprehensible problem. It gives the problem a name. And it tells the market why the problem matters **now**.
Without that, being early can look remarkably similar to being wrong.
## The archaeology of failure
Perhaps this suggests a useful exercise for anyone who has built a company that failed.
Don't only perform a post-mortem. Perform an archaeology.
Go back through the repositories. Read the old architecture documents. Look at the strange utilities nobody remembers. Find the defensive code written for problems customers barely understood. Then ask:
**Which assumptions were wrong?**
**Which assumptions are still waiting?**
And most interestingly:
**Which assumptions has the world quietly caught up with?**
Not because old code necessarily deserves resurrection. Usually it doesn't. But because failed products contain information. They record what a team believed about the future at a particular moment in time. Three years later, that prediction can finally be compared with reality.
I intend to do exactly that with MachinaLabs. Not to prove that we were right. To discover where we were.
There is a difference.
And somewhere among all those forgotten nuts and bolts may be a few problems whose market clock has finally started ticking.
---
## Sources
1. **Anthropic Claude watermark rollout — The Verge, 12 August 2026**
Technical overview of Anthropic's Claude watermark announcement and how the signal is intended to travel with text.
[The Verge](https://www.theverge.com/ai-artificial-intelligence/977823/anthropic-claude-ai-watermarks-c2pa-text-images)
2. **Anthropic says it will watermark text generated by its AI models — TechCrunch, 11 August 2026**
Reporting on Anthropic's decision to watermark model-generated text.
[TechCrunch](https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/)
3. **Anthropic Claude text watermark — developer concerns — Business Insider, 14 August 2026**
Discussion of Anthropic's watermark implementation, detection and developer concerns.
[Business Insider](https://www.businessinsider.com/anthropic-claude-text-watermark-concerns-tech-community-answers-2026-8)
4. **Regulation (EU) 2024/1689 — Artificial Intelligence Act, Article 50**
Transparency obligations for providers of systems generating synthetic content, including machine-readable marking where technically feasible.
[EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
5. **European Commission — Code of Practice on Transparency of AI-Generated Content**
Supporting material on transparency of AI-generated content under the EU framework.
[European Commission](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content)
6. **EU AI Act Service Desk — Article 50**
Guidance on transparency obligations for providers and deployers of certain AI systems.
[AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50)
7. **John Kirchenbauer et al. — *A Watermark for Large Language Models*, January 2023; ICML 2023**
Foundational statistical watermarking scheme for large language models based on pseudorandom token greenlists.
[arXiv:2301.10226](https://arxiv.org/abs/2301.10226) · [ICML proceedings](https://proceedings.mlr.press/v202/kirchenbauer23a.html)
8. **Scott Aaronson / OpenAI watermarking work — December 2022**
Early public discussion of statistical watermarking for GPT-class model outputs, reported shortly after ChatGPT's release.
[TechCrunch](https://techcrunch.com/2022/12/10/openais-attempts-to-watermark-ai-text-hit-limits/)
9. **Vinu Sankar Sadasivan et al. — *Can AI-Generated Text be Reliably Detected?*, March 2023**
Attack study showing that recursive paraphrasing can substantially degrade watermark and other AI-text detection.
[arXiv:2303.11156](https://arxiv.org/abs/2303.11156)
10. **Miranda Christ, Sam Gunn & Or Zamir — *Undetectable Watermarks for Language Models*, 2023**
Cryptographically inspired watermarks designed to be undetectable without the secret key.
[arXiv:2306.09194](https://arxiv.org/abs/2306.09194)
11. **John Kirchenbauer et al. — *On the Reliability of Watermarks for Large Language Models*, June 2023**
Study of watermark survival under human rewriting, LLM paraphrasing and mixing with human-written text.
[arXiv:2306.04634](https://arxiv.org/abs/2306.04634)
12. **Rohith Kuditipudi et al. — *Robust Distortion-free Watermarks for Language Models*, July 2023**
Distortion-free watermark constructions intended to survive significant perturbation; also summarised by Stanford CRFM.
[arXiv:2307.15593](https://arxiv.org/abs/2307.15593) · [Stanford CRFM](https://crfm.stanford.edu/2023/07/30/watermarking.html)
13. **Google DeepMind — SynthID Text (2024)**
Industrial deployment of statistical text watermarking for Gemini, with a public reference implementation.
[DeepMind blog](https://deepmind.google/blog/watermarking-ai-generated-text-and-video-with-synthid/) · [SynthID](https://deepmind.google/models/synthid/) · [Reference implementation](https://github.com/google-deepmind/synthid-text)
14. **Google Search Central — guidance about AI-generated content, 8 February 2023**
Google's public position that ranking rewards helpful content regardless of production method, while penalising automation used to manipulate rankings.
[Google Search Central](https://developers.google.com/search/blog/2023/02/google-search-and-ai-content)
15. **Guillaume Meyer — *watermarks-remover***
Open-source discussion and tooling around removing AI provenance / watermark signals from text.
[GitHub](https://github.com/guillaumemeyer/watermarks-remover)