Eliza Ward: Hey. Good to be here.
Brian Reed: Yeah, likewise — did you see the Anthropic thing this morning?
Eliza Ward: That's exactly where I want to start. August 2nd — Anthropic turned on machine-readable watermarks across all Claude models. Every output. Not a pilot.
Brian Reed: Wait — all Claude? Like, globally?
Eliza Ward: Globally. Claude Platform API, AWS, Google Cloud, Microsoft Foundry — all of it. US users, international users, everyone.
Brian Reed: So — hang on — the EU AI Act's Article 50 has no enforcement outside the EU. And Anthropic just... applied it everywhere anyway. That's the part that doesn't sit still for me. They could have geofenced this.
Eliza Ward: Right, and that's the choice worth examining. But the user response is already — actually, I want to name this concretely — Erick Erickson, radio host, went on X and said his proofreading use of Claude would now be watermarked. That's the face of the backlash right now.
Brian Reed: Proofreading. So the question he's really asking is — does contact with Claude, even light editing, now look the same as Claude wrote the whole thing?
Eliza Ward: That's the exact question — and the answer is built into how the watermark actually works. It's not a stamp they put on top. It changes which words get picked in the first place. Like — imagine every time the model faces a coin-flip between two synonyms that mean the same thing, it consistently picks the same side. You can't see the preference. But if you know the pattern, you can detect it.
Brian Reed: So it's woven into the choices, not added after.
Eliza Ward: Exactly. And that's why light editing doesn't kill it — you'd have to rewrite enough of the text that you've basically replaced the pattern. But here's where Anthropic's own language gets uncomfortable: a detected watermark means the content — quote — 'may have been processed by Claude.' Not authored. *Processed.*
Brian Reed: Wait — 'may have processed.' So Erick Erickson runs his own draft through Claude to fix a comma, and detection flags it the same way as if Claude wrote the whole piece?
Eliza Ward: Per the signal, yes. And the other end is just as loose — no watermark doesn't mean a human wrote it. Older Claude models, very short outputs, heavily edited text — none of those are reliably marked. So absence proves nothing either.
Brian Reed: Both ends of the signal are ambiguous. So what are institutions actually catching when they run detection?
Eliza Ward: Right now? Nothing — because the detection tools aren't out yet. Anthropic announced they're coming for users and third parties, but as of the sources we have, they haven't shipped. The signal exists in every Claude output since August 2nd. The reader doesn't.
Brian Reed: And — wait, there's a separate layer here that I don't think most people clock. For file outputs — images, SVGs — Anthropic is using C2PA, which is a different thing entirely. Signed metadata that travels with the file and records its origin. That one's actually tamper-evident in a cryptographic sense.
Eliza Ward: Yeah, that's the part that caught me. Text watermarking is probabilistic — you're reading a statistical tendency. C2PA on a file is verifiable. Those are doing really different jobs and most of the conversation is collapsing them into one.
Brian Reed: The collapsing is actually where the wrong take lives, I think. Because the story going around is — Anthropic built a cheating catcher. That's the headline. And that's not what this is.
Eliza Ward: No. That's — yeah, that's the take I want to push on directly.
Brian Reed: Because DrLancaster — CS professor, contract-cheating researcher — said the biggest risk isn't the full AI essay. It's the student who drafts her own literature review, runs it through Claude to fix comma splices, submits it. That output is watermarked. Her ideas, most of her sentences, but the watermark says Claude processed it.
Eliza Ward: And jaredrfrancis — educator — flagged the same thing from a different angle. Copy-editing a paper. Or citing earlier AI-assisted writing in a new document. Both could trigger a flag. The watermark persists through light editing. That's the mechanism. It was never designed to measure contribution level.
Brian Reed: Right — so the signal can't answer the question institutions actually want answered, which is: how much of this was the human?
Eliza Ward: It can't. And we have a track record on what happens next. Turnitin — institutions treated its similarity scores as dispositive. Ambiguous signal, conclusive institutional response. Every time. That pattern is already in motion, not theoretical.
Brian Reed: So the chilling effect isn't on cheaters. It's on the graduate student who used Claude legitimately and transparently and still can't explain that to a disciplinary committee.
Eliza Ward: That's the actual population at risk. And — wait, I want to name the compliance framing Anthropic is leaning on here. They cited the EU AI Act Transparency Code as the basis. Article 50. But satisfying Article 50 at the model level is actually a narrower thing than the accountability story this watermark is being sold as — and the deployer gap and the security brittleness underneath it, those are genuine problems.
Brian Reed: The part I don't get is how Anthropic thought the 'may have processed' language would survive contact with an actual academic misconduct panel.
Eliza Ward: It won't. Because the panel doesn't have a rubric for 'may have processed' — they have a finding of yes or no. And that's actually the narrower problem. The deeper one is that Anthropic's Help Center says explicitly — deployers who build products on Claude through the Platform API, through AWS, Google Cloud, Microsoft Foundry — they have to independently assess their own Article 50 obligations. The model watermark satisfies Anthropic's duty. Not theirs.
Brian Reed: Wait — so a company shipping a Claude-powered product might be non-compliant with Article 50 even though the underlying model is watermarked?
Eliza Ward: That's the gap. Anthropic's compliance doesn't travel downstream. And most of those deployers — I mean, there's no evidence they know the gap exists.
Brian Reed: So picture a hiring platform — runs on Claude under the hood, never tells applicants. The watermark is there in the generated feedback. But the platform's disclosure obligation? Separate. And probably unmet.
Eliza Ward: Right. And Anthropic hasn't published clear guidance on how those API customers close that gap — that's not me inferring, the sources say it directly.
Brian Reed: Okay, and then there's the security layer on top of that, which — actually, I want you to walk through that part, because the 'Watermarks in the Sand' finding is the one that makes the whole architecture feel shaky to me.
Eliza Ward: So that paper found attackers can strip the watermark without meaningfully degrading content quality. Not theoretically — under defined test conditions. And separately, researchers flagged that leaked cryptographic keys could let someone forge watermarks entirely. You're not just defeating the signal — you're weaponizing it. You could stamp a human-written document as Claude-processed.
Brian Reed: That flips it. The trust signal becomes the attack surface.
Eliza Ward: Which is why the thing to watch is whether Anthropic's forthcoming detection API ships with any guidance to deployers about their independent obligations — and whether they address key security at all. Those are the two unresolved structural questions. Not whether the watermark persists through copy-paste. Whether it means anything once the deployer gap and the forgery risk are sitting underneath it.
Brian Reed: And that's the part that doesn't resolve cleanly for me — Anthropic shipped the signal before shipping the literacy to read it. Institutions don't have the detection API yet. They don't have the guidance. But the watermark is already in every Claude output since August 2nd. That's a live gap, not a theoretical one.
Eliza Ward: Right — and the honest answer to whether this works as accountability is: we don't know yet. What would actually settle it is whether that detection API ships with explicit guidance on what 'may have processed' means in practice. Not as a legal disclaimer. As actual interpretive instruction to deployers and institutions. That's the question I'd hold open.
Brian Reed: Yeah. And if it doesn't — if the API ships clean without that guidance — I think the Turnitin pattern just runs again.
Eliza Ward: Contact equals guilt. Anthropic gets the compliance credit. The graduate student takes the penalty. That's — I mean, that's not a speculation at this point, that's the most likely path given what the sources actually show.
Brian Reed: Yeah. Still watching.
