Skip to content
Simple Unmark
10 min read

The Case Against AI Text Watermarking

A summary of the strongest published objections to AI text watermarking, made by Ben Thompson at Stratechery and John Gruber at Daring Fireball after Anthropic’s August 2026 announcement.

Text watermarking encodes provenance in the model’s word choices, so critics argue it trades writing quality for a signal only the provider can read. Ben Thompson calls it philosophically wrong: it marks the tool rather than the author. John Gruber calls it an adulteration of writing. Both note that it burdens honest users, including anyone using a model to proofread, while a determined user simply rewrites.

In August 2026 Anthropic said Claude would begin watermarking the text it generates, for every user worldwide, to comply with the EU AI Act. The sharpest published objections came from Ben Thompson at Stratechery and John Gruber at Daring Fireball. This guide summarizes their arguments, and the counterarguments they take seriously, with links to the originals.

What triggered the argument

On 11 August 2026 Anthropic published a support article titled “How Claude Marks AI-Generated Content”, citing its signature on the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content. Marking would be applied at the model level, would travel with the text when it is copied and pasted, and would apply wherever Claude is offered, worldwide.

The article did not say how it worked. Days later Anthropic published a second document, “How Claude’s Text Watermark Works”, describing a SynthID-Text-style scheme: nothing is inserted into the text and there are no hidden characters. Instead the model’s token probabilities are nudged during generation so that, across enough words, the choices form a statistically detectable pattern that Anthropic can test for using a secret key.

That gap between announcement and explanation is what set off the criticism. Both writers had assumed a watermark would be something added to the text. It is not. The watermark is the wording.

The tool is not the author

Ben Thompson covered the announcement in a Stratechery Update on 12 August 2026, “Anthropic’s Watermarking, How It (Probably) Works, Worse Than It Seems”. His summary: Anthropic is adding watermarking in response to the EU’s AI law, and it is a terrible idea, first and foremost for philosophical reasons.

His first objection is to the premise. He grants the appeal — “I am sympathetic to the impetus behind watermarking: wouldn’t it be better to know what is fake and what isn’t?” — then asks what “fake” is supposed to mean: “If an LLM states a true fact, and a human a fable, does it matter that the latter doesn’t have a watermark?” Provenance and truth are different properties, and a mark can only carry the first.

His second objection is that a language model is, at least for now, a tool wielded by a person. Marking its output confuses the instrument with the author.

From this perspective, to insist on watermarking is no different than insisting that a ballpoint pen advertise itself as the author, a concept that is clearly absurd.

Ben Thompson, Stratechery, 12 August 2026

The word choices are the work

John Gruber wrote about it three times: a short post on 11 August calling the announcement infuriatingly opaque, a long essay on 16 August titled “Anthropic’s ‘Watermark’ Text Adulteration in Claude Is a Perversion of Writing”, and a follow-up on 17 August.

His argument starts from Anthropic’s own original claim that the watermark is imperceptible and “doesn’t change the meaning, quality, or readability” of the response. Gruber took that literally, which is why he first guessed the mark would be invisible Unicode characters — the only mechanism he could think of that leaves the words themselves untouched.

Once the real mechanism was published, his position hardened: no two synonyms carry exactly the same meaning. “He leaped at the chance” and “He jumped at the opportunity” express the same sentiment and are not the same sentence. If a watermark ever moves the model off its best next word, it has made the writing worse — necessarily, he argues, unless the model’s own scoring was wrong. The only open question is how much worse.

It’s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance.

John Gruber, Daring Fireball, 16 August 2026

The grey-or-overcast problem

Anthropic’s technical explanation offers a worked example. After “The weather today was cold and…” the next word is very unlikely to be “sugary” but quite likely to be “overcast” or “grey”, and under most circumstances it does not matter much to the reader which one the model picks — so the choice is settled by a random number. That number is what carries the watermark.

Gruber makes the same objection to Google DeepMind’s description of SynthID Text, which illustrates the technique with “My favorite tropical fruits are mango and…” and contrasts “bananas” with “airplanes”. The real choice, he notes, is between bananas and pineapple, and the only acceptable reason to prefer one is fit to the intended meaning and tone — not which bucket the word happened to land in on that pass.

Anthropic’s documentation concedes the point in one place. Because programming code often has to be exact, it says, code carries less watermarking than other text, with marks falling mostly in comments. Gruber’s reply is that good prose is more like code than not; the difference is that sloppy code fails visibly while the human brain quietly repairs sloppy prose.

Arguing that grey vs. overcast “doesn’t matter much to the reader” is the crux of my argument that this entire endeavor is a perverse adulteration of what it means to write — or to read.

John Gruber, Daring Fireball, 16 August 2026

A watermark only its owner can read

Both writers separate the quality question from the trust question, and Gruber says he would object even if quality were untouched. Detection depends on secret keys held by the provider. Claude cannot detect Gemini’s marks and Gemini cannot detect Claude’s, and no third party can audit either result.

The consequence he draws is that every word becomes ambiguous to the reader. If a model may have chosen a word to satisfy a hidden key, you can no longer tell whether it chose that word because it was the best one. Secrets, in his phrasing, are the poison: readers cannot know what is marked, writers cannot know whether a passage they quote carries someone else’s mark, and nobody outside the provider can check a detection claim.

A useful watermark would be one that anyone can check.

John Gruber, Daring Fireball, 17 August 2026

Honest users pay, motivated ones route around it

Thompson’s most practical objection concerns editing. The EU rules contemplate an exception for editing, but a model that marks during generation cannot distinguish a full draft from a grammar fix. He wrote that it hardly seems fair that anyone who wants to fix their grammar runs the risk of having their original content labeled as AI, and that the same frustration applies to translation. Anthropic’s documentation acknowledges the reverse problem too: a light edit may leave too little for the watermark to attach to.

Gruber’s version is about enforcement. There can be no single detector across providers, so a suspicious manager or teacher would have to test text against each vendor separately — and anyone who actually intends to deceive will use a model that does not watermark, or run the output through a paraphrasing tool.

James Padolsey, whose interactive explainer of the mechanism Gruber recommends, made the same point in “Anthropic’s Weak Watermarks Appease a Weak Law”: a blanket, model-level implementation produces a signal broad enough to implicate harmless and assistive use, yet fragile enough for a motivated person to remove through substantial recomposition. The asymmetry runs in exactly the wrong direction.

The counterarguments they take seriously

The case is not one-sided, and the responses — along with Gruber’s own hedges — are worth recording.

  • Randomness was already there. Daniel Jalkut argued that watermarking does not change the temperature of generation, only the source of the randomness generation already uses, so it need not lower quality at all. Gruber answers that he hopes this is true and thinks it possible, but considers it unlikely, and says he is open to being proven wrong.
  • The production data shows no effect. Google DeepMind’s Nature paper covers roughly 20 million watermarked and unwatermarked responses in live Gemini traffic, reporting thumbs-up and thumbs-down rates differing by 0.01 and 0.02 percentage points. Gruber’s rebuttal is that a thumbs-down button measures whether readers are annoyed enough to complain, and that a negligible difference is not an imperceptible one.
  • There is no author to protect. Dan Moren at Six Colors argued that a model cannot care which phrase is right, so its choices tell you nothing about a writer, because there is no writer. Gruber disagrees philosophically — if you can read something, he says, it was necessarily written — while conceding the disagreement is about the meaning of a word rather than the artifact.

Why this matters if you handle copied text

The critique has a practical edge for readers who never generate a word with a model. Anthropic says the mark travels with the text through copying and pasting, can persist through some editing, and applies to text the model processes as well as text it writes. Quote a marked passage in something you wrote yourself, or run your own draft through a model for proofreading, and part of your document may test positive.

That is the failure mode critics keep returning to: a probabilistic signal, checkable only by its owner, attached to the wording rather than to the file. It produces an accusation the accused cannot inspect and cannot disprove.

Simple Unmark works in this area and has an obvious interest in the argument, so the limits are worth stating plainly. Neither writer endorses passing AI text off as your own; Gruber’s complaint is the opposite, that the scheme burdens honest users while barely inconveniencing dishonest ones. Removing hidden characters and rewriting wording can reduce a statistical signal, but no tool can guarantee an outcome against a detector whose key it does not hold.

Reading the originals

Gruber’s three posts are free to read in full. Thompson’s Update is for Stratechery Plus subscribers, so the quotations above come from the public excerpt and from Business Insider’s reporting on the piece. The two also discussed the subject together on their podcast Dithering, in an episode titled “Watermarks” on 14 August 2026, which is subscriber-only and is not quoted here.

Everything above is a summary in our words. Where the argument matters to you, read the sources below directly — they include Anthropic’s own documentation and the DeepMind research the companies cite in their defence.

Sources

  • watermarking
  • commentary
  • claude