Anthropic announced this month that Claude will start hiding a watermark in everything it writes. New models carry it from the second of August. It runs worldwide, not just in Europe, though Europe is what caused it.
I am not going to explain how it works. Matthew Purcell has already done that, properly, by deduction from public documents, and his piece is better than the one I would have written. The short version is that the model quietly tilts its own word choices in a pattern you cannot see and only a key holder can read.
Everyone is arguing about whether it will work.
Wrong argument. My trade settled this in 1935 and the answer was not the one anybody wanted.
An appellation for sentences
That is what this is. Not a security feature. An appellation.
France built the appellation system because people were putting famous names on ordinary wine and the famous names were starting to mean nothing. A regulator drew lines on a map and said: this word means this place, farmed this way, or you do not get to use it.
Ninety years later the same regulatory culture looked at a paragraph and had the identical instinct. Draw a boundary. Mark the inside. Protect the word.
I find the symmetry funny and I do not think it is a coincidence. Europe has exactly one move for a category losing its meaning, and it has now run that move on Burgundy and on sentences.
Who the label was actually for
Here is the part that gets left out of the nice version of this story, and it is the reason I do not find any of this reassuring.
The appellation system was not built to protect the person drinking the wine.
It was built by producers, for producers, to defend the commercial value of names they owned. Fraud was diluting those names and the money attached to them. The drinker benefited, sometimes, incidentally. But nobody drew those boundaries out of concern for a man in Lyon who might get a disappointing bottle. They drew them because the word Champagne was worth defending and somebody had to own the defending.
Provenance systems protect the value of the marked name. That is what they are for. Everything else is downstream.
So when a model provider marks its output, I do not primarily read consumer protection. I read a company establishing that its name means something specific, and building the instrument that decides who gets to say so. The law required it, the company complied faster and wider than the law demanded, and the result is that Anthropic now owns a cryptographic key that answers a question about your writing.
I am not accusing anyone of bad faith. Doing this is more responsible than not doing it. But it is worth being clear-eyed about the shape of the thing, because my trade spent a century learning that whoever certifies has the power, and that power gets used well most of the time and badly the rest of the time, and the arguments never end.
The forger's labels were perfect
The most accomplished wine counterfeiter of the modern era was not caught by his labels.
His labels were flawless. Right paper, right ink, right corks, right capsules, right wax. Experts held those bottles and saw nothing wrong, because there was nothing wrong to see.
He was caught because he sold a domaine and vintage combination that never existed. The wine had not been made that year. No amount of craft survives a fact.
The mark was perfect and the mark was worthless, because a mark on an object is not provenance. Provenance is a chain of hands. The label is one link, and it is the link most easily faked, which is why the trade stopped treating it as the answer somewhere around the time it lost a fortune treating it as the answer.
A watermark is a label. A very good one. It is still a label.
Whose hands, whose wine
Now the detail I have not stopped turning over, which Purcell caught and which almost nobody is discussing.
The watermark is applied at the model level. It does not know why it was called.
Ask it to fix the commas in a paragraph you wrote yourself, and your paragraph now carries the mark. Your idea. Your sentence. Your argument that you had in the shower. Somebody else's fingerprint on it, permanently, because a machine cleaned up your punctuation.
We have this argument in wine and it has been running for thirty years. When a consultant advises a domaine on the blend, and the same few consultants advise hundreds of estates across a dozen countries, whose wine is in the bottle? The fruit is yours. The land is yours. The vintage happened to you. The decisions might belong to a man who flew in for two days.
No appellation law has ever required anyone to put that on the label. We argued, we mostly agreed it matters, and we still do not disclose it.
So the machine version arrives with the asymmetry backwards. The commas get marked. The essay a person wrote alone, after reading four things a machine wrote, carries nothing at all.
One kind of influence leaves a fingerprint. The other kind, the kind that actually changes what people think, leaves no trace whatsoever.
We are building forensics for the typing at the exact moment the typing stopped being the interesting part.
I have been authenticated before
This is where I should admit why I care more than I probably should.
I have spent my working life being certified. Two diplomas, both of them hard, both of them expensive in the ways that do not appear on the invoice. Blind flights. Theory papers. Rooms where a stranger decides whether you are what you say you are.
I am glad I did them. They mark me. They open doors and they are the reason certain people take my call.
They also never once tested the thing I actually do for a living.
No exam has ever asked me to look at a four top and know that the man who ordered confidently is guessing, that his guest is the one who actually cares, and that the right move is to sell down and let him look generous. Nobody graded me on knowing when to say nothing. There is no certificate for the night I poured something objectively brilliant for a table that needed something honest and cheap, and watched a good evening go slightly cold because I was admiring my own conviction instead of reading the room.
The wine was right. I was wrong. Those are not the same sentence, and the diploma on my wall has nothing to say about the difference.
That is what a mark does. It certifies the thing that can be tested. Then everybody starts believing the tested thing is the thing that matters, because it is the part with a number attached, and the part with a number attached always wins the argument. Counting is not choosing. It never was.
The part no exam has ever tested
I taste and spit now. I have not had a drink in over a year, which means I do the job on memory, structure and discipline rather than on pleasure, and I am better at it than I was when I drank.
There is no mark for that either. No watermark, no certificate, no provenance document. You would have to actually watch me work, or trust somebody who has.
A watermark can tell you a machine's hands were on the words. It cannot tell you whether anyone thought. It cannot tell you if the argument holds, if the writer understood what they were saying, if a single decision in the piece was made by a person who would defend it.
We are about to spend enormous effort answering who typed.
Nobody is building the instrument for who decided, because there is not one, because judgment does not leave residue. It shows up as a thing that worked, in a room, on a night, and then it is gone.
That is the whole job. It was always the whole job.
Typing was always the cheap part.