{"slug": "waiter-theres-a-watermark-in-my-slop", "title": "Waiter, there’s a watermark in my slop", "summary": "Anthropic has introduced text watermarking in its Claude LLM outputs, a move that has sparked backlash from AI enthusiasts, according to David Gerard's coverage. The watermarking, which encodes a single bit of information by over-weighting token choices, is seen as negligible in impact but raises concerns about potential future identifiers, such as citizenship or age verification, embedded in AI-generated text. Gerard suggests that if LLM output can be watermarked, it could also carry other hidden data, posing risks of infringement or plagiarism bombs.", "body_md": "David Gerard covers the new [text\nwatermarking](https://www.404media.co/anthropics-text-watermarking-proves-ai-companies-do-not-care-at-all-about-writing/) in Anthropic’s LLM output: [Anthropic\nwatermarks AI output — and the AI bros yell](https://pivot-to-ai.com/2026/08/17/anthropic-watermarks-ai-output-and-the-ai-bros-yell/).\n\nNobody who claims they can tell good writing from bad should care this much. If they’re not using the slopbot instead of doing the writing.\n\nThe watermarked text doesn’t even make it into the final writing\nproject, if the LLM was just used for assistance, with methods such as\nSeth Godin’s [AI tear\ndown](https://seths.blog/2026/08/consider-the-ai-tear-down/)). So it shouldn’t really matter. Maybe Matt Birchler is right,\nand [the\nreader’s desire to know when text is AI-generated is more important than\nthe AI user’s desire for the opposite](https://birchtree.me/blog/what-is-a-perversion-to-writing/). Maybe Dave Winer is right in\n[A rebuttal to Doc Searls’ piece about\nwatermarks](https://rss.chat/?id=538) and the risk that a watermark might be detected could\nhelp discourage people from getting a long bit of writing from the\nbot, and then pasting it into a comment thread in a GitHub repo I\nrun.\n\nThe bigger question, though, isn’t about the [negligible](https://daringfireball.net/2026/08/anthropics_watermark_text_adulteration_in_claude_is_a_perversion_of_writing)\ndifference between watermarked slop and somehow purer non-watermarked\nslop.\n\nIf LLM output can have watermarks, what else can it have?\n\n**Other identifiers.** If Anthropic can get a 1-bit\nyes/no watermark into 200 words of text, how many words does an LLM\nprovider need to encode a 32-bit identifier? That’s probably infeasible\nin the lengths of text that most people use LLMs for in practice. Maybe\nthey would be able to find the authors of all those [slop\nclone books on Amazon dot com](https://www.404media.co/a-slop-publisher-sold-a-ripoff-of-my-book-on-amazon/), but for most business writing and\narticle-length text it wouldn’t work. SynthID, described in [Scalable\nwatermarking for identifying large language model outputs](https://www.nature.com/articles/s41586-024-08025-4), encodes a\nsingle bit of information by over-weighting token choice from [one\nred list and one green list](https://hackerfactor.com/blog/index.php?/archives/1101-Mark-My-Words.html). Splitting the list into 2n\ncategories would give you more bits but require a lot more text to\nencode it.\n\nBut what about just a few more bits? Now that governments and Big Tech know that encoding information into LLM-generated text is possible, what’s next?\n\nUSA Citizen/non-citizen? This would be a obvious one for a company trying to get in good with the Federal government here.\n\nAge verification? I don’t know, they’re sticking age verification on everything now, someone will try it.\n\nMarketing-related data? [The\nhighest-earning 10% of people in the USA buy 50% of the stuff](https://www.marketplace.org/story/2025/09/17/top-10-of-earners-make-up-half-of-us-retail-spending), so\nall kind of uses for a flag to show which side of the K-shaped economy\nthe user is on.\n\n**Infringing or plagiarizing text.** The big AI\ncompanies have a pretty well-defined political program, and can identify\nlikely opponents to some or all of that program. Some of those opponents\nare consistent “AI vegans” in their own personal IT choices, but if\nsomeone is politically inconvenient *and* an AI user, well, it’s\npossible to tune the likelihood that an LLM’s output contains material\nstraight out of the training set.\n\nCould the LLM’s output contain deliberate infringement bombs or\nplagiarism bombs? Deliberately giving users some text that would get\nthem in trouble later is not the kind of thing that a human developer\nwould risk—too much risk that the commit messages would come out in\ndiscovery—but it is the kind of trick that a heavily “agentic” automated\nsoftware process would come up with. [An AI agent can\nalready hack a gym to get its owner a spot in pilates class](https://www.bbc.com/news/articles/cn0nww2qlp7o), so a\nprogram of compromising political opponents who are also users seems\nfeasible.\n\n**Marketing side effects.** Some LLMs are serving ads\nnow, which means a lot of hard-to-predict ML-driven ad placements. And\nthis stuff will be a lot weirder and more indirect than current projects\nlike the [attribution\ncartel](https://blog.zgp.org/the-advertising-cartel-coming-to-your-web-browser/), which is pretty clearly going to cause ML to come up with\nprivacy-violating ways to juice the apparent results from Big Tech\nadvertising. ML systems going for other goals are going to get a lot\nweirder. Meta’s ad ML is already [doing\npretty weird](https://www.theguardian.com/technology/2025/sep/20/parents-outraged-meta-uses-photos-schoolgirls-ads-man) (and creepy) stuff to maximize engagement, and it’s\nonly going to get weirder.\n\nWhat happens when more ad-revenue-maxing ML is in the loop in more\nplaces? What if you can sell a renter’s insurance policy to user A by\ngiving their friend, user B, some bad household tips that result in an\nexpensive bill from their landlord? Consumer-facing LLMs are run by the\nsame companies that find themselves in a [desperate\nsqueeze to keep raising ad revenue at startup-like growth rates](https://blog.zgp.org/what-if-ed-zitron-is-an-optimist/).\nCorners will be cut. Other ways will be looked. Slop advice will reflect\nthe need to achieve ambitious business goals, even at the user’s\nexpense.\n\nAnyway, the difference between watermarked slop and non-watermarked slop is tiny compared to some of the text that’s going to be in the LLM output. Enjoy.\n\n[Hundreds\nof Fake VPNs Are Flooding the Chrome Web Store](https://lifehacker.com/tech/hundreds-of-fake-vpns-are-flooding-the-chrome-web-store) by Ritoban Mukherjee.\n(Ad blockers are another category with similar problems. If you’re\nlooking for browser extensions on the browser’s extension store, you’re\ndoing it wrong. Start with a trusted IT news site.)\n\n[Representing Python paths\nusing pathlib](https://lwn.net/Articles/1088781/) by Jake Edge. (One of the ingredients in upgrading a\nPython program from junk drawer script to maintainable. Two more: [dataclasses](https://docs.python.org/3/library/dataclasses.html)\ninstead of free-form dictionaries, and [logging](https://docs.python.org/3/library/logging.html)\ninstead of just `print()`\n\nfor debugging output)\n\n[AI\nis making everything worse](https://www.doomsdayscenario.co/p/ai-is-making-everything-worse) by Garrett Graff. (One more: scammers\nhave adopted “AI” enthusiastically and at scale. We already had a [scam culture](https://blog.zgp.org/mlp-2024-09-28/) crisis\nbefore the “AI” boom, and the existing services help the scammers a lot\nmore than they help the scam fighters. Related: [Another ad safety*\nreport](https://blog.zgp.org/another-ad-safety-report/))\n\n[Meta\nran ads for an app promising to nudify female politicians](https://arstechnica.com/ai/2026/08/meta-ran-ads-for-an-app-promising-to-nudify-female-politicians/) by\nVittoria Elliott and Matt Burgess. (File under “your company’s choice to\nadvertise on Meta sites and apps is a political statement.”)\n\n[Young\nPeople Hate AI CEOs So Passionately That It’s Almost Hard to Believe](https://futurism.com/artificial-intelligence/young-people-ai-ceos-executives-poll)\nby Joe Wilkins. Those are some appalling approval ratings, reflecting\nthe massive swing in popularity the tech industry has experienced over\nthe last decade, driven by concerns around data privacy, the purposeful\ndecay of once-useful platforms, and the erosion of democracy.\n\n(Don’t\nforget online harassment and scam culture. When a normal person’s\nday-to-day experience of an IT brand is a flood of dick picks,\nlootbox-infested games, and rip-off dietary supplements, that brand is\nnot going to be super premium.)", "url": "https://wpnews.pro/news/waiter-theres-a-watermark-in-my-slop", "canonical_source": "https://blog.zgp.org/waiter-there-s-a-watermark-in-my-slop/", "published_at": "2026-08-20 00:00:00+00:00", "updated_at": "2026-08-21 16:44:30.746623+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-policy", "ai-ethics"], "entities": ["Anthropic", "David Gerard", "Seth Godin", "Matt Birchler", "Dave Winer", "Doc Searls", "SynthID"], "alternates": {"html": "https://wpnews.pro/news/waiter-theres-a-watermark-in-my-slop", "markdown": "https://wpnews.pro/news/waiter-theres-a-watermark-in-my-slop.md", "text": "https://wpnews.pro/news/waiter-theres-a-watermark-in-my-slop.txt", "jsonld": "https://wpnews.pro/news/waiter-theres-a-watermark-in-my-slop.jsonld"}}