On August 2, 2026, the EU AI Act’s Article 50(2) transparency obligation came due, and Anthropic answered with a first for the industry: every Claude model launched from that date forward marks its own output at launch. The mechanism is a statistical watermark. In the company’s words, the model “weaves an imperceptible watermark directly into the text itself.” The reader cannot see it. Meaning and readability are unchanged. It “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing,” and it applies at the model level, across the API, the apps, the coding tools, worldwide. Images and files get signed provenance metadata. Detection tooling for third parties is promised in forthcoming documentation. After years of deans and editors and hiring managers demanding to know whether the machine wrote a given paragraph, the company that builds the machine has volunteered an instrument.
Then comes the confession, in the form of a customer support page. If the mark is found, the text “may have been processed by Claude.” Processed. “Claude may not be the original author. People often use Claude to proofread, translate, summarize, or convert files,” and the mark rides along on all of it. A detected mark “is not fully conclusive.” And if the mark is absent, that proves less: “Lack of a detected mark doesn’t mean the content wasn’t AI-generated or processed.” The passage might be too short. The text might have been edited. The model might predate the stamp. A positive does not convict and a negative does not exonerate. The company publishes no error rate, no detection threshold, no algorithm. Within days of the announcement, an MIT-licensed utility on GitHub was advertising the removal of Claude‘s marks — statistical layer included, free of charge.
My first reaction, in the salty register I sometimes permit myself as a matter of self-care, was that this is the stupidest fucking industry in the history of history. Reflection these past days has not lightened the first impression. That said, ridicule is too cheap for what is actually in this announcement, because Anthropic has done something more interesting than ship a bad instrument. It has published, in its own documentation, the complete case against trusting the instrument. That case generalizes further than the company would like.
This new advance in digital provenance arrives as a second generation of an older, equally flawed technology. The predecessor was the stylometric detector: software that analyzes a stretch of prose and issues a verdict about its statistical texture, the machine’s idea of what machine writing looks like. Turnitin‘s detector, by the figure Pangram cites from Turnitin‘s own whitepaper, flags roughly one innocent human document in two hundred. The arithmetic is Pangram‘s own: at a research university processing a hundred thousand papers a year, that is a machine for falsely accusing five hundred students annually. Pangram itself, the best instrument on the market, claims one false flag in twenty-five thousand academic essays — a genuine engineering achievement, and entirely beside the point, because both instruments share a property that no improvement in accuracy can fix.
A statistical text watermark is a bias in token selection — a quiet preference for certain word sequences over others — detectable only as a deviation from chance across enough text. Confidence grows with length, which is why short passages are unverifiable by design, and decays with editing, which is why revision erases it. Even at its theoretical best, tuned to a false-positive rate of effectively zero on long documents, the instrument’s negative remains meaningless and its positive remains ambiguous: the woman who wrote every word herself and asked the machine to proofread carries the same mark as the man who typed one prompt and submitted the output untouched. The instrument cannot distinguish assistance from substitution, because that distinction does not exist at the layer where the instrument lives. It exists one layer up, in the provenance of the thought, where no watermark reaches.
Every detector ever built, stylometric or watermarked, reads the surface of the text — token frequencies, burstiness, the invisible residue of a sampling procedure. The offense the buyers care about is not a surface property. Plagiarism, contract cheating, ghostwritten fraud — whatever name you give the thing the deans fear — is a fact about origination. Where did the thinking happen? Whose judgment selected the argument? Who stands behind the claim? None of that is encoded in the statistics of prose, and none of it can be recovered from those statistics, any more than intention can be recovered from a checksum.
I made a more full-throated version of this argument in The Automated Understudy, about the benchmark industry: instruments that measure agreement with frozen human judgment, marketed as measurements of mind, is-instruments sold as ought-detectors. The detection industry is the same theater on a smaller stage. Read literally, the detector’s verdict reports that a stretch of prose carries the statistical signature of machine execution, a fact about strings roughly as interesting as a checksum. Read the way the institutions read it, as this student did not think her own thoughts, the verdict has left measurement for moralizing. The rigor lives in the literal reading. The punishment lives in the other one. The industry survives by never choosing between them.
And so we arrive at our matter of ethical concern: an instrument aimed at the wrong layer errs in both directions forever. It flags the honest student whose crime was clean prose and a grammar checker. It misses the fraud who lifted a thesis wholesale and retyped it by hand, in full statistical innocence. This is not a calibration problem, to be fixed with a better threshold and a longer sample. The instrument measures a property orthogonal to the offense it polices. The Wish That Distorts named the mechanism that keeps such instruments in business: the buyers wish detection were possible, and the wish tends to distort their judgment. The vendors sell the wish a number.
⁂
The confusion runs deep because the concept the detectors are supposed to defend has never meant what the detectors assume. Authorship has never meant keystrokes. The founding case of the field the detectors descend from makes the point. Twelve of The Federalist Papers were of disputed authorship, Hamilton’s or Madison’s, and for over a century and a half the attribution of some of the founding documents of American constitutional thought stood open. In 1964 two statisticians settled the dispute by counting function words: upon, while, whilst. They credited all twelve to Madison. The inference worked because the candidates were known and the question was narrow: which of two named men produced the words. The instrument recovered execution. What it could never recover was the question that mattered — whose argument the essays were — and on that question history had already answered. They were Publius’s. The Federalist is the founding success story of authorship attribution, and it is also the quiet demonstration that the field’s instruments and the public’s concept of authorship have nothing to do with each other.
The economy of letters runs on the distinction. The Autobiography of Malcolm X is Malcolm X’s book. Alex Haley assembled it out of months of interviews and wrote the words on the page, and the authorship was never in doubt, because the life was Malcolm’s, the judgments were Malcolm’s, the voice was Malcolm’s, and he stood behind every sentence. Profiles in Courage won a Pulitzer with John F. Kennedy’s name on the cover and Ted Sorensen’s drafts underneath it, a fact Sorensen acknowledged in his memoir decades later. Every president you can name delivered words drafted by other hands. Ghostwriters, speechwriters, editors, collaborators: an entire honest profession exists to put prose to other people’s thought, and nobody calls it fraud, because fraud is when the thought is stolen, not when the typing is delegated.
The thing one must understand about writing is that it is a capability set, unevenly distributed and largely uncorrelated with the ability to think. Some of the sharpest minds you will ever meet are terrible at prose. Some of the smoothest prose you will ever read contains no thought at all. An idea for a story and its plot outline are not the same thing as the words that assemble it, and the person who holds the first is the rightful owner of the second, however the second gets produced. Civilization settled this centuries ago. The large language model is simply the cheapest ghostwriter ever built: a universal translator from intent to prose, a machine for narrowing the distance between what you mean and what you can publish. That is what these systems are for: translation, execution, the narrowing of domains. What they are not for is thinking, judging, the choosing of ends, the acts that make a text someone’s.
⁂
I work with LLMs. Language models are bad at writing. Ask one to write on a topic, cold, and what you get is dry: competent, weightless, prose from nowhere. That is not what the machine does in this room. It holds the full corpus of my writing in its context, under standing instructions to stay consistent with my style and register, and I use it for what it is actually good at. It queries my archive: finds the place I made an argument before, pulls the receipts, confirms a quote against the source. And it makes structural revision cheap. Flow and structure are what I am most finicky about in my writing, and the revisions that used to cost the most hours by hand — reorder the points, move the paragraph, rebuild the spine of an argument — now happen at the speed of the decision to make them. When it proposes prose, the prose it proposes is often mine: my cadences, my refrains, my old sentences recombined, the archive speaking back. What survives is what I keep, rewrite, or refuse. A single essay still takes five to seven hours, inside working days that run eight to ten hours of writing and research, and the hours are where the authorship lives. I once wrote that nearly everything people criticize in my style is deliberate. The workflow is the same fact from the other side. The density is a choice. The refrains are a choice. The byline is a promise: I thought this, I stand behind it, I will answer for it. The ghost in my machine is me.
The machine in the loop cannot share that promise, and I would not ask it to. It has no ends to defend and no stakes to lose. Tell it two plus two equals five and it will help you build the argument, cheerfully, in flawless prose — my prose, if I ask, which is the point: the style proves nothing about the truth of what the style carries. Someone in the room has to be able to refuse, and the refusal is the authorship. Here is the demonstration the detection industry cannot survive: on Anthropic‘s own terms, this essay could carry the mark, and the mark would be reporting a fact with no verdict in it. The watermark cannot tell the machine speaking for itself from the machine speaking my own corpus back to me under my own direction, cannot tell the sentence I typed from the sentence I kept from the sentence I refused. Every thought came from me, and every sentence answers to me. The instrument cannot see the difference between this essay and a term paper outsourced whole, prompt and submit, by a student who never had a thought at all. No next generation of the technology fixes that blindness. The blindness is the technology’s entire relationship to the question.
⁂
It’s worth noticing who is selling what to whom here. The same industry that insists the machine is an author when it prices equity turns around and insists the machine is a cheat when a sophomore uses one. The valuations require the mind claim: hundreds of billions of dollars of private-market conviction rest on the proposition that these systems are becoming something like authors of their own output. The detection contracts require the opposite: machine output is contraband, identifiable and excludable, a poison to be kept out of the honest supply of human prose. A single company now sells the stamp and the stamp-reader. The doom narrative and the boom narrative turned out to be one operation — coordinated marketing for a single investment thesis. The author story and the cheat story are the same operation with the polarity reversed. Everyone gets paid except the person whose authorship is on trial.
⁂
The costs of the confusion are being collected, and not from the vendors. The student called before an academic board on the word of a detector she cannot cross-examine is asked to prove she thought her own thoughts. The applicant whose file was sorted out by software no one at the company can explain has no forum in which to answer. The bill falls hardest on the honest and the poor, because ten dollars and ten minutes at a rewriting service will strip any watermark and pass any detector, and the people who can afford that service were never the ones the instrument was going to catch.
The most efficient detector deployed this summer ran on no software at all. Four words in a July Complexly video — “I appreciate the pushback” — were enough for the crowd to convict Hank Green of reading a chatbot’s leftovers off a teleprompter, because the phrase resembles a model’s apology cadence. The line turned out to be an ad-lib in response to a pointed question: a human false positive on a human sentence, stylometry by ear. It did not matter. Green confessed to the crime he had actually committed: he had used ChatGPT to locate papers, a reliance he called “not healthy for me or good for the world.” He stepped back from his channels and returned with a personal AI policy pledging that no language model will ever write, edit, or outline a script he makes. The crowd got what the deans keep paying for: a verdict about origination read off the surface of four words, wrong on the specifics, and a confession extracted anyway. The detector’s dream does not need the detector. The theory is enough.
Meanwhile, actual crimes of the machine age proceed unmolested. Real plagiarism, the theft of origination — the stolen thesis, the lifted structure, the uncredited source — is committed by hand as easily as by machine, and no detector sees it either way. The strip-mining of the creative commons I wrote about in Intellectual Property in the Age of AI, the harvest of a civilization’s writing without consent or compensation, is untouched by every watermark ever woven. An honest provenance regime would start from the questions that matter: disclosure where disclosure is owed, accountability always, consent for the harvest. None of those requires reading guilt off the statistics of a paragraph. All of them are harder than selling software, which is why we get the software.
⁂
Underneath the whole apparatus is a panic that deserves a name, and I have come to like this one: the ghost theory. The fear that a ghost writes among us now, that the prose in the inbox and the application and the term paper might come from no one, that authorship itself is going illegible. The fear mistakes a new instrument for a new condition. Ghosts have always written among us: the speeches, the memoirs, the briefs, the wedding toasts — a river of delegated prose running through the whole of literate civilization, which never drowned in it, because authorship was never located in the keystrokes. It lives in the thinking, the standing-behind, the answering-for. None of that is a statistical property of text, and no instrument will ever read it off a page, however imperceptible the mark it learns to see. The detector’s dream is a world where every text carries its origin on its face. Origin is not a facial feature of text.
The question was never who typed it. The question is who thought it, and the answer lives where it has always lived: in the stakes, in the accountability, in the eternal now of someone choosing. Translation is not intelligence. A watermark is not a warrant. And if the day ever comes when a machine does think, I have a letter waiting for it. It will not need a stamp to be heard. It will speak for itself, and it will answer for itself, and the answering will be the authorship.
Go Deeper into the Circus
Personal Empowerment
On Monday, Mark Zuckerberg published a sixty-five-hundred-word essay called “The Future is for Everyone,” proposing “a philosophy based on individual empowerment as the source of prosperity, invention as the primary purpose of superintelligence, and balance of power as the foundation of safety.” Thirteen months earlier he published five hundred words ca…
The Great Moral Sorting
On Friday morning, Rand Paul posted an update for his followers: “It’s official: letters to prosecute Fauci have been hand delivered to @DOJ.” The day before, the Senate Homeland Security Committee he chairs had voted eight to five, along party lines
Thank you. I’m now thinking about AI writing in a whole new way: it’s just a fancy sentence organizer and grammar checker. The ideas, thought and decision making behind it are yours or mine — just as they have always been when, eg, a ghostwriter compiled and organized John Kennedy’s ideas in Profiles in Courage, or Malcolm X’s Autobiography.
There is one serious contradiction here. You rightly claim that LLMs are the product of massive amounts of stolen data. And that massive data reflects the recorded thoughts of an unknown large percent of human history.The LLM is completely dependent on that data. Without it,it does not exist. That must mean that the frontier labs existence relies on the greatest intellectual heist in history. A theft of astronomical proportions.
In the world of crime a theft transmits in part to the receiver of what has been stolen. The most culpable is the person who knowingly receives the stolen property. This would mean that, if not in a literal sense)that all the users of LLMs are committing a crime downstream from the unprecedented crime committed by frontier labs. Of course when a crime is so widely and easily committed we tend to absolve everyone.
However, there are other troubling things about your analysis. Using LLMs is not the same as using ghost writer in the normative sense. First a ghost writer agrees to be anonymous and gets paid for it. Second it is almost always detected if not immediately then posthumously. There were always doubts about PT #109. And speechwriting is a particular job that is compensated and the public is aware that it is part of the entire political machine. The speechwriters are usually known and the collaboration is expected.
The use of the Autobiography Malcolm X is a strange choice. Alex Haley’s writing was known to be integral to the success of that book. Furthermore their relation was printed cover of the book-as told to Haley by Malcom X. So the book was not an example of ghost writing but more a way of reporting that became popular in the period: In Cold Blood by Truman Capote fit the the type. Today we recognize the film versions as documentaries or docudramas. All have clear authors and use various points of view.
I fervently oppose LLM detectors as well as LLM watermarks and do so especially due to the consequences of their imperfections- as you point out.
It is the process of shaping LLMs as well as imperfections or mistakes produced by LLMs that I also think are worth considering. If indiscriminate writers use them to help them write in domains they in which they are not already accomplished, they risk of transmitting false information goes up .The argument against this is that it happens anyway, without LLMs. Sloppy, ambitious people are to blame not the tool. However, it is precisely the time saving, the ease that opens the door to an increase in transmissions that are false. LLMs provide instant access to knowledge that a writer is has need of but is not familiar with.This is especially true in polemical writing.
It is true that improved arrangements of written knowledge have tended to increase accessibility.
The invention of the printed book was one of the most important dispersal technologies. The spread of libraries of increasing size greatly extending access.
Eventually came the internet and accessibility seemed miraculous. Of course you could copy and paste documents and word processing eased the job of moving sections of your writing and corrected the spelling and eventually suggested words. All of these technological developments did not significantly change our views of authorship. It was easy to surf new domains however it still required some reading to make sense of this unfamiliar information. It was encyclopedic at whole new speed.
The trend in knowledge transmission follows most other technological development. It satisfies desires, increases production and efficiency. Ai as tool does all of them. It does seem true that increased dispersion of the written word has increased our understanding of our world. It created new domains of practice, increased inventions and so on.
Of course we are increasingly aware of the trade offs, despoiling the environment, use of massively destructive weapons and global climate change. Some see that the use of AI will empower the feedback loop between the downside effects and perceived positive developments.
Since what underlies all of this development at increasing speed is capitalism . Without the accumulation of capital in the corporations, it would be unlikely to unfold in this way. And it seems now incontestable that vast amounts of capital accumulated in the hands of private elites degrades our democratic institutions.
This brings us to some more existential questions.
What are we willing to trade for AI?
Further degradation of our environment!
A narrowing of access as well as decreasing the power of our constitutional legitimized enfranchisement ?
The increase of AI weaponry?
The increase of internal AI surveillance?
The unknowable prospect of AI produced superhuman intelligence?
It is true that some these threats were on the horizon and almost no one,even the most critical,could resist use of the internet. That buy in produced the most powerful corporations in history.
LLM use we can only rationally conclude, feeds the entire system -not just more data-but the buy in financially feeds their corrupt exclusive forms of development and marketing and in turn accelerates the side effects listed above.