On August 2nd the transparency rules in the EU AI Act started applying. Anthropic began embedding a watermark in text from new Claude models the same day, applied globally rather than only in Europe. Google has done this with SynthID for a while.
Almost every conversation since has been some version of the same question. Can you get the mark off?
It is the wrong question to lead with. Not because the answer is uninteresting, but because the answer that actually determines whether marking can function as evidence runs in the opposite direction.
First, the question everyone is asking
A text watermark is not hidden characters or whitespace tricks. It changes the source of randomness a model uses when choosing among candidate words, so the mark is the word choices. Detection is a statistical test for that bias.
Can it be removed? Yes, and this is documented rather than speculative.
- Watermark under Fire catalogs removal attacks across lexical editing, text mixing, and paraphrasing
- Self-Information Rewrite Attacks finds the marks concentrate in high-entropy tokens, which is precisely what makes them reachable
- RLCracker reports adaptive attacks against ten different schemes
Nobody has to be sophisticated about it, either. Ordinary editing, translation, and reformatting degrade these marks without anyone intending to.
There is a quieter version of the same problem. Detection needs enough word choices to measure. Short output and highly constrained output give it very little to work with, and source code has far fewer meaningful word choices per line than prose does.
So removal is real. Now here is why it is the less important half.
The question almost nobody is asking
If a mark can be removed, it fails quietly. Someone publishes machine-written text, the detector says nothing, and the people who wanted the mark to work are disappointed. That is a false negative, and false negatives are a missed opportunity.
Run it the other direction.
These schemes work by splitting the vocabulary under a secret key and nudging sampling toward one half. Recover enough of that structure and you do not need a model at all. You write the text yourself, bias your own word choices to match, and the detector reports a positive on text the model never produced.
This is not a thought experiment. Watermark stealing research attacks exactly that recovery problem. The detail that matters is which schemes it targets: the single-key designs the field moved toward because they hold up better against editing and paraphrase.
Sit with that for a second, because it is the structural finding underneath all of this. The property that makes a watermark durable is the same property that makes it learnable. Harden a scheme against removal and you make its signal more consistent, more repeatable, and easier to reconstruct from samples. The two failure modes are not independent problems to be solved in sequence. They pull against each other.
There is a second route to the same place. The piggyback attack takes genuinely watermarked text and alters its meaning, including into hate speech, while the mark stays valid and detectable. The output is now attributable to the model provider, and the provider did not write it.
Why forgery breaks the whole proposition
A detection tool is evidence only if the thing it detects cannot be manufactured. Once it can, every positive result becomes contestable and every accusation built on one becomes unsafe.
Consider who is on the receiving end.
- A student accused of submitting machine-written work they wrote themselves
- A journalist whose reporting is flagged as synthetic
- A vendor whose deliverable is rejected in an audit
- A company that finds abusive content attributed to its model, which its model never generated
In each case someone faces a technical claim they cannot rebut, because the tool that would settle it is not in their hands. Anthropic has said a detection API is coming. It has not shipped. So at this moment nobody outside the company can measure the scheme's removal resistance, its forgery resistance, or its false positive rate. Anyone citing a number for any of those, in either direction, is citing something they did not measure.
And note what a positive result means even when everything works correctly. It says a model probably touched the text at some point. People run their own writing through models for editing and translation constantly, so a valid detection is entirely compatible with a human having written every idea in the passage. Marking establishes processing. It was never able to establish authorship.
A mark that can be stripped tells you less than you hoped. A mark that can be applied by someone else tells you something false, in your name.
None of this is a criticism of the labs shipping it. Marking is a consumer protection measure, and as a consumer protection measure it does useful work. The problem is that it is being quietly promoted into a role it was never built for, which is proof of origin.
Detection was always the harder path
Step back from watermarking and the shape of the problem gets clearer.
Detecting the fake is an arms race you re-enter every time generation improves. Proving the real is a fixed cost you pay once at the point of creation. The first strategy asks you to win indefinitely. The second asks you to sign something.
Europe did not miss this. The Code of Practice asks for layers, and one of them is C2PA provenance metadata with cryptographic signatures. Proof of origin is already part of the answer for files.
But every one of those layers marks an artifact. A file, an image, a passage of text. None of them describe a transaction between two systems.
And the Commission's own guidance on Article 50(2) places output communicated only machine to machine, processed automatically with no exposure to a person, outside the marking obligation entirely.
Read that against how agent systems actually run. One agent calls a tool. The tool returns a result. Another agent consumes it, transforms it, passes it on. Several hops later something reaches a person, and only that last artifact is squarely in scope. Everything upstream is machine to machine, which means the fastest growing category of traffic on the network is the category nobody is required to mark and almost nobody records in a form an outside party could check.
So the forgery problem and the coverage problem land in the same place. What you need is not a better mark on the output. It is a record of the action, signed at the moment it happened, that nobody can manufacture after the fact.
Signing the transaction instead of marking the output
That is what I have spent the last year building, in two pieces.
N-AALP makes every message an agent sends a self-contained signed object rather than a line in somebody's log. N-PAMP is the post-quantum transport underneath it. Both are Apache-2.0 with public specifications and ten reference implementations.
What that produces, in terms a control owner cares about:
Attribution that is binary, not statistical. An object either carries a valid signature from a specific system or it does not. There is no confidence score, no threshold to argue about, and no false positive rate to defend in a dispute. Forgery is not a matter of degree here. It requires the private key.
Authority recorded at the moment of action. Each action carries its own declared authority and permitted effect, checked before anything changes state rather than reconstructed afterward from logs. An auditor sees not just that an agent did something, but that it did something it was specifically authorized to do.
Verification that does not require trusting you. Records verify offline, with no certificate authority, no registry lookup, and no call back to a service you run. A regulator, a customer, or a counterparty can check your evidence without taking your word for any part of it, including the log.
Tamper evidence across the chain, not just per record. Actions link causally, so altering or omitting one is detectable rather than invisible. Where two authorities disagree about what happened, the disagreement is itself provable.
Erasure that does not break the trail. Immutable records and a right to erasure look incompatible, which is why legal teams refuse to approve append-only audit. Personal data can be erased while the signed record stays intact and verifiable. You keep the evidence without keeping a permanent personal data liability.
Confidentiality on the refusal path. When a request is denied, the requester learns that it was denied and nothing else. The reason exists, it is signed, and an authorized reader can retrieve it. An adversary probing your boundary learns nothing from the shape of your refusals.
Built for evidence that has to last
Audit records are long-lived by definition, so a signature scheme that is sound today and broken in twelve years is a poor foundation for evidence you may need to produce in twelve years. Both protocols are post-quantum from the ground up rather than retrofitted, on the finalized NIST standards.
Signature strength is tiered by profile, and that tiering exists because national guidance genuinely disagrees. CNSA 2.0 requires ML-DSA-87 for signatures on national security systems and does not require hybrid during the transition. Australia's guidance aligns. The UK's NCSC accepts a lower level. Germany's BSI and the ECCG go the other way and require hybrid deployment for lattice-based algorithms. No single fixed answer satisfies all of them, so the top tier meets the CNSA 2.0 requirement, a classical hybrid stays selectable where a regulator demands one, and moving between them is a configuration change rather than a migration.
The usual objection to post-quantum signatures is size, which is a fair objection to how they are normally applied. This design sidesteps the specific bottleneck that has stalled post-quantum adoption elsewhere, and a complete signed record arrives in the first round trip. Malformed traffic is discarded before it costs a signature verification, so a flood cannot turn your own cryptography into the attack.
Evidence you can check
Anyone can publish a specification and claim properties for it. The reason to take these seriously is that the claims are graded and the grading is published.
- The Go and Rust implementations produce byte-identical output for every construction carrying a security or interoperability claim. Not equivalent output. The same bytes.
- Every expected value in the conformance corpus comes from an independent source anchored to an RFC, FIPS, or NIST vector, or built from scratch, and never from the implementation under test. A 239-case corpus runs through every language binding.
- A clean-room harness regenerates the wire format from the specification and independent sources with all access to the implementation blocked at the process level, then requires a byte-for-byte match against the committed corpus. Twenty-six of twenty-six checks pass under that denial with zero specification defects. The harness verifies its own blocking, so a leak makes it report itself broken rather than report success.
- Ten reference implementations ship against a single machine-readable authority for every wire-affecting constant, with gates that fail if any constant goes uncompared. Go, Rust, Python, TypeScript, Java, Kotlin, C#, Ruby, PHP, and Swift.
For the engineers
The short version, if you are the one who has to run it.
It wraps what you already send. MCP, A2A, HTTP, gRPC, WebSocket, and local stdio traffic are carried inside a signed envelope without decoding or rewriting the payload, so your agents do not change and no new parser lands on the verify path.
Two deployment shapes ship alongside the specifications this week. A sidecar that is one command and no cluster, for the first taste. A per-node ambient data plane for production scale, with identity from workload attestation rather than stored credentials, implementing the Gateway API mesh profile so it drops into an existing Kubernetes cluster with no new CRDs. The wire is identical at both, so moving between them changes your topology and not your protocol.
Worth noting what that second one is. Every production sidecarless mesh shipping today secures L4 with classical cryptography. Istio's ztunnel uses X25519 mutual TLS over HBONE. Cilium uses WireGuard, also X25519. A post-quantum, agent-native ambient data plane is the gap those leave open.
The object model, the authorization model, the audit construction, and the full conformance corpus are in the specifications, which are open and are the right place to evaluate this properly.
Where this leaves you
Watermarking will keep doing what it was built for. It tells a person that a machine made the thing in front of them, and that is worth having.
What it cannot do is survive an adversary who wants to put your name on something. The removal question has an answer everyone can live with. The forgery question does not, and it is the one that decides whether a mark can ever be treated as evidence.
If you run agents in production, here is the exercise for this week. Take your strongest proof that a specific automated action happened, and ask what remains of it in front of someone who does not trust your logs.
The specifications are at N-AALP and N-PAMP, currently in IETF Internet-Draft form. If you are working on this problem, I want to hear where this fits what you are building and where it does not.
Disclosure: Some of the N-PAMP and N-AALP details referenced in this article may differ from what is in the current GitHub docs, only because these are draft revisions that will be submitted this week.
