On 2 August 2026 — the day the EU AI Act’s transparency rules went live — Anthropic switched on invisible text watermarks for Claude. The signal sits in word choice, not in hidden characters: no extra tokens, undetectable to a reader, machine-readable to anyone holding the key. Images get C2PA provenance metadata instead. Ten days later, Guillaume Meyer’s open-source watermarks-remover shipped v0.3.0 with coverage for Claude, Gemini and OpenAI. The Menon Lab blog framed it as “the open-source arms race”; BleepingComputer clocked the repo past 4,500 GitHub stars in a week, with the sharper note that almost none of these strippers can prove they actually defeat the official check.

Strip the noise and you get a system worth drawing on paper before anyone argues about it. Four layers, each depending on the one below:

• Compliance — the mark itself (C2PA manifests, statistical text watermarks). Required by regulation.
• Detection — the scanners that read the mark. Increasingly baked into platforms.
• Circumvention — tools like Meyer’s that strip or degrade it, in three passes: deterministic Unicode hygiene, best-effort statistical rewriting, and file-metadata stripping across PNG, DOCX, SVG and more.
• Policy — the human rules that decide what a present-or-absent mark means.

Read as a dependency graph, the failure mode is obvious. No single layer holds. The Unicode pass is lossless and reliable; the statistical rewrite degrades the text — Meyer’s own docs admit that running Claude’s carefully chosen tokens through a cheap local model like llama3.2 is a quality tax, and warn that re-running Claude text through Claude may just re-stamp the mark. Soft-bound C2PA, where in-content signals re-link to a remote manifest even after metadata is scrubbed, stays unsolved. The honest engineering position is the one the tool itself takes: watermarks are friction, not proof.

←TODAY: A model-level watermark and an open-source stripper shipped ten days apart in August 2026; neither side can yet cite a public detector key. →3012: Provenance becomes continuous ledger, not a per-file toggle — every draft carries its own signed lineage. Fulcrum: A mark only means something when the policy layer decides what to do about its absence.

For an architecture office this is not abstract. Your tender texts, BEP sections, client briefs and specification notes are increasingly part-drafted with AI, and from now on some of that output is marked. The question is not “how do I remove it” — for legitimate practice, that is the wrong verb. The question is which of your outgoing documents you can vouch for, and where in the workflow the provenance quietly breaks.

Atelier: The Büro risk here is treating provenance as a single switch — one AI policy, one paragraph in the QA handbook — when it is really a chain with three or four hand-offs where the signal drops. This Monday, write one line into your studio SOP: AI-assisted passages get flagged in the document’s own frontmatter or file properties, and no client-facing text is ever round-tripped through a second model to “clean” it. Record provenance; don’t launder it.

Hack: Scan your outgoing brief for invisible marks before it leaves the office. You don’t need Meyer’s full toolchain to see whether a draft carries zero-width Unicode — the deterministic Layer-A signal is three lines of Python, and running it teaches you exactly what “machine-detectable” means at the byte level.

import re
marks = re.compile(r'[\u200b\u200c\u200d\u2060\ufeff]')
draft = open("tender.md", encoding="utf-8").read()
hits = marks.findall(draft)
print(f"{len(hits)} invisible marks found" if hits else "clean: no hidden Unicode")

From the late-2070s vantage, the systems that survived were never the ones with the cleverest single control. They were the ones whose owners had drawn the real dependency graph and found the third break they didn’t know was there. Do that with your own document pipeline before a regulator or a client does it for you: map every stage where an AI touches a file, mark the two where provenance silently drops, and decide — as policy, not reflex — what each one should mean.

Source: themenonlab.blog