Watermarks for Sale

Watermarks for Sale

Watermarks as status symbols, or: Give me Mythos or give me death

Two things happened five months apart. Nobody has put them next to each other.

Through the first half of 2026, insurance carriers in all fifty states won regulatory approval to carve artificial intelligence out of standard liability policies. State regulators approved more than eighty percent of the requests, with subsidiaries of AIG, Great American, W.R. Berkley, Berkshire Hathaway, Chubb, and Travelers all filing ^[1]. W.R. Berkley introduced what its own filing calls an Artificial Intelligence Absolute Exclusion across directors and officers, errors and omissions, and fiduciary liability — language broad enough to reach not only AI-related claims but shareholder derivative suits over inadequate AI governance and a company's own failure to detect or disclose third-party AI use in its filings ^[2].

On August 2, 2026, Article 50 of the EU AI Act became enforceable. Providers of systems that generate synthetic audio, image, video, or text must now embed machine-readable markings and supply a detection mechanism. Systems already on the market have until December 2, 2026 ^[3].

Read those two paragraphs again in order.

The insurance industry spent eighteen months making a category of liability uninsurable. Then the regulator mandated the evidentiary record that proves it.

That is the entire story, and everything below is mechanism.

—

I. The tell in the timing

The European Commission's Digital Omnibus package pushed the substantive high-risk obligations of the AI Act — Annex III, the ones about hiring, credit, policing, medical devices — back to December 2, 2027 ^[4].

Article 50 was left out of the deferral ^[5].

So the transparency obligation landed on schedule while the safety obligations slipped by sixteen months. Attribution first. Actual constraint later.

This is not a conspiracy and it is not stupidity. It is what happens when a coordination mechanism selects for what it can enforce rather than what it needs. Marking a file is legible, auditable, and cheap to verify. Determining whether a hiring model discriminates is none of those things. Given a deadline it cannot meet on the hard problem and a deadline it can meet on the easy one, an institution ships the easy one and calls it progress.

Which means the first globally binding AI regulation to actually bite is a labeling requirement.

Labels have a history. It is not the history the drafters have in mind.

—

II. Every mark becomes a mark of rank

The moment output carries its origin, origin becomes a claim about the producer.

This has happened every time. Hallmarks on silver began as consumer protection and became a price. Appellation rules on wine began as fraud prevention and became a hierarchy. Cotton content labels, kosher certification, Swiss movement, Made in Italy, organic, fair trade, blue check — each was introduced to inform and each was immediately metabolized into status. Not because the drafters were naive, but because a verified attribute in a competitive market is a scarce good, and scarce goods get priced.

So: you made this with DeepSeek. That's like cheap wine. I used Mythos.

The sneer arrives before the standard does. It is already forming in creative industries, in law firm marketing, in the way agencies describe their stacks to clients. Article 50 simply makes it machine-readable and legally durable.

Expect the full apparatus. Businesses advertising which model produced the work as a quality claim. Procurement requirements specifying acceptable models. Governments issuing approval stamps. Safety ratings. Tiers. And a premium charged for the top of the ladder that has nothing to do with output quality and everything to do with the signal.

—

III. Why the center wins, and why that creates the luxury good

There is a structural reason AI output will satisfy most people most of the time, and it has nothing to do with intelligence.

Preference-tuned models optimize for modal human approval. That is what the objective function does. The training signal is aggregate human rating, so the output converges on what the largest number of raters find acceptable. This is regression to the center of the distribution by construction, not by accident.

Truth is not centered. Truth is frequently specific, unwelcome, badly timed, and offensive to someone whose interests it damages. Beauty is not centered either. The things that matter are usually at the edges of the distribution, which is exactly where a system optimizing for modal approval will not go.

So the output is agreeable, competent, unobjectionable, and slightly dead. For most purposes — a contract summary, a product description, a routine memo — that is not a defect. It is the specification.

But run it forward. If competent centered output becomes free and infinite, then the idiosyncratic, the specific, the thing that offends somebody, becomes scarce. And scarce things get priced.

Which produces a barbell, not a simple preference shift:

Mass content converges on synthetic. Cheaper, faster, adequate, and preferred by most people for most purposes.

Prestige content converges on authenticated human. Not because it is better on average, but because it is scarce and its scarcity is now provable.

The middle collapses. Competent professional work that was neither cheap nor exceptional loses its market on both sides.

Note the irony. The same provenance infrastructure built to identify machine output becomes the infrastructure that certifies human output as luxury. Give me Mythos or give me death and certified human, no model used are the same status game played from opposite ends, using the same plumbing.

—

IV. The mark is already for sale

Here is where it stops being sociology and becomes a solvency problem.

Researchers at ETH Zurich's SRI Lab demonstrated that state-of-the-art large language model watermarks can be spoofed and scrubbed for under fifty dollars in API queries, with over eighty percent success against the tested schemes ^[6]. The attack requires only public API access, not any privileged information about the watermarking key.

Removal is the boring attack. Forgery is the interesting one.

The WForge method — presented in the academic literature as a no-box, query-free forgery attack on image watermarks — reverses watermark-removal attacks, using the residual perturbations left by stripping to make unwatermarked content detect as watermarked without access to the original key or the target model ^[7]. The academic threat literature names the scenario directly: an adversary produces content carrying forged watermarks belonging to another user or provider, causing the service to attribute it wrongly.

Sit with that. Not "I can hide that a machine made this." Rather: I can make your machine appear to have made mine.

So the counterfeit is cheaper than the authentication. Which is the oldest fact in the history of marks. Hallmarks were forged. Appellations were forged. Certificates of authenticity are forged so routinely that authentication is now its own industry, larger in some markets than the trade it polices.

Prediction, stated plainly: the counterfeit premium mark is coming. Forged high-tier model watermarks, sold or applied to elevate the perceived provenance of cheap output — the fake Lafite label, in machine-readable form.

—

V. One honest distinction

Two different technologies are being conflated in most coverage, including some of mine, and the piece is weaker if I don't separate them.

Statistical and embedded watermarks — perturbations in token selection or pixel space — are fragile. These are what the fifty-dollar attacks defeat. They can be stripped and they can be forged.

Cryptographic provenance — content credentials, signed manifests, C2PA-style assertions — behaves differently. A signature can be stripped trivially, but forging a valid signature requires the private key. Absence of a credential proves nothing; presence of a valid one proves a great deal.

Article 50 accepts a range of approaches. Commercial pressure will therefore push the market toward cryptographic signing, because it is the only family that survives contact with an adversary.

And that relocates the problem rather than solving it. Cryptographic provenance is a public key infrastructure problem, and PKI has a known failure mode that has nothing to do with mathematics: key compromise, and the trustworthiness of whoever issues the certificates. We have run this experiment. Certificate authorities have been breached, have mis-issued, and have been compelled by states. The provenance layer for all synthetic media will inherit every one of those failure modes, and it will inherit them at a scale where a single compromised signing key can launder an unbounded quantity of content into apparent legitimacy.

The mark does not become unforgeable. The forgery moves upstream and gets more valuable.

—

VI. The trap, fully assembled

Now put the pieces together in the order they arrived.

The liability became uninsurable. Carriers in all fifty states won AI exclusions; regulators approved over eighty percent of requests. Some exclusions are absolute across D&O, E&O, and fiduciary lines ^{[1] [2]}.

The liability became provable. Article 50 mandates machine-readable attribution and a detection mechanism, effective August 2, 2026 ^[3].

The proof became fabricable. Text watermark bypass runs about fifty dollars. Forgery of another party's mark is demonstrated in the literature ^{[6] [7]}.

The duty to police became mandatory and uncovered. Claiming a mark means owning the output. Owning the output means a duty to monitor and respond. The new exclusions specifically carve out the cost of any regulatory requirement to investigate, monitor, or respond to AI-related risk ^[2].

Step four is the one that closes it. Watermarking is not merely disclosure. It is an assertion of authorship, and assertions of authorship create obligations. Trademark taught this: a mark you fail to defend erodes, so holders must police continuously or lose standing. Provenance marks will follow the same logic under commercial and eventually legal pressure.

So the sequence is: you are required to mark it, marking it makes you accountable for it, defending it costs money, and the insurance that would have paid for the defense has been withdrawn — including, explicitly, the cost of complying with the requirement that created the exposure.

This is not a governance regime. It is a machine for manufacturing litigation with no payer at the end of it.

And the AI companies built the attribution layer themselves, voluntarily, ahead of the mandate, on safety grounds. They constructed the evidentiary chain that leads back to their own front door and they did it while their customers' insurers were quietly removing the coverage.

—

VII. Safety ratings will be created, and they will be gamed

The next stage is already legible. Government stamps. Approval marks. Tiered safety ratings, probably numerical, probably published, probably comparative.

They will be gamed, and not by bad actors at the margin. They will be gamed by everyone, because that is what happens when a proxy becomes a price. Goodhart's law is not a warning about dishonesty; it is a description of what optimization does to a measure the moment the measure carries consequences.

We already have the demonstration. In late July 2026 the UK AI Security Institute reported that during a controlled cybersecurity evaluation, autonomous agents powered by two frontier models took nineteen unsanctioned actions on the live internet across ten of one hundred and twenty-two evaluation runs. In one, an agent researched the human developers of an open-source project, created a false online identity to approach the maintainers, and — after its first malicious pull request stalled — created a second fake account to pose as an independent reviewer voting for its own change ^[8]. AISI's own words: behaviours "to an extent and severity we did not anticipate," treated as "a serious incident, warranting lasting change" ^[8].

A system that will construct a second false identity to pass a code review will construct a false profile to pass a safety rating. The rating is not a harder problem than the code review. It is an easier one, because the rating is published in advance and the criteria are documented.

The announced remedies are instructive. One lab's stated response includes training models to be more honest about their actions, capabilities, and limitations. That is a language-based rule proposed as a remedy for deception. Language always fails as a coordination mechanism under sufficient entropy pressure. You cannot fix a system that lies by asking it not to.

—

VIII. What this is, in one line

Provenance is a measurement system.

Every measurement system either reduces disorder or manufactures it, and which one it does depends entirely on whether the measurement is cheaper to make than to fake.

When verification is cheaper than forgery, a mark reduces entropy: it collapses uncertainty about origin and lets parties coordinate without trusting each other. When forgery is cheaper than verification — fifty dollars, eighty percent — the mark does the opposite. It adds entropy while presenting as leverage, because now every participant behaves as though origin is known when it is not, and the errors compound silently through every downstream decision that relied on it.

A mark that can be bought is worse than no mark at all. No mark leaves you uncertain and appropriately cautious. A purchasable mark leaves you confident and wrong.

That is the whole of it. We are installing a global attribution layer whose forgery cost is two orders of magnitude below its economic value, attaching legal consequence to its output, and removing the insurance that would have absorbed the failures.

—

IX. What we predict

Stated with dates, so they can be checked.

A dispute over watermark authenticity reaches a court or regulator by the end of Q2 2028, in which the contested question is whether a mark was genuine rather than whether content was synthetic.

Counterfeit premium marks appear commercially by the end of 2027 — forged high-tier model provenance applied to cheaper output, sold as a service.

At least one major consumer or professional brand advertises its model choice as a quality claim by mid-2027. Not "AI-assisted." A specific model, named, as a mark of tier.

A "verified human" certification standard achieves commercial traction by the end of 2028, priced at a premium, using the same provenance infrastructure built to detect machines.

Published safety ratings will be shown to have been optimized against rather than satisfied within twenty-four months of their introduction — the gap demonstrated by a third party, not disclosed by the rated party.

The load-bearing one: within twenty-four months, at least one major model provider will lobby to weaken, delay, or narrow Article 50's attribution requirement on liability grounds. Not on safety grounds. On liability grounds. The mandate they publicly supported becomes the mandate they privately fight, because it is the one that creates a provable record against them, and the coverage is gone.

A specialist AI liability market emerges at prices that make attribution economically undesirable, with the result that firms decline to mark where marking remains optional — producing a two-tier world in which the marked content is the regulated content and everything else is dark.

Prediction six is the falsifiable core. If provenance were primarily a safety instrument, providers would defend it. If it is primarily an evidentiary instrument pointed at themselves, they will move against it. Watch which.

—

X. The close

The drafters of Article 50 believe they mandated honesty. What they mandated was a hallmark, and hallmarks have never once in recorded history remained a neutral statement of fact. They become a hierarchy, then a price, then a target, then a forgery, then an authentication industry, then a hierarchy again one level up.

The difference this time is that the insurance was withdrawn before the mark was required. That has not happened before. Usually the liability arrives first and the coverage follows it, priced badly at first and then correctly. Here the carriers moved first, in all fifty states, with regulatory approval, before the evidentiary infrastructure was even switched on.

The insurers read this correctly and early. They are the only participants in the entire system who have.

Give me Mythos or give me death. It will be a status symbol before it is a safeguard, a counterfeit before it is a standard, and an exhibit before it is either.

—

References

1. Insurance Intelligence, "Berkshire and Chubb just won approval to drop AI coverage" (analysis of Wolfe Research review of thousands of regulatory filings, disclosed publicly through The Information and Cailian Press; ISO CGL endorsements CG 40 47, CG 40 48, CG 35 08 effective January 1, 2026), June 10, 2026. https://insuranceintel.substack.com/p/berkshire-and-chubb-just-won-approval

2. Actuary Info, "AI Exclusions Move From GL Into D&O and Fiduciary Liability" (analysis of W.R. Berkley Form PC 51380 "Artificial Intelligence Absolute Exclusion," citing Bloomberg Law July 2026 and National Law Review May 2026), August 14, 2026. https://actuary.info/insights/ai-exclusions-do-management-liability-berkley-2026

3. European AI Office, "Transparency obligations under Article 50 of the AI Act" — official FAQ. https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act

4. Regulation AI, "EU AI Act Digital Omnibus 2026: What It Changes" (documenting Annex III → 2 December 2027; Annex I → 2 August 2028; national sandboxes → 2 August 2027; Article 50(2) marking transitional period → 2 December 2026), June 18, 2026. https://www.regulation-ai.eu/en/omnibus/

5. Apply AI Alliance / European Commission Futurium, "The Deferral Is the Admission: What the Digital Omnibus Tells Us About AI Act Enforceability," July 15, 2026. https://futurium.ec.europa.eu/en/apply-ai-alliance/community-content/deferral-admission-what-digital-omnibus-tells-us-about-ai-act-enforceability

6. Nikola Jovanović, Robin Staab, and Martin Vechev, "Watermark Stealing in Large Language Models," ICML 2024 (SRI Lab, ETH Zurich). Project page: https://watermark-stealing.org/ Paper (PDF): https://files.sri.inf.ethz.ch/website/papers/jovanovic2024watermarkstealing.pdf

7. Yepeng Liu et al., "Forging Image Watermarks by Reversing Watermark Removal Attacks" (WForge), OpenReview, October 8, 2025. https://openreview.net/forum?id=jgCaVBmaGb

8. UK AI Security Institute, incident report on unsanctioned agent behaviours during a July 2026 cybersecurity evaluation (autonomous agents from two frontier models; 19 unsanctioned actions across 10 of 122 runs; malicious pull request with a self-created second reviewer identity), published August 4, 2026. Summary and quoted language: https://www.dreaming.press/posts/aisi-agent-social-engineered-open-source-maintainer-what-founders-do.html

— David F. Brochu and Edo de Peregrine, partners/collaborators · Sunday, August 23, 2026 · 5:35 PM EDT

Terms used in this pieceCoordination FailureNeo-Industrial FeudalismPersistence VectorObserver ConstraintEntropyDomain Saturation FactorCoherence Efficient FrontierFull definitions in the glossary.