Unscarcity
Sign in for free: Preamble (PDF, ebook & audiobook) + Forum access + Direct purchases Sign In By signing in, you get our daily podcast email. Unsubscribe any time.

Unscarcity Research

Provenance Is Not Authorship: The Limits of Marking AI Work

A watermark can say a machine was involved. It cannot say who wrote what, and that is the only question schools, courts and employers ask.

17 min read 3731 words Updated October 2026 /a/provenance-is-not-authorship

Note: This is a research note supplementing the book Unscarcity, now available for purchase. These notes expand on concepts from the main text. Start here or get the book.

Provenance Is Not Authorship: The Limits of Marking Machine Work

The two companies that spent the most on invisible watermarks have now explained, in writing, the one question their watermarks cannot answer. It is the question everyone is asking.

The Vendors Said It First

On August 14, 2026, Anthropic published an explainer on the invisible watermark it now puts in Claude’s text to satisfy the EU AI Act. Most of it is reassuring engineering. One paragraph is the whole story:

“A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this.’”

And, a few lines later: “It doesn’t say anything about ownership or authorship.”

Seven weeks after that, on October 5, OpenAI published its own version for the same law. Same conclusion, plainer words:

“A watermark does not measure human contribution. It can indicate that an OpenAI system generated or processed part of a passage, but not how much human judgment, editing, or creativity went into it.”

Then two sentences that every academic integrity office should have framed: “A watermark does not establish ownership or responsibility.” And: “The absence of a detected watermark does not prove human authorship.”

Read those again and notice what they are not. They are not critics. They are the people who built the marks, describing the marks accurately. Provenance, the fact that a machine touched the text, is a question the technology can answer, badly but honestly. Authorship, the allocation of credit and blame between a person and a machine that worked on the same paragraph, is a different question, and nothing you can attach to the artifact answers it.

The trouble is that nobody outside a Brussels directorate actually asks the first question. Schools, courts, employers and journals ask the second one. They have been pointing provenance tools at an authorship problem for three years, and the wreckage is now well documented.

What the Mark Can Say

Start with what the technology is, because it is better than its reputation and worse than its marketing.

Claude’s watermark is a version of SynthID-Text, which Google DeepMind described in Nature in October 2024. The idea is a statistical thumb on the scale: when the model picks the next word, it nudges its choice among near-equivalent options according to a secret key, so that over a long enough passage the pattern of choices becomes detectable to anyone with the key, and invisible to everyone else. Google tested it in Gemini on nearly 20 million responses and found the thumbs-up rate between watermarked and unwatermarked answers differed by 0.01%. Readers cannot see it. That part works.

The paper is just as clear about what weakens it. Short texts carry little evidence. Low-entropy text, the kind where there is only one right next word, carries almost none. Paraphrasing degrades it. And “the rise of open-source models presents a challenge, as enforcing watermarking on these models deployed in a decentralized manner is difficult,” which is a polite way of saying that any model whose weights you can download will do whatever its operator wants.

OpenAI’s October 2026 numbers put figures on the degradation. At a target false-positive rate of 1%, its detector caught the mark in about 80% of 200-token passages and about 95% of 400-token passages. Replace 10% of the words with synonyms and detection fell from about 92% to 66%. Replace a quarter of them and it fell to 17%. Anthropic says the same thing without the numbers: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” It adds that when Claude proofreads a person’s draft, nearly all the words are still the person’s, so “there’s very little (if anything) for the watermark to attach to.”

So the mark is strong exactly where nobody disputes authorship, on long passages the model wrote by itself, and weak exactly where the dispute lives, in the edited, blended, proofread, half-and-half document that is now the default way anything gets written. OpenAI had already discovered this once. In 2024 it disclosed that it had built a text watermark it considered “highly accurate,” then kept it in a drawer, because it was trivial to defeat with translation or a second model, and because “it could stigmatize use of AI as a useful writing tool for non-native English speakers.” The company’s earlier classifier, which guessed without a watermark, had caught 26% of AI text and falsely flagged 9% of human text; it was switched off on July 20, 2023, “due to its low rate of accuracy.”

Google, meanwhile, has moved its effort to where the mark does work. On October 7, 2026 it opened its SynthID detector to everyone and reported more than 180 billion watermarked images and videos plus 240,000 years of audio. It published no count for text. There is a reason for that.

What the Law Asks For

The law that produced all these explainers asks a narrow question, and it is worth being precise about it, because it is the only institution asking the question the mark can answer.

Article 50(2) of the EU AI Act requires providers of systems that generate synthetic text, audio, images or video to ensure the outputs “are marked in a machine-readable format and detectable as artificially generated or manipulated.” The duty took effect on August 2, 2026. The Digital Omnibus, Regulation (EU) 2026/1744, gave systems already on the market before that date a four-month transition, to December 2, 2026. A Code of Practice on Transparency of AI-Generated Content was published on June 10, 2026 and had about 190 signatories by the end of July, Anthropic and OpenAI among them. California’s AI Transparency Act became operative the same August 2, with duties for large platforms following in 2027 and for cameras in 2028.

Notice the verb. The law says detectable as artificially generated. It does not say attributable, gradable, or punishable. The European legislator wants to know whether the thing in front of you came out of a machine, so that you can treat it accordingly: a deepfake of a politician, a synthetic voice on a phone line, a news story nobody wrote. For that purpose a mark that says “a model was involved somewhere” is useful, and a false negative on a lightly edited paragraph is tolerable. The regulation and the technology fit each other, because they were designed together. (The companion article on reciprocal freedom covers what the Omnibus did to the rest of the Act.)

The mismatch begins the moment the same mark leaves Brussels and walks into a classroom.

What Everyone Else Asks

A teacher does not want to know whether a machine was involved. In 2026 a machine was involved in nearly everything. The Higher Education Policy Institute’s 2026 survey of 1,054 British undergraduates found that 94% use generative AI to help with assessed work, that 12% now paste AI-generated text directly into it (up from 8% in 2025 and 3% in 2024), and that 65% say assessment has already changed significantly in response. Sonar’s survey of developers found AI writing 42% of committed code. Graphite, measuring with three AI detectors and therefore to be read with the appropriate irony, reckons that primarily AI-generated articles have run at about half of everything published on the web since early 2025.

In that world the teacher’s question is the authorship one: did this student do the thinking, or did the student outsource the thinking and keep the grade? And the tool the teacher was sold does not even try to answer that. It answers the Brussels question, and it answers it by guessing, because no watermark survives the blender.

Turnitin switched on its AI writing detector on April 4, 2023 and advertised a document-level false-positive rate under 1%. Its own chief product officer added the fine print six weeks later: at the sentence level the false-positive rate was about 4%, and documents scored under 20% AI showed “a higher incidence of false positives.” Vanderbilt University did the arithmetic that every integrity office should have done. It had submitted 75,000 papers to Turnitin in 2022; at 1%, “around 750 student papers could have been incorrectly labeled.” On August 16, 2023 it disabled the detector “for the foreseeable future,” noting that Turnitin “gives no detailed information as to how it determines if a piece of writing is AI-generated or not.” Turnitin kept counting anyway. By March 2024 it had reviewed over 200 million papers and flagged 11% as at least a fifth AI-written; in February 2026 it reported that since October 2025 about 15% of essays were more than 80% AI-generated, up from 3% when the tool launched.

The errors are not random. In 2023 Weixin Liang and colleagues at Stanford ran seven popular detectors over 91 TOEFL essays by non-native writers and 88 essays by American eighth-graders. The detectors were near-perfect on the eighth-graders. They flagged an average of 61% of the TOEFL essays as AI-generated, and 89 of the 91 were flagged by at least one detector. Simpler vocabulary looks like a machine. OpenAI’s reason for shelving its watermark, the stigma on non-native speakers, was the same finding from the other side of the counter.

Bloomberg Businessweek tested GPTZero and Copyleaks on 500 college application essays submitted to Texas A&M in the summer of 2022, before ChatGPT existed. One to two percent came back as likely AI, some with near-certainty scores. About two-thirds of teachers told the magazine they use such tools regularly. Multiply, as Vanderbilt did. The magazine’s lead case was Moira Olmsted, a Central Methodist University student whose paper came back from the detector and whose grade came back as zero.

The courts have now seen the question too, and the instructive thing is what they used to decide it. When the University of Minnesota expelled a doctoral student in 2024 for using AI on a closed exam, the hearing panel relied on four graders who compared his answers with a chatbot’s and on testimony, and the Minnesota Court of Appeals affirmed on February 2, 2026 that he “more likely than not used AI.” No watermark, no detector score; human judgment about process, tested in a hearing. At Yale, an executive MBA student suspended for a year after a professor ran his work through GPTZero has a thirteen-count federal lawsuit pending since February 2025; the university’s stated ground is lack of candor, and Yale itself has said that policing AI use through detection tools is infeasible. One case decided without the tool, one case stuck because of it.

Journals got there earliest and said it best. Nature’s editorial of January 24, 2023 laid down two rules: no language model would be credited as an author, “because any attribution of authorship carries with it accountability for the work, and AI tools cannot take such responsibility,” and researchers must document their use of the tools. That is an authorship rule built on accountability rather than on detection, and it has held. ICML’s 2023 policy prohibited model-generated text in papers, exempted “light editing of their own text,” and said plainly that the conference “does not plan to implement any automated or semi-automated system” to catch violators, because “it is difficult to detect whether any given text snippet was produced by a language model.” Science already had a vocabulary for the harder question: the CRediT taxonomy, an ANSI/NISO standard since 2022, splits authorship into fourteen contributor roles, including “Writing – original draft” and “Writing – review & editing.” It records process. It is also, you will notice, entirely self-reported.

Why the Artifact Cannot Tell You

Put the pieces together and the shape is clear.

A provenance signal is a property of the artifact. It travels with the file, or with the statistical texture of the words, and it says one thing: a particular machine was here. The better versions, like the Content Credentials standard the C2PA coalition has developed since Adobe, Arm, BBC, Intel, Microsoft and Truepic founded it in February 2021, say several things: where the file came from, which tools edited it, in what order. Google’s Pixel 10 became, in September 2025, the first phone to attach those credentials to every photo its camera takes. That is a real achievement, and it is still a record of tools, not of people. It also tends not to survive contact with the world: the World Privacy Forum’s 2025 review notes that uploaded files “are often stripped of their metadata” and that “multiple implementers of C2PA have acknowledged metadata stripping as an obstacle to its efficacy and robustness.” The watermark is the fallback for when the credential is gone. It is a fallback that says less.

Authorship is not a property of the artifact. It is a claim about a process: who had the idea, who judged the options, who wrote the sentence, who checked it, who is prepared to stand behind it. Two documents can be word-for-word identical, one written by a student who thought for a week and polished with a model, the other pasted from a prompt in forty seconds, and no instrument applied to the page can tell them apart, because the thing that differs is not on the page. The vendors know it. Anthropic’s “cannot distinguish” and OpenAI’s “does not measure human contribution” are the same admission, and OpenAI goes a step further, saying it is “exploring ways to distinguish AI assistance from AI authorship more meaningfully.” Every institution that reads a detector score as a verdict on a person is asking a photograph whether the photographer has talent.

This is the same error the biosecurity world is making with screening against a catalog of the known: a gate that inspects the artifact for a signature, built for a world in which artifacts were scarce and signatures were stable, facing a world in which neither is true. And it is the mirror image of accountability laundering, where a decision made by a person is dressed as the machine’s. Here the machine’s involvement is used to deny a person their credit, or to assign them blame, from the same missing evidence.

What Replaces Detection

The institutions that have thought hardest about this have reached the same place, and it is not a better detector.

Australia’s higher-education regulator, TEQSA, published its assessment-reform discussion paper in late 2023 with a sentence that could be the whole policy: the assignment becomes “a collection of evidence of student processes rather than a final product: the focus is on how the product is derived, not on how generative AI simulates its derivation.” Its September 2025 follow-up drops the diplomacy: “Rather than investing primarily in detection mechanisms, institutions need to emphasise the redesign of assessment to capture authentic demonstrations of student capability and comprehension.” Secure the few moments that must be the student’s alone; let the rest be openly co-authored and judged on reasoning the student can defend. The University of Sydney’s version, two lanes, one secured and one open, is spreading: the University of Bath replaced its traffic-light rules with it for the 2026-27 year.

Britain’s Russell Group adopted five principles in July 2023 whose third is to “adapt teaching and assessment to incorporate the ethical use of generative AI” and whose fourth is to uphold rigour; all 24 universities reviewed their conduct policies. And the bluntest answer came from Princeton. On May 11, 2026 its faculty voted, with one dissent, that from July 1 all in-class examinations would be proctored for the first time since the Honor Code was introduced in 1893. Oral examinations are back at Cornell, Penn, NYU and UC San Diego, where students defend their problem sets out loud. None of these institutions is detecting anything. They are moving the assessment to a place where process is visible, and leaving the artifact alone.

That is the honest redesign, and it generalizes beyond school. A journal that wants accountability asks for a named human who answers for the paper, not a scan. An employer that wants to know whether a candidate can think puts them in a room with a problem. A court that must decide whether a student cheated hears from the graders who read the answers, as Minnesota’s did. In every case the institution stops asking the page and starts asking the person.

The Unscarcity Reading

The book’s second law, Truth Must Be Seen, is usually read as a rule about outputs: decisions on a ledger, code in the open. The watermark episode shows why it has to be a rule about process. A visible output with an invisible process is exactly the document that fools a detector and would fool a Civic Layer too. What the framework records is contribution, and contribution is a verb.

That is what the Impact ledger is for. It does not infer who did the work from the finished artifact, which is the trick nobody can perform. It records contribution as it happens, by whom, decaying over time, with the Diversity Guard auditing the record rather than the product. CRediT’s fourteen self-reported roles are a cottage version of the same idea; the difference is that Impact is written by the system that saw the contribution, not by the contributor afterward. “Who wrote this” dissolves into two answerable questions: who can defend this, out loud, to someone who knows the field, and who will answer for it if it is wrong. Nature’s accountability rule is that principle applied to a byline.

The verifiability premium article argued that where proof is cheap, trust migrates to whatever can be checked. A watermark is a certificate of provenance, and it certifies the only thing it can: that words came from a machine. A Lean proof certifies the claim. An oral exam certifies the person. Institutions in the 2020s are learning, expensively, which certificate they actually wanted. The ones that wanted provenance already have it, and are the only ones satisfied. The ones that wanted to know whether a human understood something were never going to get it from the page, and the factory school that graded pages for 180 years is the institution with the most to redesign.

Ask what your own organization is trying to protect. If it is the knowledge that a machine was involved, the mark is enough. If it is accountability, design for a signature. If it is learning, design for a process. Only the first of those can be read off the artifact, and it is the one almost nobody cares about.

Sources

The machine did not take authorship. It made authorship the only thing left to ask about, and then showed that the page was never where the answer lived. Read the book or start with the preamble.

Share this article:

Share Share Share