I commented it last time the post about Claude watermarking went viral and I'm going to say the same thing again:
"I've been working in the media and model IP space for quite many years. What this article misses a bit is the threat model for watermarking in general. Watermarking and fingerprinting have inherently weak security guarantees -- they rely a lot on security through obscurity, weak assumed adversaries to deliver.
There are clear trade offs between true positives, false positives and maintaining the quality of the media. It's true for audio-visual media, models and their outputs alike.
As much as I like to take shots at poor technical choices by corps and govs, this one is unjustified. Sure, inserting glyphs is bad but biased sampling is as good as it gets in 2026."
Since the announcement, there have been many people who don't seem to fully understand what a security guarantee is, what trade offs it might involve, or how popular the type of technological solution is in general (media watermarking is ubiquitous).
And naturally, there are challenges with how you will make sense of the score in your org, e.g. you wrote an email, and it's flagged as LLM-generated because you copied two generated/edited paragraphs.
Yeah, the article might disagree with watermarking as a matter of principle, comparing it to censorship. But the methodological arguments that I have read so far have been thin in these articles.
I've been working in the media and model IP space for quite many years. What this article misses a bit is the threat model for watermarking in general.
Watermarking and fingerprinting have inherently weak security guarantees -- they rely a lot on security through obscurity, weak assumed adversaries to deliver.
There are clear trade offs between true positives, false positives and maintaining the quality of the media. It's true for audio-visual media, models and their outputs alike.
As much as I like to take shots at poor technical choices by corps and govs, this one is unjustified. Sure, inserting glyphs is bad but biased sampling is as good as it gets in 2026.
I think that's the wrong question. What kind of shadow spy network must exist around all these companies such that they all happen to be working on the same features at the same time.
> What kind of shadow spy network must exist around all these companies such that they all happen to be working on the same features at the same time.
Stuff like that happened even before the invention of the telephone, humans within the same geographic location is even more predicable, so surely this shouldn't come as a surprise.
I mean your initial question kind of implies something that is likely to be the wrong answer, so sounds like at least someone could potentially be surprised by that :)
Frequently, two movies with very similar concepts drop the same year. Is that because they're spying, or because the companies make decisions in similar ways based on similar input information?
It's possible and even likely there's industrial espionage going on. But imo, you don't need that. I've worked in cutting edge industries, and even when you don't know what your competition is doing, there are usually only so many logical next steps.
This. / Who remembers the "birth" of crowdfunding? Why did so much seem to happen at all once? The most likely explanation imo is that it was "in the air" -- we share culture and ideas. These ideas don't have to be stolen to co-occur... quite the opposite.
The human brain strikes again. It is built into our cognitive machinery to look for patterns and naively ascribe causation. We're not rational beings that sometimes mess up. We're a clusterf--k of cognitive biases all the way down.*
Cool pattern! Sure, maybe there is something there.** And/or maybe our brain is doing "conspiracy theorizing lite". Its all on the same spectrum -- the same flawed cognitive machinery trying to operate in a weird modern world quite different from where we came from.
A better way: write out your favorite hypothesis. But don't stop there... keep going... write out many hypotheses. Then find ways to test them. To tap into our best selves, I recommend The Scout Mindset (book). Here is an infographic summary of part of it: https://imgur.com/qN31PX8
Probably not a better way: float one's first gut feels to the Internet phrased as i.e. the better question and feed empty calories to our pattern-craving brains. There is reason some of our brain functions are considered higher order.
* Maybe I'm overstating this. Let me know? I want to read Rationality and the Reflective Mind by Keith Stanovich (https://academic.oup.com/book/5930) as a counterpoint to the usual suspects (such as Tversky & Kahneman)
Let's forget that this post is an ad. I feel like there is a use for LLMs that could help us do stacked PRs better.
Right now there are effectively three ways to do a PR:
- a bunch of small commits, some of them related to the feature, some fixes, some mixing both -> a PR with 'n' commits -> they don't really make sense as atomic commits, you have to review the entire PR to make the sense of it
- a squashed PR
- some uber principled reorganisation of commits that separates key implementation concerns into smaller commits (effectively stacked PRs but clean)
The last option would be desirable but it's unreasonable to expect anyone to do it by hand. So this is where <maybe> an LLM could parse my garbage intermediate commits, the final diff and generate a stack instead?
The last option is absolutely not unreasonable to expect people to do by hand, as the article states it’s simply a problem of tooling. JJ makes this extremely easy to do, but some of us have been doing just the same in git for a long time and it is extremely achievable once you know your way around a rebase.
Yep, ensuring RERERE and autostash are enabled eliminate 80% of the tedium for me, but honestly just try jj; it seriously is a gamechanger and (so far, in ~6mth of use) it has had literally zero drawbacks in comparison to git, because it is still git and if I don’t know how to do something with jj, I can use the git commands I do know and it Just Works™
I have had good success lately with asking Claude to do your last option. jj also works fantastically for this, because you can easily jj new up a bunch of empty changes with the descriptions you want to have, and then jj restore the state from your original stack into them. If the process goes poorly for any reason, you still have your original stack around.
You don’t have to do it this way, you could use the oplog to undo it all if it’s not to your satisfaction, but it’s much simpler than trying to edit the commits into the right shape directly.
I was thinking a similar thing when reading the article. Often, the validity of the input depends on the interaction between some of them.
Sure, we can follow the advice of creating types that represent only valid states but then we end up with `fn(a: A, b: B, c: C) transformed into `fn(abc: ValidABC)`
> We already had that disaster where pop-ups fly out "do you want to accept those cookies". That is just a usability nightmare. People are forced into extensions, just to stop wasting their time here.
You’re perpetuating a gross misunderstanding of the cookie law. What it states is different from how the advertisers implement malicious compliance to bias people, like yourself.
Websites that implement basic functional cookies do not need to display any popups. They’re permitted to do so. Any cookies that are essential to the functioning of the website within reason are permitted. In fact at no point a website should serve you a cookie popup unless you seek it out because analytics and advertising cookies are supposed to be opt in.
So many websites do two things, serve you a popup that has everything enabled which is a clear violation; or a popup that has only functional cookies selected but the biggest highlighted button allows all of them.
The law is fine. Malicious compliance is to blame. The EU has been slow to rectify it.
The government (EU in this case) passes a law and a finger goes down on the monkeys paw. This will always be the case. If everything is illegal then nothing is.
The quality and usefulness of it aside, the primary question is: are they still collecting chats for training data? If so, it limits how comfortable, and sometimes even permitted, people would with working on their yet-to-be-public work using this tool.
The collect chat records for any number of users, not the least of which being NSA surveillance and analysis - highly likely given what we know from the Snowden leaks.
Interestingly enough, it is possible to do private inference in theory, e.g. via oblivious inference protocols but prohibitively slow in practice.
You can also throw a model into a trusted execution environment. But again, too slow.
Modern TEE is actually performant for industry needs these days. Over 400,000x gains of zero knowledge proofs and with nominal differences from most raw inference workloads.
I agree that is performant enough for many applications, I work in the field. But it isn't performant enough to run large scale LLM inference with reasonable latency. Especially not when we compare the throughput numbers for a single-tenant inference inside a TEE vs batched non-private inference.
These are fair points but the weight of their impact is a misconception. Times and times again, lower capital and investment risk aversion are shown to be the limiting factors.
"I've been working in the media and model IP space for quite many years. What this article misses a bit is the threat model for watermarking in general. Watermarking and fingerprinting have inherently weak security guarantees -- they rely a lot on security through obscurity, weak assumed adversaries to deliver. There are clear trade offs between true positives, false positives and maintaining the quality of the media. It's true for audio-visual media, models and their outputs alike. As much as I like to take shots at poor technical choices by corps and govs, this one is unjustified. Sure, inserting glyphs is bad but biased sampling is as good as it gets in 2026."
Since the announcement, there have been many people who don't seem to fully understand what a security guarantee is, what trade offs it might involve, or how popular the type of technological solution is in general (media watermarking is ubiquitous).
And naturally, there are challenges with how you will make sense of the score in your org, e.g. you wrote an email, and it's flagged as LLM-generated because you copied two generated/edited paragraphs.
Yeah, the article might disagree with watermarking as a matter of principle, comparing it to censorship. But the methodological arguments that I have read so far have been thin in these articles.