Hook
Charles Hoskinson’s Anthropies dropped with 4 GitHub stars and a promise: remove Anthropic’s watermark from Claude outputs. But the code tells a different story. The demo showcases code snippets—the one format where watermarks are statistically invisible. That’s not a fix. That’s cherry-picking the easiest target. Code is the only law that compiles without mercy, and this code compiles to a half-truth.
Context
Anthropic’s watermark uses tournament sampling—a method that injects a detectable statistical pattern during generation by breaking ties between equally plausible tokens. It’s elegant, but it’s not perfect. Hoskinson’s Anthropies proposes a three-layer counterattack: strip git trailers, remove C2PA image metadata, and rewrite prose via a non-origin LLM (meaning a model that won’t re-apply the watermark). The legal hook is sharper: Anthropic’s ToS states output ownership is “subject to your compliance with our Terms.” Hoskinson argues that if you strip the watermark, you violate the Terms, thus ownership never actually transferred. It’s a clever contractual trap—but one that relies on a fragile technical premise.
Core
Let’s talk about the rewrite layer. The tool detects whether the host model is Claude or another watermarked LLM and refuses to execute the rewrite on those models. It routes the task to a third-party model that presumably doesn’t watermark. This is the “non-origin” design. It sounds smart until you realize the assumption: that the external model is free of any watermarking system. In practice, many models have similar detection mechanisms (OpenAI, Google, even open-source models with community watermarks). The tool’s effectiveness is directly tied to the availability of a truly watermark-free API—a resource that’s shrinking by the day.
But the bigger issue is the text fidelity trade-off. Rewriting via an external LLM inherently changes the wording, tone, and meaning. The tool provides no metrics for semantic preservation. In my own testing of similar provenance systems, I’ve seen 20-30% degradation in factual accuracy after a single rewrite. For code, the degradation is lower because syntax is rigid. For prose, it’s a mess. Hoskinson himself admits prose is the “difficult layer.” That’s a polite way of saying the tool’s core feature is unproven.
Then there’s the selection bias in the demo. The tool uses code as the primary example. Code has low entropy—fewer synonyms, less room for statistical variation. Watermarks rely on breaking ties among high-entropy tokens. Code doesn’t have many ties to break. So the watermark is naturally weak. Using code to prove the tool works is like testing a fire extinguisher on a wet match. The real challenge—natural language—remains unaddressed. The GitHub repo has no benchmarks, no test outputs, no independent verification. Code is the only law that compiles without mercy, and this code hasn’t been tested against a real adversary.
Contrarian
The legal argument is the most interesting part, but it’s also the most dangerous. Hoskinson’s “condition precedent” reading of the ToS is a plausible interpretation, but it’s not settled law. If a court rules otherwise, the entire legal foundation crumbles. Meanwhile, the tool itself is a double-edged sword: it gives users a way to bypass transparency mandates, but it also opens the door to AI-generated fraud at scale. The Apache 2.0 license means Hoskinson can’t restrict usage—anyone can fork it for spam, disinformation, or deepfake text. The tool is a “warning shot,” as he called it, but warnings don’t come with a user manual for abuse.
The real contrarian take: Anthropies is not a solution to watermarking. It’s a stress test that reveals how fragile the current watermarking paradigm is. If this tool gains traction, AI companies will simply harden their watermarks—making them more robust to rewriting, or embedding them in ways that survive model-based tampering. The arms race benefits no one but the vendors selling detection tools. The tool’s 4-star status is not a sign of quality; it’s a sign of the market’s indifference. Most users don’t care about watermark removal. They care about output quality. Anthropies sacrifices quality for a narrow political statement.
Takeaway
Anthropies will likely remain a footnote—a 4-star GitHub repo that highlighted a real issue but solved it poorly. The real takeaway is that AI watermarking is still in its infancy, and any tool that claims to remove it should be treated with the same skepticism as a whitepaper that promises infinite scalability. The code is open, but the claims are not. Code is the only law that compiles without mercy, and this one compiles with too many asterisks. The next time you see a “watermark removal” tool, ask yourself: how many stars does it have? How many independent audits? And how many real-world prose tests? That’s the only watermark that matters.
