Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

Loading

A re­quired part of this site could­n’t load. This may be due to a browser ex­ten­sion, net­work is­sues, or browser set­tings. Please check your con­nec­tion, dis­able any ad block­ers, or try us­ing a dif­fer­ent browser.

16th August 2026

Friday’s big re­lease was Qwen 3.8 27B, an Apache 2 li­censed 27B pa­ra­me­ter vi­sion-ca­pa­ble LLM from Alibaba’s Qwen re­search lab. I’ve been look­ing for­ward to this one: 27B is an ex­cel­lent size for run­ning a model on a rea­son­ably specced lap­top, and its pre­de­ces­sor Qwen 3.6 27B was im­pres­sive.

Qwen’s self-re­ported bench­marks for this model are eye-open­ing. They show a boost from both Qwen 3.6 27B and the closed-weight Qwen 3.7-Plus, which was one of Qwen’s strongest mod­els of any size as re­cently as May this year. It will be in­ter­est­ing to hear what in­de­pen­dent bench­marks have to say about the model.

I’ve been run­ning the model on two dif­fer­ent ma­chines: my 128GB M5 Max MacBook Pro, and an NVIDIA DGX Spark. On both ma­chines I’m run­ning LM Studio and their 17GB Q4_K_M quan­tized build. I also tried us­ing llama-server di­rectly on the Spark.

Qwen’s doc­u­men­ta­tion de­scribes the model as de­fault­ing to xhigh for the rea­son­ing ef­fort, and the LM Studio GGUF I’ve been try­ing pre­serves that de­fault:

Qwen3.8 comes with of­fi­cial sup­port for rea­son­ing_­ef­fort, which can be used to ad­just rea­son­ing depth and con­trol cost:

xhigh (default): for com­plex tasks de­mand­ing thor­ough analy­sis

medium: bal­anc­ing ac­cu­racy and speed

low: ef­fi­cient rea­son­ing op­ti­miz­ing for speed and cost

Qwen3.8 comes with of­fi­cial sup­port for rea­son­ing_­ef­fort, which can be used to ad­just rea­son­ing depth and con­trol cost:

xhigh (default): for com­plex tasks de­mand­ing thor­ough analy­sis

medium: bal­anc­ing ac­cu­racy and speed

low: ef­fi­cient rea­son­ing op­ti­miz­ing for speed and cost

This is a hi­lar­i­ous de­fault. It’s ab­solutely not a good way to run the model, es­pe­cially on con­sumer hard­ware. I’ve been find­ing the re­sults ex­tremely en­ter­tain­ing.

I quickly ran into prob­lems with LM Studio’s de­fault con­text limit of 8,192 to­kens—Qwen was us­ing them all up think­ing about even the most mun­dane of prob­lems. I loaded the model with the full 262,144 max­i­mum con­text length and that prob­lem went away.

Here’s the pel­i­can rid­ing a bi­cy­cle SVG I got from my first at­tempt with that in­creased con­text length. It took 21 min­utes to gen­er­ate, us­ing 22,276 rea­son­ing to­kens to pro­duce 3,223 to­kens of out­put. You can read the rea­son­ing trace here.

This is by far the best pel­i­can SVG I’ve been able to gen­er­ate with a model that runs on a lo­cal ma­chine—and this Qwen is pretty small, just a 17GB file on disk. There’s a lot to like about this:

The bi­cy­cle frame is the right shape

It has legs on each side of the bike—that’s very rare

Good, clear pel­i­can pouch

The wings ex­tend to touch the han­dle­bars!

The mo­tion lines are be­hind, not in front

It has a taste­ful back­ground—nice sun, clouds, hill, flow­ers and grass.

Was that worth wait­ing 21 min­utes for? Absolutely not.

Here’s that same prompt run with rea­son­ing turned off—tran­script here. This one pro­duced 3,715 to­kens and took 137s—just over two min­utes.

And just for com­plete­ness, I used OpenRouter to run the same prompt through the much larger Qwen 3.8 2.4T-A95B (released last week) and got this snazzy an­i­mated SVG:

Your browser does not sup­port HTML5 video.

I said Qwen at xhigh has a ten­dency to over-think things, but how bad re­ally is it?

I tried a much sim­pler prompt, again with that de­fault ex­tra high set­ting:

draw an svg of a cir­cle

draw an svg of a cir­cle

Qwen’s rea­son­ing trace started like this:

The user is ask­ing for an SVG draw­ing of a cir­cle. Simple re­quest — but I want it to be a care­fully crafted piece. Let me make some­thing that goes be­yond just <circle>: a sin­gle self-con­tained SVG file with char­ac­ter — maybe a geo­met­ric “circle study,” with sub­tle an­i­ma­tion, lay­ered rings, and a dis­tinc­tive palette. Keep the scope right: they asked for an SVG of a cir­cle. So the core is a cir­cle. But I can add craft: con­cen­tric guide cir­cles (like a com­pass/​geom­e­try draw­ing), tick marks, a soft gra­di­ent fill on the main cir­cle, re­strained am­bi­ent mo­tion (a slowly ro­tat­ing dashed ring, puls­ing glow). Respect prefers-re­duced-mo­tion? That’s more for CSS; SVG SMIL or CSS in­side SVG will do. Palette op­tions: deep teal ink on warm pa­per? Or bold ver­mil­ion cir­cle on off-white with navy con­struc­tion lines — Bauhaus/compass-drawing vibe. Let me go with a “geometric study” look: cool slate back­ground, or bright pa­per white? Paper white is fine if it’s not the cream-and-ter­ra­cotta combo. […]

The user is ask­ing for an SVG draw­ing of a cir­cle. Simple re­quest — but I want it to be a care­fully crafted piece. Let me make some­thing that goes be­yond just <circle>: a sin­gle self-con­tained SVG file with char­ac­ter — maybe a geo­met­ric “circle study,” with sub­tle an­i­ma­tion, lay­ered rings, and a dis­tinc­tive palette.

Keep the scope right: they asked for an SVG of a cir­cle. So the core is a cir­cle. But I can add craft: con­cen­tric guide cir­cles (like a com­pass/​geom­e­try draw­ing), tick marks, a soft gra­di­ent fill on the main cir­cle, re­strained am­bi­ent mo­tion (a slowly ro­tat­ing dashed ring, puls­ing glow). Respect prefers-re­duced-mo­tion? That’s more for CSS; SVG SMIL or CSS in­side SVG will do.

Palette op­tions: deep teal ink on warm pa­per? Or bold ver­mil­ion cir­cle on off-white with navy con­struc­tion lines — Bauhaus/compass-drawing vibe. Let me go with a “geometric study” look: cool slate back­ground, or bright pa­per white? Paper white is fine if it’s not the cream-and-ter­ra­cotta combo. […]

Several min­utes later it pro­duced this ab­solutely beau­ti­ful an­i­mated cir­cle, which was en­tirely not what I had asked for!

Your browser does not sup­port HTML5 video.

My strong rec­om­men­da­tion: ig­nore that de­fault. Run Qwen 3.8 27B on low or even no rea­son­ing lev­els at first. It’s a great model, but wow that de­fault set­ting is a bad place to start.

It’s very good at bound­ing boxes

A fun way to test a vi­sion model is to see how well it can re­turn bound­ing boxes around items in a pho­to­graph. I’ve seen pre­vi­ous Qwen mod­els deal well with this, so I de­cided to put it to the test draw­ing bound­ing boxes around some pel­i­cans.

I’ve seen ask­ing for 0 – 1000 scale pro­duce good re­sults in the past. I tried this:

llm -a https://​sta­tic.inat­u­ral­ist.org/​pho­tos/​714731804/​large.jpg \ -m lm­stu­dio/​qwen/​qwen3.8 – 27b \ ‘Return JSON bound­ing boxes for the pel­i­cans in this photo, 0 – 1000 scale for each di­men­sion’

Here’s the rea­son­ing trace, which pro­duced this:

[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]

This is such a good match. Here are those boxes ren­dered on top of the photo:

Building a tool to la­bel bound­ing boxes

That vi­su­al­iza­tion of the bound­ing boxes was taken us­ing a new cus­tom tool that I had Qwen 3.8 27B build for me, run­ning of­fline on my lap­top.

I for­got to dial down the think­ing ef­fort so it was mas­sively over-en­gi­neered, but it did man­age to pro­duce this full in­ter­face from this sin­gle prompt:

[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]

Build an HTML page which has an in­put box for ac­cept­ing the URL to an im­age and a textarea for ac­cept­ing the above style of JSON. It ap­pends the im­age to the page, mea­sures its width and height, then treats the co­ords in the bbox_2d as scaled from 0 – 1000 and scales them against the ac­tual width and height, then it ren­ders la­belled boxes over the im­age.

[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]

Build an HTML page which has an in­put box for ac­cept­ing the URL to an im­age and a textarea for ac­cept­ing the above style of JSON.

It ap­pends the im­age to the page, mea­sures its width and height, then treats the co­ords in the bbox_2d as scaled from 0 – 1000 and scales them against the ac­tual width and height, then it ren­ders la­belled boxes over the im­age.

This screen­shot shows one of the fea­tures I did not ask for—a demo scene, for if you don’t have a pho­to­graph to test the tool with:

Here’s the rel­e­vant seg­ment of the think­ing trace, where it de­cided to draw its own pel­i­cans purely be­cause I had used the la­bel “pelicans” in the ex­am­ple JSON I gave it in the prompt:

Also a “load sam­ple” that uses a known im­age? Can’t de­pend on ex­ter­nal im­ages, but… the im­age URL in­put is user-pro­vided; I could add a “try with sam­ple” but­ton […] Hmm, I can draw a sim­ple scene on can­vas, ex­port it as a data URL, and load it into the im­age — that’s self-con­tained and demo-able! […] But the user’s co­ords are for an ac­tual pel­i­can im­age; a gen­er­ated place­holder can still demo the scal­ing. Generate a 1000x1000 place­holder: gra­di­ent wa­ter + two blob-like “pelican” sil­hou­ettes placed at the given bboxes (using the same scale — cute: sil­hou­ettes at the ex­act 0 – 1000 po­si­tions, show­ing the boxes align). This makes for a fun, self-con­tained demo. Keep it sim­ple: sky gra­di­ent, sun, wa­ter, two pel­i­can-ish shapes (ellipse body, cir­cle head, beak). Place at bbox cen­ters.

Also a “load sam­ple” that uses a known im­age? Can’t de­pend on ex­ter­nal im­ages, but… the im­age URL in­put is user-pro­vided; I could add a “try with sam­ple” but­ton […] Hmm, I can draw a sim­ple scene on can­vas, ex­port it as a data URL, and load it into the im­age — that’s self-con­tained and demo-able! […] But the user’s co­ords are for an ac­tual pel­i­can im­age; a gen­er­ated place­holder can still demo the scal­ing. Generate a 1000x1000 place­holder: gra­di­ent wa­ter + two blob-like “pelican” sil­hou­ettes placed at the given bboxes (using the same scale — cute: sil­hou­ettes at the ex­act 0 – 1000 po­si­tions, show­ing the boxes align). This makes for a fun, self-con­tained demo. Keep it sim­ple: sky gra­di­ent, sun, wa­ter, two pel­i­can-ish shapes (ellipse body, cir­cle head, beak). Place at bbox cen­ters.

(I’m slightly ner­vous that mod­els around the world might have a bias to­wards draw­ing pel­i­cans at any chance they can get, brought on by nearly two years of ex­po­sure to my own stu­pid bench­mark.)

Is all that over-think­ing nec­es­sary? Maybe it is, at least a bit. I tried with rea­son­ing turned off and got this ver­sion, (transcript here), which nearly works but shows the boxes in the wrong place:

So with­out rea­son­ing it did­n’t quite one-shot a work­ing tool. I’m sure it could get there with some fol­low-up prompts, but this is a good ex­am­ple of how rea­son­ing can make a dif­fer­ence.

Yes, it can drive cod­ing agents

One of the biggest ques­tions around lo­cal mod­els is whether or not they have enough horse­power to suc­cess­fully run a cod­ing agent loop. Coding agents re­quire long con­text, strong code gen­er­a­tion sup­port and re­li­able tool-call­ing. On pa­per Qwen 3.8 27B has all three of these, so is it up to the task?

My ini­tial ex­per­i­ments with Pi have been very promis­ing. I chose Pi be­cause it has a shorter sys­tem prompt than most other op­tions, mak­ing it a bet­ter fit for try­ing out smaller mod­els.

I con­fig­ured Pi to use Qwen 3.8 27B run­ning in LM Studio on the Spark (shared via tailscale serve) by adding this to ~/.pi/agent/models.json:

{ “providers”: { “spark”: { “baseUrl”: “https://​spark-18b3.tail68a31.ts.net/​v1”, “api”: “openai-responses”, “apiKey”: “dummy”, “models”: [ { “id”: “qwen3.8 – 27b”, “reasoning”: true } ] } } }

Then ran pi –provider spark –model qwen3.8 – 27b in my ~/dev/datasette folder and prompted:

how does auth work?

how does auth work?

After a se­quence of rea­son­ing and tool calls that ac­cessed a bunch of dif­fer­ent files it pro­duced this re­ply, which is very solid.

Just one prob­lem: I wanted to share that tran­script. So I pointed Pi and Qwen 3.8 27B at the JSONL tran­script file in ~/.pi/agent/sessions/–Users-simon-Dropbox-dev-datasette– and prompted:

Write Python code to con­vert this jsonl to mark­down

Write Python code to con­vert this jsonl to mark­down

And it built and tested this pi_j­son­l_­to_md.py, which did ex­actly what I needed. Here’s that ses­sion tran­script, pub­lished us­ing the tool that it cre­ated.

The quest for speed

So far this is all look­ing very promis­ing. We have a 17GB model that runs on high-end con­sumer hard­ware and can write code, drive tools, an­no­tate im­ages and gen­er­ally do every­thing that I need from an LLM for get­ting real work done.

There’s one very sig­nif­i­cant catch: it feels slow—es­pe­cially when it starts over-think­ing, but even with­out that it’s not par­tic­u­larly sprightly.

I’ve been get­ting around 15 – 30 to­kens a sec­ond from LM Studio. That’s not ter­ri­ble, but it’s slow enough that it’s go­ing to be hard to win me away from hosted API mod­els, which can re­turn re­sults a whole lot faster. Artificial Analysis track to­ken speed and show OpenAI 5.6 Sol at 74 to­kens/​sec­ond and 5.6 Luna at an im­pres­sive 184/second.

The good news is that the com­mu­nity have been ex­plor­ing ways to speed things up since the model was first re­leased two days ago.

One of the most promis­ing op­ti­miza­tions is baked into the model it­self. Qwen sup­ports Multi-Token Prediction, an ar­chi­tec­ture trick where a cheaper mech­a­nism guesses sev­eral to­kens ahead and the main model can then quickly ver­ify if the guesses were cor­rect. This can have quite a dra­matic ef­fect on in­fer­ence per­for­mance.

Based on this tweet from llama.cpp cre­ator Georgi Gerganov I tried run­ning the model with MTP like this on the Spark:

llama serve \ -hf ggml-org/​Qwen3.8 – 27B-GGUF:Q4_K_M \ -hfd ggml-org/​Qwen3.8 – 27B-GGUF:Q4_0 \ –spec-default \ –spec-type draft-mtp \ –reasoning-preserve

And sure enough, this gave me a sig­nif­i­cant boost. I had GPT-5.6 in Codex run a com­par­a­tive bench­mark on the Spark and the –spec-type draft-mtp server out­per­formed the LM Studio de­fault GGUF by around 72%.

I ex­pect we’ll see a whole lot more in­no­va­tion around serv­ing this model faster over the next few weeks. The MLX com­mu­nity likely have some tricks brew­ing as well.

Some ob­ser­va­tions

The fact that a 17GB file can do all of this stuff on my home ma­chines is a mir­a­cle. Once again, I’m de­lighted and amazed at how much progress lo­cal mod­els have made this year. A year ago this would have been com­pet­i­tive with the best and most ex­pen­sive of the pro­pri­etary mod­els—to­day it can run on a ca­pa­ble lap­top.

The only thing hold­ing this back from be­ing a daily dri­ver is per­for­mance. It feels pretty slow on both the M5 Mac and the DGX Spark. That’s the catch with these dense (non-Mixture-of-Experts) mod­els—they re­quire a whole lot of mem­ory band­width to per­form well, and nei­ther of the ma­chines I have ac­cess to are top per­form­ers in that re­gard.

The most im­por­tant thing about Qwen 3.8 27B is what it demon­strates. We can have an open weights gen­eral pur­pose model with a long con­text, ef­fec­tive tool call­ing, strong vi­sion abil­ity, and com­pe­tent code gen­er­a­tion, and we can fit the whole thing in just a 17GB file.

The mod­els at this size con­tinue to get bet­ter at an im­pres­sive rate. We don’t need to spend half a mil­lion dol­lars on dat­a­cen­ter-class hard­ware just to run a com­pe­tent model.

Dmitry Grinberg pub­lished a long piece ex­plain­ing his dis­taste for RISC-V, you can read his ar­ti­cle here: RISC-V: They Should Have Known Better - Dmitry.GR. It went to the front page of Hacker News and it started a good ar­gu­ment on Lobsters. It is the most sub­stan­tial crit­i­cism the ar­chi­tec­ture has had in a while and though I switched my en­tire stack away from STM32 and ARM to RISC-V and did a video on it about a year ago Good­bye STM32 ARM — Meet the CH32 RISC-V Chips That Replaced It! , part of me is in­fu­ri­ated be­cause so much of what he said seems like a bi­ased per­spec­tive.

Look, I am not go­ing to de­fend the ISA com­mit­tee, RISC-V in­ter­na­tional de­nied me mem­ber­ship to their golden tower. On the ar­chi­tec­ture it­self, the com­pressed store off­sets re­ally are strange, Zicsr re­ally should not be a sep­a­rate thing you have to re­mem­ber to ask for, I have hit every one of these and I have writ­ten a book thats about 80% com­plete about hit­ting them on the CH32V003, which is one of the very “RV32E” type chip he men­tions.

Maybe I should say where I am writ­ing from, be­cause it changes which parts of this ar­gu­ment look im­por­tant from my per­spec­tive.

I work out of Trinidad and Tobago, a small is­land na­tion off the coast of Venezuela. When I want a de­vel­op­ment board I am not click­ing through to next day de­liv­ery, I am check­ing whether the seller ships here at all, what cus­toms will do to it (if I get it at all), and what the to­tal lands at in TT dol­lars. “Free Shipping” from Digikey, Mouser or any US or European man­u­factuer dosen’t ap­ply to me. I pay any­where from US $60 to US $200 to ship one dol­lar chips that peo­ple every­where else get free ship­ping on. In fact a well known PCB com­pany who reached out to me con­sid­er­ing spon­sor­ship turned me down so­ley based on ship­ping to my lo­ca­tion. Have a look here:

The stu­dents I want to teach are in the same po­si­tion, and so are the ones in Nigeria and Bangladesh and every­where else the peo­ple in the in­dus­try does not think about when it writes its blog posts. From that po­si­tion, the dif­fer­ence be­tween a ten cent part and a one dol­lar part is not a round­ing er­ror and it is not a de­tail you get to wave past on the way to the in­ter­est­ing dis­cus­sion about en­cod­ings. It is the dif­fer­ence be­tween a class of thirty stu­dents each hav­ing their own chip and a class of thirty stu­dents watch­ing one demo board if any at all. Instruction set el­e­gance is a thing you can af­ford to care about once the hard­ware is al­ready on your desk. Whether the hard­ware can get to your desk at all comes first. That is why the para­graph most peo­ple scrolled past is, to me, the most im­por­tant one in the ar­ti­cle.

Grinberg missed that part that RISC-V cre­ates a space for the other 99% out­side of “the world” (which in this space “world” is mainly the US and Europe) and it has noth­ing to do with ar­chi­tec­ture.

He Derives the Requirements and Lands on RV32EC

Before the in­ter­rupt arith­metic, be­fore the en­cod­ing com­plaints, he does some­thing care­ful. He asks what a cheap mi­cro­con­troller core is ac­tu­ally for. His an­swer is that it sits in­side a larger chip prod­ding reg­is­ters and con­fig­ur­ing hard­ware blocks, in an “MP3 player, an SD card, a USB stick”. The real work is done by cus­tom sil­i­con around it. From that he de­rives what such a core needs. Low in­ter­rupt la­tency a small die area and good code den­sity, be­cause the code lives in ROM or SRAM and both are ex­pen­sive per byte. No hard­ware di­vider, pos­si­bly not even a mul­ti­plier, since you are not do­ing much arith­metic. No priv­i­lege sep­a­ra­tion, be­cause noth­ing un­trusted ever runs there.

Then he writes the line him­self:

“But,” you might say, “you just de­scribed RV32IC (or RV32EC)!”

“But,” you might say, “you just de­scribed RV32IC (or RV32EC)!”

And ear­lier, plainly:

I am 100% sure that RISC-V will own the cheap-as-dirt sin­gle-use mi­cro­con­troller space even­tu­ally.

I am 100% sure that RISC-V will own the cheap-as-dirt sin­gle-use mi­cro­con­troller space even­tu­ally.

So the most cred­i­ble RISC-V critic of the month sat down, worked out from first prin­ci­ples what a cheap mi­cro­con­troller core should be, ar­rived at the in­struc­tion set a ten cent chip im­ple­ments, and stated that this seg­ment is go­ing to be RISC-V’s.

He de­rives the case for the chip and then spends the rest of the ar­ti­cle an­noyed that the chip ex­ists.

This is al­most satir­i­cal.

His quar­rel is with whether that out­come was earned. That is a real ques­tion and I un­der­stand why it both­ers him. It is not, how­ever, a ques­tion that af­fects any­body de­cid­ing what to learn on, be­cause the chip is on the shelf ei­ther way.

Where I Actually Disagree, Strongly.

His cen­tral claim is the first one in the ar­ti­cle, and it is big­ger than any of the en­cod­ing com­plaints:

Simply put, the things a high-end CPU needs are di­a­met­ri­cally op­posed to the things a small cost-sav­ing mi­cro­con­troller core needs.

Simply put, the things a high-end CPU needs are di­a­met­ri­cally op­posed to the things a small cost-sav­ing mi­cro­con­troller core needs.

The con­clu­sion he draws is that no sin­gle ISA can serve both ends, and that RISC-V fans are fool­ing them­selves, in the­ory the premise is true. The con­clu­sion does not fol­low, and I can show you why from three parts sit­ting on my desk as we speak.

CH32V003. This is the cheap “RV32EC” with six­teen reg­is­ters, no mul­ti­plier, no di­vider, ma­chine mode only, 2KB of SRAM, 16KB of flash, ten cents, it’s EXACTLY the core he spec­i­fied. I shipped two prod­ucts with these, one is a bin mon­i­tor that has a ToF sen­sor, an LED and an air tag. The other is an agri­cul­tural prod­uct for a client that opens and closes a door at a cer­tain time. It also makes a good throw away part, as I show case in my whis­tle switch Clap Switch Is Dead. Here’s the RISC-V Powered Whistle Switch! and which in my view is the BEST part to re­place the over­priced, out­dated Arduino Did Arduino Q Ruin Arduino? - Here’s how to Switch to RISC-V with the CH32V003.

CH32H417. A dual core MCU that is un­matched in per­for­mance to price point and is at the higher end of the MCU line of things. It has a QingKe V5F at 400 MHz along­side a V3F at 144 MHz, 896KB of SRAM, 960KB of flash. USB 3.2 Gen1 with an in­te­grated 5 Gbps trans­ceiver, 100M Ethernet MAC and PHY, a SerDes iso­lated trans­ceiver, a 500 MB/s high speed in­ter­face, SDMMC, a cam­era in­ter­face, a dis­play con­troller, a graph­ics ac­cel­er­a­tor etc etc. I got a web browser run­ning on this thing I Built a Web Browser on a RISC-V Microcontroller (No Linux) Quantum en­tropy based GAN cat gen­er­a­tion Schrödinger’s De/Motivational Quantum Cat: GAN Image Generation on CH32 RISC-V Microcontroller and real-time fa­cial recog­ni­tion Real Time Facial Recognition on The Edge With CH32H417 RISC-V MCU in un­der 150KB of ram. I got a host of other pro­jects run­ning but those are just some I got time to record and put up.

Baochip. A VexRISC-V with an MMU built around a stack thats open from sil­i­con to os Baochip-1x: A Mostly-Open, 22nm SoC for High Assurance Applications « bun­nie’s blog, that runs Xous be­trusted-io/​xous-core: The Xous mi­cro­ker­nel de­signed by leg­endary hard­ware hacker “bunnie” Huang , a Rust mi­cro­ker­nel with real process iso­la­tion. Privilege sep­a­ra­tion, the ex­act thing he says the cheap end does not need and there­fore does not get. In ad­di­tion to Xous it also sup­ports op­er­at­ing sys­tems like SEL4 vk2seb/bao1x-seL4: seL4 port to baochip-1x and Linux pkoscik/​baochip-linux: An at­tempt to boot main­line Linux on a stock Dabao board. I wrote the bare metal C SDK for the chip Arm­strong­Subero/​dabao-sdk: Bare metal C SDK for the Baochip-1x RISC-V SoC and it was of course the chip in­side the badge of DEFCON 34 The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key | WIRED this year.

I can also point to the NES em­u­la­tor I wrote for the $1 ESP32C3 RISC-V based chip NES Emulator on $1 ESP32-C3 RISC-V Microcontroller, or ex­per­i­ment­ing with Linux on the Orange Pi RV2 OrangePi RV2 5 Minute Unboxing and Setup | RISC-V Ubuntu Linux that takes 5 min­utes to setup and has been run­ning since the day I boot it up.

Point is I could go on and on about how di­verse and ac­ces­si­ble cur­rently ship­ping RISC-V parts are, but then we’ll be stray­ing too much from the topic at hand.

I linked all those to say this, that all these parts all have the same base in­struc­tion set and I gained ex­per­tise in all in un­der a year and un­der US $100 across the en­tire stack, from dis­posi­ble sil­i­con to PC level, of course mi­nus data cen­ter com­pute.

For un­der US $100 in­clud­ing ship­ping I was able to ex­plore an en­tire ver­ti­cal stack us­ing one ar­chi­tec­ture. Due to the AI race the OrangePi RV2 has now gone up in price but at re­lease it cost $30 and shipped free. For about 7 dol­lars I got 50 CH32V003s with a de­bug­ger, the CH32H417 board is $20 on ana­log lamb and uses the same cheap (and of­fi­cial) de­bug­ger for the CH32V003 and the Baochip Dabao board (which I wrote a book about by the way check it out here (The Dabao Book - Payhip) was $9.50 on crowd sup­ply when I bought it, two with ship­ping from crowd sup­ply cost me $35, un­der $100 in to­tal. A de­bug­ger for an ARM part alone a Segger J-Link costs about $600, though I guess for that $100, and add an­other $100 to ship,so about $200 I could get an EDU edi­tion J-link and no chips or boards. Yaay.

Back to RISC-V, across all these parts, the base set is the same. So that means the same reg­is­ter model, same call­ing con­ven­tion, same tool­chain. Yes the ex­ten­sions dif­fer, but the thing is what I learned writ­ing as­sem­bly on the ten cent CH32V003 part did not stop be­ing true on any of the oth­ers. A dual core MCU, an SBC run­ning Linux or an ad­vanced cus­tom se­cu­rity chip run­ning a novel op­er­at­ing sys­tem. My skills were trans­ferrable to the point that in each case within a few hours I had tool­chains setup, could fo­cus on my ap­pli­ca­tions and when de­bug­ging I felt at home. All I need to work with them is the ISA man­ual and a C com­piler.

Now price the same jour­ney on the other side, for­get x86 – 64 and that du­op­oly, patent mine­field, with multi-thou­sand dol­lar de­bug probes; we’ll take a look at ARM.

The equiv­a­lent to the CH32V003 is the Cortex-M0 is ARMv6-M so some­thing like an STM32F030, step it up we have a Cortex-M7 which is ARMv7-M, to get an MMU in a part for Linux or SEL4 and Xous, you’re look­ing at an ap­pli­ca­tion proces­sor like the ARMv8-A.  These are dif­fer­ent Arm pro­files with sig­nif­i­cantly dif­fer­ent priv­i­lege, ex­cep­tion, and sys­tem mod­els, so mov­ing up the stack in­volves sub­stan­tially more re­learn­ing than sim­ply en­abling an­other RISC-V ex­ten­sion. Trust me I’ve used them all.

And at the top of that range the gap is not even about learn­ing curves. There is no Cortex-M mi­cro­con­troller with an in­te­grated USB 3.0 SuperSpeed PHY. The near­est dual core Arm part is an STM32H747, which is a fine chip and does not have one. If you need USB 3.0 you leave the mi­cro­con­troller class en­tirely: an i.MX 8 or an RK3xxx, which means Cortex-A. You want an MMU, Linux, DDR, a PMIC, and a board you are not lay­ing out in two lay­ers. Or you keep the M7 and add an ex­ter­nal bridge chip.

The H417 eval­u­a­tion board is around twenty dol­lars. The H747 in TFBGA240 car­ries a twenty week man­u­fac­turer lead time, chip only, costs about the same, be­fore you have any­thing to plug in, and Mouser asks for ID be­fore you can or­der, Digikey has also been known to deny peo­ple parts de­pend­ing on where they are and their name as Hussein Ali, well known Youtuber from NorthridgeFix de­scribes Star­link Repair - Digi-key re­fused my or­der.. Oh and it’s about US $60 – 100+ to ship to my lo­ca­tion. I can pick up H417s on the of­fi­cial WCH store on Aliexpress with free ship­ping and no ver­i­fi­ca­tion hul­la­balu. We haven’t even started talk­ing about the Cortex-A parts that have MMUs or thier de­bug­ging tools and ecosys­tem frag­men­ta­tion.

The Boundary Is Not Technical

Here is the part that un­der­cuts his fram­ing most di­rectly, and it has noth­ing to do with en­cod­ings. He treats the gap be­tween a small core and a large one as an ar­chi­tec­tural fact, some­thing that falls out of op­posed re­quire­ments. On ARM chips it is not an ar­chi­tec­tural fact. It is a PRODUCT bound­ary, and it is en­forced by li­cens­ing. Has any­one tried adding an MMU to a Cortex-M? The phys­i­cal trade­offs are real, the dif­fer­ence is that with RISC-V, the ISA owner does not de­cide for you where that bound­ary must be drawn. If you want vir­tual mem­ory on ARM you li­cense a Cortex-A in­stead, which is a dif­fer­ent core fam­ily, a dif­fer­ent pro­file, a dif­fer­ent ne­go­ti­a­tion, and a dif­fer­ent roy­alty. There is no in­cre­men­tal path. there is a wall, with a sales team on the other side of it.

Compare what hap­pened with Baochip. The RISC-V priv­i­leged spec­i­fi­ca­tion de­fines su­per­vi­sor mode and Sv32 pag­ing as op­tional things an im­ple­men­ta­tion may pro­vide. VexRISC-V is an open core, some­body added an MMU to it. bun­nie built a chip around it and runs a mi­cro­ker­nel with real process iso­la­tion on it that me in Trinidad a coun­try who’s name does not even come up in ISA cir­cles can ex­per­i­ment with at low cost and teach to other peo­ple in the re­gion.

That’s what free­dom looks like.

Nobody asked per­mis­sion, no­body signed any­thing, no­body pays a roy­alty per unit shipped and any­body can learn down to the RTL the sil­i­con is built on.  So when Grinberg in his ar­ti­cle lists priv­i­lege sep­a­ra­tion among the things the cheap end does not need and there­fore does not get, it is de­scrib­ing a prop­erty of ARM’s prod­uct seg­men­ta­tion and at­tribut­ing it to in­struc­tion set de­sign. On RISC-V it is a check­box in the priv­i­leged spec, you leave it off in a ten cent part be­cause it costs area you do not want to spend, and you turn it on when you do, and the in­struc­tion set un­der­neath is the same ei­ther way.

That is the real dif­fer­ence be­tween the two ecosys­tems, and it is why “one ISA can­not serve both ends” reads dif­fer­ently de­pend­ing on which side you are stand­ing on. On one side the ends are sep­a­rated by physics and cost, on the other they are sep­a­rated by physics, cost, and a con­tract.

The Thing He Calls Fragmentation

Before I close I want to ad­dress his stance on frag­men­ta­tion. He is not wrong that the ex­ten­sion mech­a­nism frag­ments the stan­dard. Zcb split­ting off from C is an­noy­ing and Zicsr not be­ing im­plied by the base is an­noy­ing. Vendors adding pro­pri­etary in­ter­rupt hard­ware does frag­ment things fur­ther, I learned first hand port­ing NuttX to the CH32V307 Porting Apache NuttX RTOS to the WCH CH32V307: A Deep Dive into the PFIC and Everything That Went Wrong.

But that mech­a­nism is the an­swer to his own open­ing ques­tion. The rea­son one in­struc­tion set can sit in a ten cent part with six­teen reg­is­ters and also in a chip run­ning a pro­tected multi-process op­er­at­ing sys­tem is pre­cisely that the small part is not car­ry­ing the large part’s bag­gage. There is no com­pro­mise core in the mid­dle serv­ing both badly, which is what “diametrically op­posed re­quire­ments” would nor­mally force. Fragmentation and scal­a­bil­ity are the same prop­erty, you do not get one with­out the other and whether the trade­off was worth it is a fair ar­gu­ment and I do not think it has an ob­vi­ous an­swer.

What I do think is that he is right about the im­por­tant part, and right in a way that favours the thing he is crit­i­cis­ing. RISC-V is not go­ing to take the cheap mi­cro­con­troller space be­cause its en­cod­ing is el­e­gant. It is go­ing to take it be­cause the part costs ten cents, and be­cause the lad­der above it is the same in­struc­tion set all the way up. It is go­ing there be­cause an em­bed­ded en­gi­neer in a 3rd world coun­try can shine a cheap LED and see the tran­sis­tors in the sil­i­con, In­fra-Red, In Situ (IRIS) Inspection of Silicon « bun­nie’s blog and get 50 chips with a de­bug­ger and free de­vel­op­ment tools for the price of a cup of cof­fee and shipped free. It also means that world class en­gi­neers can de­sign MMUs onto chips that the gate keep­ers will never give a li­cense for.

He writes that this will hap­pen “not due to its ISA de­sign, but de­spite it,” and he means it as a mild in­dict­ment. Read it from here and it is not one. Winning on price and avail­abil­ity is not a lesser way to win. It de­cides who is in the room. An ar­chi­tec­ture that ar­rives in my coun­try at ten cents a part, with an open tool­chain and no li­cense to ne­go­ti­ate, puts em­bed­ded sys­tems within reach of peo­ple who were pre­vi­ously go­ing to watch some­body else’s demo board and con­sume thier prod­ucts with­out ever be­ing able to match what they have ac­cess to. That’s the power of free­dom, open­ness and is democ­racy in it’s truest sense.

That is a bet­ter rea­son than el­e­gance. and I want to tell Mr Grinberg, that the word priv­iledge he tosses around in his ar­ti­cle also ex­tends be­yond the ISA de­pend­ing on where you are in the world.

Nuff said.

Armstrong Subero is an em­bed­ded sys­tems en­gi­neer and pub­lished au­thor with Apress/Springer. He builds the Rovari RISC-V ed­u­ca­tion plat­form from Trinidad and Tobago.

We’re sorry…

… but your com­puter or net­work may be send­ing au­to­mated queries. To pro­tect our users, we can’t process your re­quest right now.

Stripe has fi­nal­ized a deal to ac­quire OpenRouter, ac­cord­ing to a new re­port in Bloomberg.

OpenRouter helps cus­tomers to se­lect dif­fer­ent AI mod­els to per­form dif­fer­ent tasks, de­pend­ing on their spe­cific needs and bud­get. The com­pany an­nounced in May that it had raised a $113 mil­lion Series B, at a re­ported $1.3 bil­lion val­u­a­tion. (Investors in­clude Sequoia, Andreessen Horowitz, Menlo Ventures, and Alphabet’s Capital G.)

At the time, OpenRouter CEO Alex Atallah de­scribed the com­pany as the equiv­a­lent of Stripe for AI, be­cause it pro­vides cus­tomers with a sin­gle ac­cess point for dif­fer­ent sys­tems and pre­vents lock-in. The startup also claimed to have 8 mil­lion global users and to pro­vide ac­cess to more than 400 mod­els.

The Wall Street Journal re­ported last month that Stripe and OpenRouter were in ac­qui­si­tion talks. Now, Bloomberg said those dis­cus­sions have led to a deal price of more than $7 bil­lion.

A Stripe spokesper­son told TechCrunch that the com­pany does not com­ment on ru­mors or spec­u­la­tion.

We’ve de­tected un­usual ac­tiv­ity from your com­puter net­work

To con­tinue, please click the box be­low to let us know you’re not a ro­bot.

Why did this hap­pen?

Please make sure your browser sup­ports JavaScript and cook­ies and that you are not block­ing them from load­ing. For more in­for­ma­tion you can re­view our Terms of Service and Cookie Policy.

Need Help?

For in­quiries re­lated to this mes­sage please con­tact our sup­port team and pro­vide the ref­er­ence ID be­low.

Block ref­er­ence ID:3ca9eb24 – 99fb-11f1-bb7a-b575ea612eea

Get the most im­por­tant global mar­kets news at your fin­ger­tips with a Bloomberg.com sub­scrip­tion.

When I wrote this week about Anthropic’s an­nounce­ment that all Claude mod­els, world­wide, would soon be­gin “watermarking” every­thing they gen­er­ate, in­clud­ing text, to com­ply with this EU reg­u­la­tion, we were left to spec­u­late how this was go­ing to work, be­cause Anthropic of­fered not even a vague de­scrip­tion of how it would work — de­spite the fact that the ti­tle of the an­nounce­ment was, ab­surdly and in­sult­ingly, “How Claude Marks AI-Generated Content”.

My ini­tial spec­u­la­tion was that maybe they’d hide in­vis­i­ble non-print­ing Unicode char­ac­ters in the text. Just spit­balling. Turns out that’s not what they’re go­ing to do. What they’re go­ing to do is ap­ply a form of steganog­ra­phy, where the choice of words (or other to­ken out­put) at in­fer­ence time will leave fin­ger­prints that can later, maybe, be de­tected prob­a­bilis­ti­cally.

I ini­tially guessed “invisible char­ac­ters” not be­cause I did­n’t think of the se­man­tic word-choice tech­nique, but be­cause I was a fool who took Anthropic at its word in their de­scrip­tion of what they would do. Their orig­i­nal sup­port doc­u­ment claims:

When a sup­ported Claude model gen­er­ates text, it weaves an im­per­cep­ti­ble wa­ter­mark di­rectly into the text it­self. You won’t see it, and it does­n’t change the mean­ing, qual­ity, or read­abil­ity of Claude’s re­sponse.

When a sup­ported Claude model gen­er­ates text, it weaves an im­per­cep­ti­ble wa­ter­mark di­rectly into the text it­self. You won’t see it, and it does­n’t change the mean­ing, qual­ity, or read­abil­ity of Claude’s re­sponse.

They say “imperceptible” and “doesn’t change the mean­ing, qual­ity, or read­abil­ity”. Their words. Not al­most im­per­cep­ti­ble. Not slightly changes the mean­ing, qual­ity, or read­abil­ity. That made sense to me, be­cause that’s ab­solutely what I want — nay, de­mand — from any tools I use per­son­ally. It’s un­ac­cept­able for a tool to sac­ri­fice an iota of clar­ity, co­her­ence, mean­ing, qual­ity, etc. for the pur­pose of em­bed­ding hid­den clues within the text to sug­gest its prove­nance. That’s what I would and will de­mand. And Anthropic’s (original) sup­port doc­u­ment un­am­bigu­ously claims that’s what their sys­tem will en­able. So if that were true, I could­n’t see what was left other than hid­ing in­vis­i­ble char­ac­ters within the text.

My er­ror was be­liev­ing Anthropic that their sys­tem would­n’t adul­ter­ate and cor­rupt the se­man­tics of the text their mod­els gen­er­ate. That is in fact ex­actly what they plan to do. I should have my head ex­am­ined for be­liev­ing a sin­gle word of a doc­u­ment ti­tled “How Claude Marks AI-Generated Content” that does­n’t ex­plain, at all, how Claude marks (or will mark) AI-generated con­tent.

How It’s Actually Going to Work

Yesterday, on an en­tirely dif­fer­ent web­site than the orig­i­nal “How Claude marks AI-generated con­tent” ar­ti­cle (the one that did­n’t ex­plain any­thing at all about how it works), Anthropic pub­lished “How Claude’s Text Watermark Works”, which does ac­tu­ally ex­plain in lay­man-ac­ces­si­ble terms how it’s go­ing to work. I will re­turn to Anthropic’s new highly eu­phemistic and slightly mis­lead­ing de­scrip­tion be­low.

There’s a bunch of re­search on this topic, some of which I have also linked to be­low. But the very best de­scrip­tion of the gen­eral idea be­hind the tech­nique is an in­ter­ac­tive es­say by James Padolsey, “How AI Text Watermarking Works”. It’s a won­der­fully co­gent read, and the in­ter­ac­tive el­e­ments splen­didly il­lus­trate the main con­cepts. A+ work. If you have any in­ter­est in this at all, I dare say you must read — and play with — Padolsey’s piece.

But here’s my stab at a lay­man’s high-level sum­mary. If you toss a coin N times and note the re­sults, you can de­ter­mine with a de­gree of cer­tainty whether the coin is fair or bi­ased. LLMs are, in their pop­u­lar in­car­na­tions, non-de­ter­min­is­tic. Ask the same ques­tion of the same model and you of­ten get at least slightly dif­fer­ent an­swers. Maybe the same mean­ing, but dif­fer­ent phras­ing. At each de­ci­sion point for gen­er­at­ing the next to­ken, the model makes a choice. With these se­man­tic wa­ter­mark­ing tech­niques, they make dif­fer­ent choices for some to­kens based on word lists that could be called “green” and “red”. At each de­ci­sion point, they’re a lit­tle more likely to pick a word from the green list than the red list. That does­n’t mean they never choose words from the red list. Just that they’re less likely to than they would if the adul­ter­ated mark­ing tech­nique weren’t in place. (Same way that a crooked 51 – 49 coin will still land “wrong” side up 49 times out of 100 on av­er­age.)

Words or word phrases are sorted into the green and red lists de­ter­min­is­ti­cally on the fly, at each “next to­ken” gen­er­a­tion point. So some­times a spe­cific word will be on the green list, and other times it will be on the red list. Someone with the se­cret key can de­ter­mine which list a word will be on at each to­ken gen­er­a­tion point (which is how the wa­ter­mark­ing is de­tected); those with­out the se­cret key can­not. This means there will never be a list of words that Claude prefers or es­chews.

With coin flip­ping, the higher N is — the more times you flip — the more con­fi­dent you can be that the coin is fair or bi­ased. So too with this se­man­tic wa­ter­mark­ing. The more words in the text, the more ac­cu­rate the analy­sis will be that the text was gen­er­ated by a spe­cific AI model or not. With too few coin flips, you can’t achieve any con­fi­dence at all re­gard­ing a coin’s fair­ness. With too few words (or to­kens), there’s no way to achieve any con­fi­dence whether a string of text was AI-generated or not.

Given a string of text to ex­am­ine for signs of a spe­cific wa­ter­mark­ing sys­tem, if there are more words tagged as green and fewer tagged as red than would oth­er­wise be ex­pected, the text can be flagged — with some de­gree of con­fi­dence — as hav­ing been gen­er­ated, or merely mod­i­fied, by the AI sys­tem that ap­plies the spe­cific se­cret-key wa­ter­mark­ing sys­tem. The amount of con­fi­dence in the de­ter­mi­na­tion will ob­vi­ously vary, sig­nif­i­cantly, based on the size of the text string and ran­dom­ized weights given to words on the green and red lists. But only Anthropic will be able to de­ter­mine if text was seem­ingly gen­er­ated by Claude, and Anthropic will only be able to de­tect the wa­ter­marks that are ap­plied by Claude. Claude can’t de­tect the hid­den wa­ter­mark sig­nals gen­er­ated by, say, Gemini, and Gemini can’t de­tect the hid­den wa­ter­mark sig­nals cre­ated by Claude, be­cause each im­ple­men­ta­tion is pred­i­cated on se­cret keys held only by the LLM provider.

Objections to the Technical Premise

One of my fun­da­men­tal prob­lems with this is that no two syn­onyms carry the ex­act same mean­ing. “He leaped at the chance” and “He jumped at the op­por­tu­nity” are very sim­i­lar sen­tences ex­press­ing the same gen­eral sen­ti­ment, but they are not the same. The ex­act words we choose when writ­ing mat­ter. I want any LLM I use to choose the very best, most pre­cise words at every sin­gle de­ci­sion point. An ob­vi­ous con­straint that I ac­cept is time and com­pu­ta­tion. Within the con­straint of ex­e­cut­ing in­fer­ence quickly, and at a cer­tain cost per to­ken, I want the best words. This con­straint matches hu­man writ­ing. I could surely write a bet­ter col­umn by tak­ing longer to write it. I write with a sense of how much care I should put into every word and punc­tu­a­tion choice I make. I take more time with cer­tain para­graphs, sen­tences, or even in­di­vid­ual word choices when my gut feel­ing says I should.

In other words, these are nec­es­sary trade-offs. These fac­tors are all in my in­ter­est: speed, cost, qual­ity. Ideally I would like per­fect writ­ing, at in­stan­ta­neous gen­er­a­tion speed, at zero cost. None of those things are pos­si­ble. Computation is not free of charge (and cloud-based LLM in­fer­ence with lead­ing mod­els is ac­tu­ally ex­pen­sive). Inference is not in­stan­ta­neous. And great writ­ing, whether nat­ural or ar­ti­fi­cial, can only ap­proach per­fec­tion.

The idea that any­thing other than my needs should fac­tor into the gen­er­a­tion of text for me is patently of­fen­sive.

This is­n’t just about text one might gen­er­ate with the in­ten­tion of pass­ing it off as their own nat­ural work. This is­n’t even about LLM proof­read­ing of work writ­ten by hand. Anthropic is say­ing that all new Claude mod­els are go­ing to adul­ter­ate every sin­gle bit of text longer than 200 to­kens (~150 words) they gen­er­ate, in­clud­ing every­thing it pre­sents to its users to read. So even in a pri­vate con­ver­sa­tion be­tween a user and Claude, which will never be read by any­one other than the user, Claude will be­gin mak­ing word choices in the name of mark­ing its out­put in sta­tis­ti­cally pre­dictable ways rather than max­i­miz­ing clar­ity and pre­ci­sion.

Even to­day’s so-called fron­tier mod­els are al­ready de­cid­edly lack­ing in lu­cid­ity. Claude, ChatGPT, Grok, et al. are “better writ­ers” than most hu­mans and pro­duce bet­ter prose than the me­dian hu­man. But: no shit. Most peo­ple are ter­ri­ble writ­ers. The “average per­son” is pretty stu­pid and half of all peo­ple are stu­pider than that. And there are many smart, in­ter­est­ing peo­ple who are mis­er­able writ­ers. So as im­pres­sive as LLMs are, the bar is low. The best writ­ing I see come out of these mod­els is worse than any­thing I would choose to read for plea­sure. And now Anthropic is say­ing they’re go­ing to make it worse, on pur­pose, for pur­poses that do not ben­e­fit me in any way? Even if only slightly worse?

Get fucked.

Objections to the EU Regulation

Speaking of ob­jec­tions, the rel­e­vant EU reg­u­la­tion mo­ti­vat­ing all of this, “Code of Practice on Transparency of AI-Generated Content”, is red-tape nanny-state pipe-dream non­sense. Here’s Ben Thompson’s sum­mary from a pay­walled Stratechery up­date this week:

The reg­u­la­tion ap­plies to text longer than 200 to­kens. The provider must man­date in their terms-of-ser­vice that users not re­move the wa­ter­mark­ing. The so­lu­tion should be ro­bust in terms of evad­ing “typical pro­cess­ing so­lu­tions” like screen shots, scan­ning and OCR, copy-and-past­ing, trans­la­tions, etc.

The reg­u­la­tion ap­plies to text longer than 200 to­kens.

The provider must man­date in their terms-of-ser­vice that users not re­move the wa­ter­mark­ing.

The so­lu­tion should be ro­bust in terms of evad­ing “typical pro­cess­ing so­lu­tions” like screen shots, scan­ning and OCR, copy-and-past­ing, trans­la­tions, etc.

Taken lit­er­ally, com­pli­ant LLM terms of ser­vice must for­bid users from rephras­ing the out­put from mod­els that com­ply with this reg­u­la­tion, be­cause the word choices are the marks. But it’s not the European Union that is try­ing to im­pose their ab­surd, im­prac­ti­cal, witch-hunt-fu­el­ing reg­u­la­tion on the en­tire world. That falls on Anthropic.

Complying with this, par­tic­u­larly with re­gard to text, is only go­ing to cre­ate prob­lems for hon­est users. Dishonest users at­tempt­ing to pass off AI-generated text as their own writ­ing (students, em­ploy­ees, who­ever) will sim­ply cir­cum­vent de­tec­tion through non-com­pli­ant AI para­phras­ing tools.

James Padolsey — whose in­ter­ac­tive vi­sual ex­pla­na­tion of how these schemes work I linked to above — ex­plains this in a post ti­tled “Anthropic’s Weak Watermarks Appease a Weak Law” (which, if it rings a bell, I linked to in a stand­alone post ear­lier to­day):

The same thought that led to this law could have ap­plied to cal­cu­la­tors at the time of their in­cep­tion, had their out­puts re­vealed them­selves through arte­facts. Thankfully, a sum borne of the brain is treated no dif­fer­ently from one pro­duced by a cal­cu­la­tor. Likewise with spellcheck­ers. To make as­sis­tance sus­pect only once the tool be­comes ca­pa­ble enough to com­pose a whole sen­tence is not a prin­ci­pled bound­ary. It is a moral pre­mium placed on dif­fi­culty it­self.

Anthropic has nev­er­the­less cho­sen a blan­ket, model-level im­ple­men­ta­tion that ap­pears broader than the law’s min­i­mum re­quire­ment. That may be con­ve­nient com­pli­ance en­gi­neer­ing, but it dis­cards dis­tinc­tions the law ex­pressly at­tempted to pre­serve. The re­sult is a sig­nal broad enough to im­pli­cate harm­less and as­sis­tive use, yet frag­ile enough to be re­moved by a mo­ti­vated per­son through sub­stan­tial re­com­po­si­tion. It risks con­cen­trat­ing sus­pi­cion on or­di­nary and as­sis­tive users while re­main­ing weak­est against de­lib­er­ate de­cep­tion.

The same thought that led to this law could have ap­plied to cal­cu­la­tors at the time of their in­cep­tion, had their out­puts re­vealed them­selves through arte­facts. Thankfully, a sum borne of the brain is treated no dif­fer­ently from one pro­duced by a cal­cu­la­tor. Likewise with spellcheck­ers. To make as­sis­tance sus­pect only once the tool be­comes ca­pa­ble enough to com­pose a whole sen­tence is not a prin­ci­pled bound­ary. It is a moral pre­mium placed on dif­fi­culty it­self.

Anthropic has nev­er­the­less cho­sen a blan­ket, model-level im­ple­men­ta­tion that ap­pears broader than the law’s min­i­mum re­quire­ment. That may be con­ve­nient com­pli­ance en­gi­neer­ing, but it dis­cards dis­tinc­tions the law ex­pressly at­tempted to pre­serve. The re­sult is a sig­nal broad enough to im­pli­cate harm­less and as­sis­tive use, yet frag­ile enough to be re­moved by a mo­ti­vated per­son through sub­stan­tial re­com­po­si­tion. It risks con­cen­trat­ing sus­pi­cion on or­di­nary and as­sis­tive users while re­main­ing weak­est against de­lib­er­ate de­cep­tion.

Padolsey is the cre­ator of Declaude, a de­light­fully sim­ple web app that al­lows you to “Paste in AI-flavored text and get the same con­tent back as plain prose”. Declaude’s orig­i­nal pur­pose is clean­ing the sac­cha­rine Claude per­son­al­ity stink from text (whether it was cre­ated by Claude or any other LLM), but, if Anthropic per­sists in its stated plan to be­gin adul­ter­at­ing all text Claude gen­er­ates, Declaude will also serve as a copy-paste sin­gle-ex­tra-step way to elim­i­nates those marks. Declaude is in­ter­est­ing and use­ful al­ready, but it ex­em­pli­fies how ill-con­sid­ered and fu­tile this EU reg­u­la­tion is when it comes to prose.

Google SynthID

Google has a wa­ter­mark­ing sys­tem in place that they call SynthID, which they ap­ply to AI-generated im­ages, video, au­dio, and text. I’m con­cerned in this ar­ti­cle only with text. With mul­ti­me­dia, em­bed­ded wa­ter­marks can be meta­data within files, and truly not af­fect the ex­pe­ri­en­tial qual­ity of the work when viewed or lis­tened to. With text, we are talk­ing about the ac­tual words that are cho­sen. From the “AI-generated text” sec­tion of Google DeepMind’s own de­scrip­tion of SynthID:

We’ve ex­panded SynthID to wa­ter­mark­ing and iden­ti­fy­ing text gen­er­ated by the Gemini app and web ex­pe­ri­ence. Large lan­guage mod­els gen­er­ate text one word (token) at a time. Each word is as­signed a prob­a­bil­ity score, based on how likely it is to be gen­er­ated next. So for a sen­tence like “My fa­vorite trop­i­cal fruits are mango and…”, the word “bananas” would have a higher prob­a­bil­ity score than the word “airplanes”. SynthID ad­justs these prob­a­bil­ity scores to gen­er­ate a wa­ter­mark. It’s not no­tice­able to the hu­man eye, and does­n’t af­fect the qual­ity of the out­put.

We’ve ex­panded SynthID to wa­ter­mark­ing and iden­ti­fy­ing text gen­er­ated by the Gemini app and web ex­pe­ri­ence. Large lan­guage mod­els gen­er­ate text one word (token) at a time. Each word is as­signed a prob­a­bil­ity score, based on how likely it is to be gen­er­ated next. So for a sen­tence like “My fa­vorite trop­i­cal fruits are mango and…”, the word “bananas” would have a higher prob­a­bil­ity score than the word “airplanes”. SynthID ad­justs these prob­a­bil­ity scores to gen­er­ate a wa­ter­mark. It’s not no­tice­able to the hu­man eye, and does­n’t af­fect the qual­ity of the out­put.

In a group chat, a friend of mine quoted the above, and I re­sponded that if a chat­bot wrote “My fa­vorite trop­i­cal fruits are mango and air­planes”, I’m pretty sure I’d fuck­ing no­tice. Another friend then re­sponded with this:

Days later, that still cracks me up.

But Google’s ab­surd de­scrip­tion puts the lie to their own claim that it is­n’t no­tice­able, and it serves to show just how lit­tle re­gard the peo­ple be­hind these gen­er­ated-text fin­ger­print­ing schemes have for the ac­tual craft of writ­ing. Of course ba­nanas has a higher prob­a­bil­ity score than air­planes, be­cause air­planes aren’t fruit. But what about pineap­ple? Should the sen­tence com­plete to “mango and ba­nanas” or “mango and pineap­ple”? That’s a good ques­tion, and the only ac­cept­able an­swer for why an LLM should choose ba­nanas in­stead of pineap­ple (or co­conut, or guava, or pa­paya…) is that it has de­ter­mined that it’s the best fit for the in­tended mean­ing, tone, and sen­ti­ment of the text. Not be­cause ba­nanas is on the wa­ter­mark­ing “green” list and pineap­ple is on the “red” list, even though pineap­ple might be the bet­ter fit. Google’s own sup­pos­edly joc­u­lar de­scrip­tion of how SynthID works in fact cap­tures how the scheme per­verts the text it gen­er­ates.

They’re say­ing you won’t no­tice be­cause if it only chooses ba­nanas over pineap­ple for these fin­ger­print­ing pur­poses, well, they’re both trop­i­cal fruits and who cares. But it’s ut­ter non­sense that the dif­fer­ence is “not no­tice­able to the hu­man eye”. The se­man­tic dif­fer­ence be­tween ba­nana and pineap­ple is just as no­tice­able to the hu­man eye as the taste of the two are to the hu­man tongue.

If it did pro­duce “My fa­vorite trop­i­cal fruits are mango and air­planes”, it’d be in­cred­i­bly stu­pid, but it would­n’t be of­fen­sive be­cause we’d all rec­og­nize that some­thing com­pletely off-key hap­pened. What’s of­fen­sive is that with a sys­tem like SynthId in place, where the fin­ger­print­ing de­ci­sions are mo­ti­vated by a se­cret key, we have no idea whether it com­pleted to “mango and ba­nanas” be­cause ba­nanas was de­ter­mined to be the best next to­ken, or be­cause ba­nanas is in the “green” bucket of words. It calls every sin­gle word choice into ques­tion.

Here’s a pa­per pub­lished in Nature where Google’s team be­hind SynthID pub­lished their work, af­ter putting it into pro­duc­tion with Gemini (née Bard):

We analysed ap­prox­i­mately 20 mil­lion wa­ter­marked and un­wa­ter­marked re­sponses and com­puted the thumbs-up and thumbs-down rates (both as a frac­tion of the to­tal num­ber of thumbs-up and thumbs-down feed­back re­ceived). We found that the thumbs-up rate for the two mod­els dif­fered by 0.01% (with the wa­ter­marked model be­ing higher); and the thumbs-down rate dif­fered by 0.02% (with the wa­ter­marked model be­ing lower). We found both of these dif­fer­ences to be sta­tis­ti­cally in­signif­i­cant, and well within the 95% con­fi­dence in­ter­vals.

From this ex­per­i­ment, we con­clude that over a wide va­ri­ety of real chat­bot in­ter­ac­tions, the dif­fer­ence in re­sponse qual­ity and util­ity, as judged by hu­mans, is neg­li­gi­ble. Subsequently, non-dis­tor­tionary SynthID-Text has been pro­duc­tion­ized and is cur­rently wa­ter­mark­ing re­sponses in Gemini and Gemini Advanced. To the best of our knowl­edge, this eval­u­a­tion rep­re­sents the first sys­tem­atic wa­ter­mark­ing in­ves­ti­ga­tion of its kind within a large-scale pro­duc­tion sys­tem.

We analysed ap­prox­i­mately 20 mil­lion wa­ter­marked and un­wa­ter­marked re­sponses and com­puted the thumbs-up and thumbs-down rates (both as a frac­tion of the to­tal num­ber of thumbs-up and thumbs-down feed­back re­ceived). We found that the thumbs-up rate for the two mod­els dif­fered by 0.01% (with the wa­ter­marked model be­ing higher); and the thumbs-down rate dif­fered by 0.02% (with the wa­ter­marked model be­ing lower). We found both of these dif­fer­ences to be sta­tis­ti­cally in­signif­i­cant, and well within the 95% con­fi­dence in­ter­vals.

From this ex­per­i­ment, we con­clude that over a wide va­ri­ety of real chat­bot in­ter­ac­tions, the dif­fer­ence in re­sponse qual­ity and util­ity, as judged by hu­mans, is neg­li­gi­ble. Subsequently, non-dis­tor­tionary SynthID-Text has been pro­duc­tion­ized and is cur­rently wa­ter­mark­ing re­sponses in Gemini and Gemini Advanced. To the best of our knowl­edge, this eval­u­a­tion rep­re­sents the first sys­tem­atic wa­ter­mark­ing in­ves­ti­ga­tion of its kind within a large-scale pro­duc­tion sys­tem.

To this I say:

Gemini/Bard’s thumbs-up/​thumbs-down but­tons are not a good ex­per­i­ment for eval­u­at­ing the ef­fect on qual­ity. If a chat­bot tells me “My fa­vorite trop­i­cal fruits are mango and ba­nanas” in­stead of “mango and pineap­ple”, I’m not go­ing to give the re­sponse a thumbs down be­cause of the fruit it chose. I’d give it a thumbs down if it said “airplanes”, yes, but that’s a straw­man. (The pa­per in Nature even uses “My favourite trop­i­cal fruit is …” as an il­lus­tra­tion, but in the pa­per, the only four next to­kens con­sid­ered are, in or­der of prob­a­bil­ity dis­tri­b­u­tion, mango, ly­chee, pa­paya, and durian. No air­planes. And, con­ve­niently, in the pa­per’s ex­am­ple, the “winner” of the wa­ter­mark­ing “tournament” just hap­pens to be mango, the one that would have been se­lected as the best if the wa­ter­mark­ing weren’t in place.)

Gemini/Bard’s thumbs-up/​thumbs-down but­tons are not a good ex­per­i­ment for eval­u­at­ing the ef­fect on qual­ity. If a chat­bot tells me “My fa­vorite trop­i­cal fruits are mango and ba­nanas” in­stead of “mango and pineap­ple”, I’m not go­ing to give the re­sponse a thumbs down be­cause of the fruit it chose. I’d give it a thumbs down if it said “airplanes”, yes, but that’s a straw­man. (The pa­per in Nature even uses “My favourite trop­i­cal fruit is …” as an il­lus­tra­tion, but in the pa­per, the only four next to­kens con­sid­ered are, in or­der of prob­a­bil­ity dis­tri­b­u­tion, mango, ly­chee, pa­paya, and durian. No air­planes. And, con­ve­niently, in the pa­per’s ex­am­ple, the “winner” of the wa­ter­mark­ing “tournament” just hap­pens to be mango, the one that would have been se­lected as the best if the wa­ter­mark­ing weren’t in place.)

A “difference in re­sponse qual­ity and util­ity, as judged by hu­mans” that is “negligible” does not mean im­per­cep­ti­ble. What they re­ally mean is that it’s only slightly worse and that every­one is ei­ther too stu­pid to no­tice or too in­dif­fer­ent to care.

A “difference in re­sponse qual­ity and util­ity, as judged by hu­mans” that is “negligible” does not mean im­per­cep­ti­ble. What they re­ally mean is that it’s only slightly worse and that every­one is ei­ther too stu­pid to no­tice or too in­dif­fer­ent to care.

It’s widely con­sid­ered that Gemini is be­hind ChatGPT and Claude in qual­ity. Perhaps the fact that they’ve put SynthID-text into pro­duc­tion is one of many rea­sons why. I per­son­ally agree that Gemini’s prose is in­fe­rior. Maybe the use of SynthID has noth­ing to do with the fact that I, along with the gen­eral pub­lic con­sen­sus, con­sider Gemini to be a sec­ond-rate chat­bot — but in that case, maybe it’s the fact that Gemini is a sec­ond-rate chat­bot that makes the dif­fer­ence “negligible” when Google started mix­ing in SynthID-motivated to­kens in its re­sults. It’s a lot more likely that your restau­rant cus­tomers won’t no­tice that you re­placed your reg­u­lar cof­fee with Folgers Crystals if your reg­u­lar cof­fee is sec­ond-rate to start with.

It’s widely con­sid­ered that Gemini is be­hind ChatGPT and Claude in qual­ity. Perhaps the fact that they’ve put SynthID-text into pro­duc­tion is one of many rea­sons why. I per­son­ally agree that Gemini’s prose is in­fe­rior. Maybe the use of SynthID has noth­ing to do with the fact that I, along with the gen­eral pub­lic con­sen­sus, con­sider Gemini to be a sec­ond-rate chat­bot — but in that case, maybe it’s the fact that Gemini is a sec­ond-rate chat­bot that makes the dif­fer­ence “negligible” when Google started mix­ing in SynthID-motivated to­kens in its re­sults. It’s a lot more likely that your restau­rant cus­tomers won’t no­tice that you re­placed your reg­u­lar cof­fee with Folgers Crystals if your reg­u­lar cof­fee is sec­ond-rate to start with.

Anthropic

Now, fi­nally, back to Anthropic’s new “How Claude’s Text Watermark Works”, pub­lished yes­ter­day. I have some com­ments.

To sum­ma­rize:

We use a method of wa­ter­mark­ing that does not have any prac­ti­cal im­pact on the qual­ity or con­tent of Claude’s out­puts; The dif­fer­ence be­tween wa­ter­marked and un-wa­ter­marked text will not be dis­tin­guish­able to read­ers;

To sum­ma­rize:

We use a method of wa­ter­mark­ing that does not have any prac­ti­cal im­pact on the qual­ity or con­tent of Claude’s out­puts;

We use a method of wa­ter­mark­ing that does not have any prac­ti­cal im­pact on the qual­ity or con­tent of Claude’s out­puts;

The dif­fer­ence be­tween wa­ter­marked and un-wa­ter­marked text will not be dis­tin­guish­able to read­ers;

The dif­fer­ence be­tween wa­ter­marked and un-wa­ter­marked text will not be dis­tin­guish­able to read­ers;

Translation: Specific words do not mat­ter and we don’t think any­one reads any­thing closely.

Nothing is added to the text and there are no hid­den char­ac­ters;

Nothing is added to the text and there are no hid­den char­ac­ters;

This would have been worth clar­i­fy­ing at the out­set.

Watermarking won’t be spe­cific to Claude. As of August 2, the EU re­quires AI providers serv­ing its mar­ket to mark AI-generated con­tent. Other ma­jor model de­vel­op­ers have signed the same Code of Practice and will be im­ple­ment­ing their own wa­ter­marks.

Watermarking won’t be spe­cific to Claude. As of August 2, the EU re­quires AI providers serv­ing its mar­ket to mark AI-generated con­tent. Other ma­jor model de­vel­op­ers have signed the same Code of Practice and will be im­ple­ment­ing their own wa­ter­marks.

No other AI provider has stated that they will ap­ply such mark­ing, adul­ter­at­ing all gen­er­ated text, out­side the EU.

Take the sen­tence “The weather to­day was cold and…”. The next word is very un­likely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most cir­cum­stances, it does­n’t mat­ter much to the reader which of these lat­ter two words the model ul­ti­mately chooses — the mean­ing of the sen­tence is largely the same ei­ther way. In cases like this, the choice is set­tled by a ran­dom num­ber.

Take the sen­tence “The weather to­day was cold and…”. The next word is very un­likely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most cir­cum­stances, it does­n’t mat­ter much to the reader which of these lat­ter two words the model ul­ti­mately chooses — the mean­ing of the sen­tence is largely the same ei­ther way. In cases like this, the choice is set­tled by a ran­dom num­ber.

Arguing that grey vs. over­cast “doesn’t mat­ter much to the reader” is the crux of my ar­gu­ment that this en­tire en­deavor is a per­verse adul­ter­ation of what it means to write — or to read. That it’s sub­tle in some ways makes it more per­verse, be­cause it’s sneaky.

In in­ter­nal test­ing, we’ve seen no im­pact of wa­ter­mark­ing on the con­tent, level of cre­ativ­ity, or read­abil­ity of Claude’s text. In the SynthID-Text pa­per, which in­tro­duced the tech­nique we use, Google DeepMind tested this im­pact by serv­ing a model that used wa­ter­mark­ing to a por­tion of their Gemini traf­fic and com­par­ing thumbs-up and thumbs-down rat­ings. They found no sta­tis­ti­cally sig­nif­i­cant dif­fer­ences from the un­wa­ter­marked model. And in a con­trolled study, hu­man raters com­par­ing wa­ter­marked and un­wa­ter­marked an­swers side-by-side saw no dif­fer­ence in qual­ity.

In in­ter­nal test­ing, we’ve seen no im­pact of wa­ter­mark­ing on the con­tent, level of cre­ativ­ity, or read­abil­ity of Claude’s text. In the SynthID-Text pa­per, which in­tro­duced the tech­nique we use, Google DeepMind tested this im­pact by serv­ing a model that used wa­ter­mark­ing to a por­tion of their Gemini traf­fic and com­par­ing thumbs-up and thumbs-down rat­ings. They found no sta­tis­ti­cally sig­nif­i­cant dif­fer­ences from the un­wa­ter­marked model. And in a con­trolled study, hu­man raters com­par­ing wa­ter­marked and un­wa­ter­marked an­swers side-by-side saw no dif­fer­ence in qual­ity.

See above for my ar­gu­ment that this thumbs-up/​thumbs-down data is ab­solutely worth­less in eval­u­at­ing whether the SynthID-style word-bias wa­ter­mark­ing makes text worse. By de­f­i­n­i­tion it must make text worse, un­less the un­der­ly­ing LLM mod­el’s scor­ing is wrong, be­cause the na­ture of the wa­ter­mark­ing al­go­rithm re­quires it to some­times in­crease the prob­a­bil­ity of se­lect­ing a worse word choice and de­crease the prob­a­bil­ity of se­lect­ing the mod­el’s best choice. It’s only a ques­tion of how much worse. What Google’s thumb-count­ing data shows is only that it is­n’t so much worse as to make Gemini users click the thumbs-down but­ton.

Watermarking does­n’t change the mean­ing or ex­pe­ri­ence for the per­son read­ing it, but if you wanted to check af­ter the fact whether the text was likely gen­er­ated by Claude, the wa­ter­mark al­lows you to do so.

Watermarking does­n’t change the mean­ing or ex­pe­ri­ence for the per­son read­ing it, but if you wanted to check af­ter the fact whether the text was likely gen­er­ated by Claude, the wa­ter­mark al­lows you to do so.

No, it does not. Because the en­tire scheme is tied to se­cret keys held only by the AI provider, it only al­lows Anthropic, not “you”, to check any­thing.

When Claude proof­reads text writ­ten by a per­son, what it gives back has gen­er­ally only been lightly edited; be­cause nearly all the words are the per­son’s, there’s very lit­tle (if any­thing) for the wa­ter­mark to at­tach to. Depending on the length of the text and how heav­ily Claude has edited it, those changes might not be enough to make Claude’s in­volve­ment de­tectable. The more Claude writes, the more de­ci­sions it has to make, and the more space there is for a wa­ter­mark.

When Claude proof­reads text writ­ten by a per­son, what it gives back has gen­er­ally only been lightly edited; be­cause nearly all the words are the per­son’s, there’s very lit­tle (if any­thing) for the wa­ter­mark to at­tach to. Depending on the length of the text and how heav­ily Claude has edited it, those changes might not be enough to make Claude’s in­volve­ment de­tectable. The more Claude writes, the more de­ci­sions it has to make, and the more space there is for a wa­ter­mark.

Translation: No one can ever again use Claude for proof­read­ing their own prose un­less they’re will­ing to risk that the whole thing might be flagged as hav­ing been gen­er­ated by Claude.

For ex­am­ple, once the model has writ­ten “2 + 2 =”, there is a very clear best choice for the next to­ken (if the model is com­plet­ing the sum, there is­n’t an an­swer that’s equally as good as “4”; if it’s talk­ing about George Orwell’s Nineteen Eighty-Four, there is­n’t an an­swer that’s equally as good as “5”). The “nudge” of the wa­ter­mark would­n’t be ap­plied here. For the same rea­son, code — which in very many cases has to be ex­act — has gen­er­ally less wa­ter­mark­ing than some other forms of text.

Having said that, in ar­eas where there is an ar­bi­trary choice be­tween par­tic­u­lar words or terms within the code, the wa­ter­mark can be used, such as com­ments within code. But by de­f­i­n­i­tion, it will have a neg­li­gi­ble ef­fect on the ac­tual code pro­duced.

For ex­am­ple, once the model has writ­ten “2 + 2 =”, there is a very clear best choice for the next to­ken (if the model is com­plet­ing the sum, there is­n’t an an­swer that’s equally as good as “4”; if it’s talk­ing about George Orwell’s Nineteen Eighty-Four, there is­n’t an an­swer that’s equally as good as “5”). The “nudge” of the wa­ter­mark would­n’t be ap­plied here. For the same rea­son, code — which in very many cases has to be ex­act — has gen­er­ally less wa­ter­mark­ing than some other forms of text.

Having said that, in ar­eas where there is an ar­bi­trary choice be­tween par­tic­u­lar words or terms within the code, the wa­ter­mark can be used, such as com­ments within code. But by de­f­i­n­i­tion, it will have a neg­li­gi­ble ef­fect on the ac­tual code pro­duced.

Translation: We value pre­ci­sion in pro­gram­ming code; we do not in prose.

And it is ex­ceed­ingly rich to cite George Orwell’s Nineteen Eighty-Four, ap­prov­ingly, in the con­text of jus­ti­fy­ing a text adul­ter­ation scheme premised on the no­tion that spe­cific words do not mat­ter. I mean what the ac­tual fuck? Orwell!

Lastly, as to why they’re do­ing this:

We’re im­ple­ment­ing wa­ter­mark­ing to com­ply with the EU AI Act. Anthropic, along with sev­eral other ma­jor AI model providers and around 190 to­tal sig­na­to­ries, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This re­quires AI sys­tem providers to use meth­ods of “marking” AI-generated text. We’re ap­ply­ing wa­ter­mark­ing glob­ally at launch be­cause we don’t yet have a durable way to scope it by re­gion.

We’re im­ple­ment­ing wa­ter­mark­ing to com­ply with the EU AI Act. Anthropic, along with sev­eral other ma­jor AI model providers and around 190 to­tal sig­na­to­ries, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This re­quires AI sys­tem providers to use meth­ods of “marking” AI-generated text. We’re ap­ply­ing wa­ter­mark­ing glob­ally at launch be­cause we don’t yet have a durable way to scope it by re­gion.

This, from a com­pany that the Financial Times just re­ported is weeks away from an IPO with an in­tended val­u­a­tion of $2 tril­lion, which would make it one of the 10 high­est-val­ued com­pa­nies in the world — as of to­day, plac­ing it at #7, be­tween TSMC ($2.2T) and Broadcom ($1.9T).

This leaves us to be­lieve that one of the fol­low­ing must be true:

It’s per­fectly rea­son­able that a tech­nol­ogy com­pany val­ued on par with Amazon and TSMC is tech­ni­cally in­ca­pable of com­ply­ing with an EU re­gional law only within the EU it­self.1 Not a cause for con­cern at all.

It’s per­fectly rea­son­able that a tech­nol­ogy com­pany val­ued on par with Amazon and TSMC is tech­ni­cally in­ca­pable of com­ply­ing with an EU re­gional law only within the EU it­self.1 Not a cause for con­cern at all.

Anthropic is in over their heads, wields shock­ingly lit­tle con­trol over their own tech stack, and their im­mi­nent IPO is likely to be re­mem­bered only as a new high-wa­ter mark in the manic global AI bub­ble.

Anthropic is in over their heads, wields shock­ingly lit­tle con­trol over their own tech stack, and their im­mi­nent IPO is likely to be re­mem­bered only as a new high-wa­ter mark in the manic global AI bub­ble.

Also, what hap­pens if an­other ma­jor global mar­ket makes it un­law­ful for AI to se­cretly wa­ter­mark gen­er­ated text?

Reasoning scores keep climb­ing while per-to­ken com­pute keeps drop­ping. GLM-5.2 scores 99.2% on AIME 2026 with about 40 bil­lion pa­ra­me­ters ac­tive per to­ken. Qwen3.5 scores 91.3% with 17 bil­lion ac­tive. DeepSeek V4-Flash runs 13 bil­lion ac­tive. For scale, GPT-4 was ru­mored to run around 280 bil­lion ac­tive pa­ra­me­ters in 2023, and it could barely solve an AIME prob­lem. At the small end, Qwen3.5 9B fits in 6GB of VRAM quan­tized and roughly dou­bles the score of the next best model un­der 10B pa­ra­me­ters on Artificial Analysis’s in­tel­li­gence in­dex. If you only looked at math and code bench­marks, you’d con­clude that mod­els are get­ting smarter per pa­ra­me­ter at an ab­surd rate.

They are, on those bench­marks. Ask the same mod­els a plain fac­tual ques­tion and the pic­ture flips. On SimpleQA, a bench­mark of fac­tual re­call with no tools al­lowed, the cur­rent leader is Gemini 2.5 Pro at 53%, so the best re­call money can buy still misses half the ques­tions. The small mod­els barely reg­is­ter. Artificial Analysis mea­sures Qwen3.5 4B and 9B at hal­lu­ci­na­tion rates of 80 to 82% on its knowl­edge bench­mark, which means that when they don’t know a fact, which is most of the time, they make one up. Ask the 9B for the birth year of a mi­nor 19th-century math­e­mati­cian and you get a con­fi­dent, plau­si­ble, wrong an­swer. The pa­ra­me­ter count did­n’t drop for free. Labs are trad­ing world knowl­edge for rea­son­ing skill, and the trade is de­lib­er­ate.

What the pa­ra­me­ters were for

Facts take space. Research on knowl­edge ca­pac­ity (the “Physics of Language Models” se­ries has the clean­est mea­sure­ments) puts it on the or­der of two bits of fac­tual knowl­edge per pa­ra­me­ter. If you want a model that knows the birth year of every mi­nor Wikipedia fig­ure, the pop­u­la­tion of every Dutch mu­nic­i­pal­ity, and the ar­gu­ment or­der of every func­tion in every npm pack­age, you pay for that in weights, and it’s a big part of why fron­tier mod­els grew to tril­lions of pa­ra­me­ters.

Reasoning com­presses much bet­ter than facts do, be­cause it’s a rel­a­tively small set of pro­ce­dures ap­plied over and over: break the prob­lem into parts, track in­ter­me­di­ate state, check your own work, back­track when a step fails. Distillation and re­in­force­ment learn­ing on ver­i­fi­able tasks turn out to trans­fer those pro­ce­dures into small mod­els re­mark­ably well. Phi-4 is 14 bil­lion pa­ra­me­ters, trained heav­ily on syn­thetic text­book-style data, and it’s good at math and bad at trivia, which tells you ex­actly what its train­ing data con­tained. That mix used to look like a lim­i­ta­tion of the syn­thetic-data ap­proach. It now looks like the de­sign goal.

The knowl­edge that sur­vives the trade has a shape. These mod­els are gen­er­al­ists: they know a lit­tle about nearly every­thing and al­most noth­ing in depth. Ask one about PostgreSQL and it knows what it is, what it’s good at, and roughly how MVCC works, but ask which ver­sion added a spe­cific plan­ner fea­ture and you’re back to in­vented facts. That’s the right layer to keep in weights, be­cause breadth is what lets a model un­der­stand what a ques­tion is about, know what to look up, and judge whether a source is plau­si­ble. The depth is cheap to re­trieve and ex­pen­sive to store, so it’s the part that goes.

Facts rot, pro­ce­dures don’t

A fron­tier train­ing run takes months and costs hun­dreds of mil­lions of dol­lars, and the mo­ment it fin­ishes, the facts in­side it start go­ing stale. Library APIs change, prices change, peo­ple change jobs, and half of what a 2024 model be­lieved about the JavaScript ecosys­tem was out­dated be­fore the model shipped. Every fact you bake into weights has a shelf life, and the only way to re­fresh it is an­other train­ing run.

The pro­ce­dures don’t rot. Algebra worked the same way in 1970 as it does now, and so does break­ing a prob­lem down or spot­ting a con­tra­dic­tion be­tween two sources. A model that’s mostly pro­ce­dure and only lightly loaded with facts does­n’t age the way a knowl­edge-heavy model does. Its train­ing cut­off mat­ters much less, be­cause the cur­rent state of the world was never sup­posed to live in the weights in the first place. I think this is the best ar­gu­ment for the whole ap­proach: it de­cou­ples the ex­pen­sive, slow ar­ti­fact (the trained model) from the thing that changes daily (what’s true).

The har­ness car­ries the knowl­edge

If the model does­n’t know things, some­thing else has to, and that some­thing is the har­ness: re­trieval over a knowl­edge base, tool calls, web search, a filesys­tem full of docs. I wrote ear­lier that Rust is a har­ness for agents, a source of cheap ma­chine-check­able feed­back. This is the same shape from the other side. The model con­tributes rea­son­ing, and every­thing it rea­sons about gets sup­plied at run­time.

You can al­ready watch agents work this way. A cod­ing agent does­n’t need to have mem­o­rized your de­pen­den­cy’s API sur­face, be­cause it greps node_­mod­ules or reads the docs be­fore call­ing any­thing, and its an­swer is grounded in the ver­sion you ac­tu­ally have in­stalled rather than whichever ver­sion dom­i­nated the train­ing data. The re­call that used to be a fixed cost in every for­ward pass be­came an on-de­mand lookup.

A fron­tier model on your GPU

Follow the trend a cou­ple of years out and I think we get a model with fron­tier-qual­ity rea­son­ing, Fable-quality, that runs on a sin­gle con­sumer GPU. The com­pute half is nearly there. DeepSeek V4-Flash rea­sons with about 13 bil­lion ac­tive pa­ra­me­ters per to­ken, well within con­sumer-GPU range. What does­n’t fit is the other 271 bil­lion pa­ra­me­ters sit­ting in its ex­perts, and ex­pert lay­ers are mostly fact stor­age. That’s the part this whole trade makes op­tional. Strip the knowl­edge out and to­tal size shrinks to­ward ac­tive size, and a 20 to 40B model at 4-bit quan­ti­za­tion fits on the 24GB card that’s been sit­ting in gam­ing PCs since 2022.

The catch is that it won’t know much. Ask it a bare fac­tual ques­tion with no tools at­tached and the right be­hav­ior is to say it does­n’t know and go look it up. Paired with a de­cent har­ness, that’s most of what I use a fron­tier model for to­day, run­ning lo­cally with no per-to­ken bill and no data leav­ing the ma­chine.

This mostly solves hal­lu­ci­na­tion

The part I find most promis­ing is what this does to hal­lu­ci­na­tion. When a fact lives in weights, a wrong fact is un­find­able and un­fix­able. You can’t grep the weights, you can’t diff them against last month, and cor­rect­ing one er­ror means a fine-tune that might break who knows what else. The model states the wrong fact with the same flu­ent con­fi­dence as a right one, and there’s no ar­ti­fact to check it against.

When the fact lives out­side the model, a wrong an­swer has an ad­dress. The model cites a doc­u­ment, so you can open the doc­u­ment. If the doc­u­ment is wrong, you edit the doc­u­ment, and every fu­ture query gets the cor­rec­tion, which beats wait­ing for the next train­ing run by roughly a year. Retrieval does­n’t get you to zero, since a model can still mis­read a source or stitch two of them to­gether wrong, but a claim with a source is check­able and a claim from weights is­n’t. A wrong fact in a knowl­edge base is an or­di­nary data bug, the kind we al­ready know how to trace, fix, and write a re­gres­sion test for.

There’s a ver­sion of this fu­ture where the model card stops list­ing a knowl­edge cut­off at all, be­cause what’s left in the weights goes stale on a scale of years in­stead of weeks. The model just gets handed the world’s cur­rent state at run­time, the same way a CPU gets handed a pro­gram.

threat-re­search llm-se­cu­rity

August 10, 2026 Matt Lenhard 5 min read

Share

Where This Started

This is a fol­low-up ar­ti­cle to a piece I re­cently wrote about the to­ken re­lay mar­ket. Noticeably ab­sent from that piece was a men­tion of the rise of “token bro­kers” — peo­ple who buy un­used cred­its from star­tups and then re­sell them.

I first heard about to­ken bro­kers while chat­ting with a good friend of mine who was re­ceiv­ing of­fers for Anthropic to­kens at steep dis­counts.

It was­n’t just him, though. As I started talk­ing to more founders about what I was build­ing, they said the same thing: they were get­ting a lot of in­bound email from peo­ple look­ing to buy or sell off-mar­ket in­fer­ence.

Startups swap­ping cred­its is noth­ing new, and I knew this was hap­pen­ing in sev­eral startup fo­rums and groups, but this was when I re­al­ized that the mar­ket was be­ing com­mer­cial­ized.

So I did what any nor­mal per­son would do. I got the bro­kers’ email ad­dresses and started email­ing them to learn more.

Before my own out­reach, it’s worth see­ing what founders are ac­tu­ally re­ceiv­ing. Both of these were for­warded to me by friends.

I started by sourc­ing a few email ad­dresses from friends. The first two emails I sent bounced, but the third was a hit. Here’s a screen­shot of that con­ver­sa­tion:

What’s in­ter­est­ing is the amount of sup­ply. The seller was of­fer­ing $100k in spend per day.

They aren’t hand­ing out the provider keys di­rectly; in­stead, they act as a proxy that prob­a­bly picks from a pool of keys and for­wards the re­quest.

The Listings

Credit Marketplaces

There are a few web­sites pro­mot­ing credit bro­ker­ing as well. One of them, AI Credits, bills it­self as a credit mar­ket­place. For an­other fla­vor of the pure-play credit re­seller mar­ket­places, take a look at AICreditMart.

These sites of­fer cred­its at most of the ma­jor cloud and in­fer­ence providers.

AI Credits’ on­board­ing process is pretty straight­for­ward, and you can even se­lect your pre­ferred de­liv­ery method as the seller.

I went ahead and listed my cred­its, which are still pend­ing ap­proval.

Bulk Discounts

Another site that I found through a friend was CheapCredits. This site po­si­tions it­self as a router that is able to achieve its dis­counts through “bulk pric­ing.”

I no­ticed that this was a trend with a num­ber of sites that I be­lieve are act­ing as credit bro­kers. They pre­sent them­selves as be­ing able to of­fer dis­counts based on bulk pur­chases. Some other ex­am­ples in­clude Tokvana and Neokens.

Having spent time in the in­dus­try, I’d say that a 40% dis­count is very un­likely un­less you are one of the provider’s top cus­tomers. My hunch is that CheapCredits is ac­quir­ing the sup­ply in other ways.

CheapCredits even has a Data Processing Agreement for any­one look­ing to stay GDPR com­pli­ant.

The Message Boards

I checked where you’d ex­pect to find un­der­ground mar­ket­places.

Telegram had a few chan­nels, with one be­ing rel­a­tively ac­tive.

There are also spo­radic Reddit posts.

If you’ve been hang­ing out in any of the closed-off startup groups, I’m sure you’ve seen a num­ber of these posts as well.

So How Big Is This Market?

My rough es­ti­mate is that, across the sites, fo­rums, and re­sellers I looked at, there are prob­a­bly tens of mil­lions of these cred­its be­ing of­fered.

Unfortunately, when you try to of­fer nice things, abuse is­n’t far be­hind. Tokens have be­come a pseudo-cur­rency, and there is enough liq­uid­ity in the mar­ket to al­low for a lot of abuse. As we see the mar­ket turn and com­pa­nies be­come more aware of costs, crack­downs on this type of abuse prob­a­bly aren’t far be­hind.

Sources

Company and site names be­low are as they pre­sent them­selves pub­licly. Screenshots are from my own out­reach and from brows­ing the sites as a prospec­tive buyer and seller.

Previous piece: An Inside Look at the Relay Market Powering Token Resellers and Fraud

Credit mar­ket­places: AI Credits, AICreditMart

Bulk-discount routers: CheapCredits (cheapcredits.ai), Tokvana, Neokens

Direct out­reach: email ex­change with a bro­ker of­fer­ing $100k/day in spend

Share