Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
10 interesting stories served every morning and every evening.
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
A required part of this site couldn’t load. This may be due to a browser extension, network issues, or browser settings. Please check your connection, disable any ad blockers, or try using a different browser.
16th August 2026
Friday’s big release was Qwen 3.8 27B, an Apache 2 licensed 27B parameter vision-capable LLM from Alibaba’s Qwen research lab. I’ve been looking forward to this one: 27B is an excellent size for running a model on a reasonably specced laptop, and its predecessor Qwen 3.6 27B was impressive.
Qwen’s self-reported benchmarks for this model are eye-opening. They show a boost from both Qwen 3.6 27B and the closed-weight Qwen 3.7-Plus, which was one of Qwen’s strongest models of any size as recently as May this year. It will be interesting to hear what independent benchmarks have to say about the model.
I’ve been running the model on two different machines: my 128GB M5 Max MacBook Pro, and an NVIDIA DGX Spark. On both machines I’m running LM Studio and their 17GB Q4_K_M quantized build. I also tried using llama-server directly on the Spark.
Qwen’s documentation describes the model as defaulting to xhigh for the reasoning effort, and the LM Studio GGUF I’ve been trying preserves that default:
Qwen3.8 comes with official support for reasoning_effort, which can be used to adjust reasoning depth and control cost:
xhigh (default): for complex tasks demanding thorough analysis
medium: balancing accuracy and speed
low: efficient reasoning optimizing for speed and cost
Qwen3.8 comes with official support for reasoning_effort, which can be used to adjust reasoning depth and control cost:
xhigh (default): for complex tasks demanding thorough analysis
medium: balancing accuracy and speed
low: efficient reasoning optimizing for speed and cost
This is a hilarious default. It’s absolutely not a good way to run the model, especially on consumer hardware. I’ve been finding the results extremely entertaining.
I quickly ran into problems with LM Studio’s default context limit of 8,192 tokens—Qwen was using them all up thinking about even the most mundane of problems. I loaded the model with the full 262,144 maximum context length and that problem went away.
Here’s the pelican riding a bicycle SVG I got from my first attempt with that increased context length. It took 21 minutes to generate, using 22,276 reasoning tokens to produce 3,223 tokens of output. You can read the reasoning trace here.
This is by far the best pelican SVG I’ve been able to generate with a model that runs on a local machine—and this Qwen is pretty small, just a 17GB file on disk. There’s a lot to like about this:
The bicycle frame is the right shape
It has legs on each side of the bike—that’s very rare
Good, clear pelican pouch
The wings extend to touch the handlebars!
The motion lines are behind, not in front
It has a tasteful background—nice sun, clouds, hill, flowers and grass.
Was that worth waiting 21 minutes for? Absolutely not.
Here’s that same prompt run with reasoning turned off—transcript here. This one produced 3,715 tokens and took 137s—just over two minutes.
And just for completeness, I used OpenRouter to run the same prompt through the much larger Qwen 3.8 2.4T-A95B (released last week) and got this snazzy animated SVG:
Your browser does not support HTML5 video.
I said Qwen at xhigh has a tendency to over-think things, but how bad really is it?
I tried a much simpler prompt, again with that default extra high setting:
draw an svg of a circle
draw an svg of a circle
Qwen’s reasoning trace started like this:
The user is asking for an SVG drawing of a circle. Simple request — but I want it to be a carefully crafted piece. Let me make something that goes beyond just <circle>: a single self-contained SVG file with character — maybe a geometric “circle study,” with subtle animation, layered rings, and a distinctive palette. Keep the scope right: they asked for an SVG of a circle. So the core is a circle. But I can add craft: concentric guide circles (like a compass/geometry drawing), tick marks, a soft gradient fill on the main circle, restrained ambient motion (a slowly rotating dashed ring, pulsing glow). Respect prefers-reduced-motion? That’s more for CSS; SVG SMIL or CSS inside SVG will do. Palette options: deep teal ink on warm paper? Or bold vermilion circle on off-white with navy construction lines — Bauhaus/compass-drawing vibe. Let me go with a “geometric study” look: cool slate background, or bright paper white? Paper white is fine if it’s not the cream-and-terracotta combo. […]
The user is asking for an SVG drawing of a circle. Simple request — but I want it to be a carefully crafted piece. Let me make something that goes beyond just <circle>: a single self-contained SVG file with character — maybe a geometric “circle study,” with subtle animation, layered rings, and a distinctive palette.
Keep the scope right: they asked for an SVG of a circle. So the core is a circle. But I can add craft: concentric guide circles (like a compass/geometry drawing), tick marks, a soft gradient fill on the main circle, restrained ambient motion (a slowly rotating dashed ring, pulsing glow). Respect prefers-reduced-motion? That’s more for CSS; SVG SMIL or CSS inside SVG will do.
Palette options: deep teal ink on warm paper? Or bold vermilion circle on off-white with navy construction lines — Bauhaus/compass-drawing vibe. Let me go with a “geometric study” look: cool slate background, or bright paper white? Paper white is fine if it’s not the cream-and-terracotta combo. […]
Several minutes later it produced this absolutely beautiful animated circle, which was entirely not what I had asked for!
Your browser does not support HTML5 video.
My strong recommendation: ignore that default. Run Qwen 3.8 27B on low or even no reasoning levels at first. It’s a great model, but wow that default setting is a bad place to start.
It’s very good at bounding boxes
A fun way to test a vision model is to see how well it can return bounding boxes around items in a photograph. I’ve seen previous Qwen models deal well with this, so I decided to put it to the test drawing bounding boxes around some pelicans.
I’ve seen asking for 0 – 1000 scale produce good results in the past. I tried this:
llm -a https://static.inaturalist.org/photos/714731804/large.jpg \ -m lmstudio/qwen/qwen3.8 – 27b \ ‘Return JSON bounding boxes for the pelicans in this photo, 0 – 1000 scale for each dimension’
Here’s the reasoning trace, which produced this:
[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]
This is such a good match. Here are those boxes rendered on top of the photo:
Building a tool to label bounding boxes
That visualization of the bounding boxes was taken using a new custom tool that I had Qwen 3.8 27B build for me, running offline on my laptop.
I forgot to dial down the thinking effort so it was massively over-engineered, but it did manage to produce this full interface from this single prompt:
[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]
Build an HTML page which has an input box for accepting the URL to an image and a textarea for accepting the above style of JSON. It appends the image to the page, measures its width and height, then treats the coords in the bbox_2d as scaled from 0 – 1000 and scales them against the actual width and height, then it renders labelled boxes over the image.
[ {“bbox_2d”: [195, 290, 370, 780], “label”: “pelicans”}, {“bbox_2d”: [445, 320, 675, 850], “label”: “pelicans”} ]
Build an HTML page which has an input box for accepting the URL to an image and a textarea for accepting the above style of JSON.
It appends the image to the page, measures its width and height, then treats the coords in the bbox_2d as scaled from 0 – 1000 and scales them against the actual width and height, then it renders labelled boxes over the image.
This screenshot shows one of the features I did not ask for—a demo scene, for if you don’t have a photograph to test the tool with:
Here’s the relevant segment of the thinking trace, where it decided to draw its own pelicans purely because I had used the label “pelicans” in the example JSON I gave it in the prompt:
Also a “load sample” that uses a known image? Can’t depend on external images, but… the image URL input is user-provided; I could add a “try with sample” button […] Hmm, I can draw a simple scene on canvas, export it as a data URL, and load it into the image — that’s self-contained and demo-able! […] But the user’s coords are for an actual pelican image; a generated placeholder can still demo the scaling. Generate a 1000x1000 placeholder: gradient water + two blob-like “pelican” silhouettes placed at the given bboxes (using the same scale — cute: silhouettes at the exact 0 – 1000 positions, showing the boxes align). This makes for a fun, self-contained demo. Keep it simple: sky gradient, sun, water, two pelican-ish shapes (ellipse body, circle head, beak). Place at bbox centers.
Also a “load sample” that uses a known image? Can’t depend on external images, but… the image URL input is user-provided; I could add a “try with sample” button […] Hmm, I can draw a simple scene on canvas, export it as a data URL, and load it into the image — that’s self-contained and demo-able! […] But the user’s coords are for an actual pelican image; a generated placeholder can still demo the scaling. Generate a 1000x1000 placeholder: gradient water + two blob-like “pelican” silhouettes placed at the given bboxes (using the same scale — cute: silhouettes at the exact 0 – 1000 positions, showing the boxes align). This makes for a fun, self-contained demo. Keep it simple: sky gradient, sun, water, two pelican-ish shapes (ellipse body, circle head, beak). Place at bbox centers.
(I’m slightly nervous that models around the world might have a bias towards drawing pelicans at any chance they can get, brought on by nearly two years of exposure to my own stupid benchmark.)
Is all that over-thinking necessary? Maybe it is, at least a bit. I tried with reasoning turned off and got this version, (transcript here), which nearly works but shows the boxes in the wrong place:
So without reasoning it didn’t quite one-shot a working tool. I’m sure it could get there with some follow-up prompts, but this is a good example of how reasoning can make a difference.
Yes, it can drive coding agents
One of the biggest questions around local models is whether or not they have enough horsepower to successfully run a coding agent loop. Coding agents require long context, strong code generation support and reliable tool-calling. On paper Qwen 3.8 27B has all three of these, so is it up to the task?
My initial experiments with Pi have been very promising. I chose Pi because it has a shorter system prompt than most other options, making it a better fit for trying out smaller models.
I configured Pi to use Qwen 3.8 27B running in LM Studio on the Spark (shared via tailscale serve) by adding this to ~/.pi/agent/models.json:
{ “providers”: { “spark”: { “baseUrl”: “https://spark-18b3.tail68a31.ts.net/v1”, “api”: “openai-responses”, “apiKey”: “dummy”, “models”: [ { “id”: “qwen3.8 – 27b”, “reasoning”: true } ] } } }
Then ran pi –provider spark –model qwen3.8 – 27b in my ~/dev/datasette folder and prompted:
how does auth work?
how does auth work?
After a sequence of reasoning and tool calls that accessed a bunch of different files it produced this reply, which is very solid.
Just one problem: I wanted to share that transcript. So I pointed Pi and Qwen 3.8 27B at the JSONL transcript file in ~/.pi/agent/sessions/–Users-simon-Dropbox-dev-datasette– and prompted:
Write Python code to convert this jsonl to markdown
Write Python code to convert this jsonl to markdown
And it built and tested this pi_jsonl_to_md.py, which did exactly what I needed. Here’s that session transcript, published using the tool that it created.
The quest for speed
So far this is all looking very promising. We have a 17GB model that runs on high-end consumer hardware and can write code, drive tools, annotate images and generally do everything that I need from an LLM for getting real work done.
There’s one very significant catch: it feels slow—especially when it starts over-thinking, but even without that it’s not particularly sprightly.
I’ve been getting around 15 – 30 tokens a second from LM Studio. That’s not terrible, but it’s slow enough that it’s going to be hard to win me away from hosted API models, which can return results a whole lot faster. Artificial Analysis track token speed and show OpenAI 5.6 Sol at 74 tokens/second and 5.6 Luna at an impressive 184/second.
The good news is that the community have been exploring ways to speed things up since the model was first released two days ago.
One of the most promising optimizations is baked into the model itself. Qwen supports Multi-Token Prediction, an architecture trick where a cheaper mechanism guesses several tokens ahead and the main model can then quickly verify if the guesses were correct. This can have quite a dramatic effect on inference performance.
Based on this tweet from llama.cpp creator Georgi Gerganov I tried running the model with MTP like this on the Spark:
llama serve \ -hf ggml-org/Qwen3.8 – 27B-GGUF:Q4_K_M \ -hfd ggml-org/Qwen3.8 – 27B-GGUF:Q4_0 \ –spec-default \ –spec-type draft-mtp \ –reasoning-preserve
And sure enough, this gave me a significant boost. I had GPT-5.6 in Codex run a comparative benchmark on the Spark and the –spec-type draft-mtp server outperformed the LM Studio default GGUF by around 72%.
I expect we’ll see a whole lot more innovation around serving this model faster over the next few weeks. The MLX community likely have some tricks brewing as well.
Some observations
The fact that a 17GB file can do all of this stuff on my home machines is a miracle. Once again, I’m delighted and amazed at how much progress local models have made this year. A year ago this would have been competitive with the best and most expensive of the proprietary models—today it can run on a capable laptop.
The only thing holding this back from being a daily driver is performance. It feels pretty slow on both the M5 Mac and the DGX Spark. That’s the catch with these dense (non-Mixture-of-Experts) models—they require a whole lot of memory bandwidth to perform well, and neither of the machines I have access to are top performers in that regard.
The most important thing about Qwen 3.8 27B is what it demonstrates. We can have an open weights general purpose model with a long context, effective tool calling, strong vision ability, and competent code generation, and we can fit the whole thing in just a 17GB file.
The models at this size continue to get better at an impressive rate. We don’t need to spend half a million dollars on datacenter-class hardware just to run a competent model.
Dmitry Grinberg published a long piece explaining his distaste for RISC-V, you can read his article here: RISC-V: They Should Have Known Better - Dmitry.GR. It went to the front page of Hacker News and it started a good argument on Lobsters. It is the most substantial criticism the architecture has had in a while and though I switched my entire stack away from STM32 and ARM to RISC-V and did a video on it about a year ago Goodbye STM32 ARM — Meet the CH32 RISC-V Chips That Replaced It! , part of me is infuriated because so much of what he said seems like a biased perspective.
Look, I am not going to defend the ISA committee, RISC-V international denied me membership to their golden tower. On the architecture itself, the compressed store offsets really are strange, Zicsr really should not be a separate thing you have to remember to ask for, I have hit every one of these and I have written a book thats about 80% complete about hitting them on the CH32V003, which is one of the very “RV32E” type chip he mentions.
Maybe I should say where I am writing from, because it changes which parts of this argument look important from my perspective.
I work out of Trinidad and Tobago, a small island nation off the coast of Venezuela. When I want a development board I am not clicking through to next day delivery, I am checking whether the seller ships here at all, what customs will do to it (if I get it at all), and what the total lands at in TT dollars. “Free Shipping” from Digikey, Mouser or any US or European manufactuer dosen’t apply to me. I pay anywhere from US $60 to US $200 to ship one dollar chips that people everywhere else get free shipping on. In fact a well known PCB company who reached out to me considering sponsorship turned me down soley based on shipping to my location. Have a look here:
The students I want to teach are in the same position, and so are the ones in Nigeria and Bangladesh and everywhere else the people in the industry does not think about when it writes its blog posts. From that position, the difference between a ten cent part and a one dollar part is not a rounding error and it is not a detail you get to wave past on the way to the interesting discussion about encodings. It is the difference between a class of thirty students each having their own chip and a class of thirty students watching one demo board if any at all. Instruction set elegance is a thing you can afford to care about once the hardware is already on your desk. Whether the hardware can get to your desk at all comes first. That is why the paragraph most people scrolled past is, to me, the most important one in the article.
Grinberg missed that part that RISC-V creates a space for the other 99% outside of “the world” (which in this space “world” is mainly the US and Europe) and it has nothing to do with architecture.
He Derives the Requirements and Lands on RV32EC
Before the interrupt arithmetic, before the encoding complaints, he does something careful. He asks what a cheap microcontroller core is actually for. His answer is that it sits inside a larger chip prodding registers and configuring hardware blocks, in an “MP3 player, an SD card, a USB stick”. The real work is done by custom silicon around it. From that he derives what such a core needs. Low interrupt latency a small die area and good code density, because the code lives in ROM or SRAM and both are expensive per byte. No hardware divider, possibly not even a multiplier, since you are not doing much arithmetic. No privilege separation, because nothing untrusted ever runs there.
Then he writes the line himself:
“But,” you might say, “you just described RV32IC (or RV32EC)!”
“But,” you might say, “you just described RV32IC (or RV32EC)!”
And earlier, plainly:
I am 100% sure that RISC-V will own the cheap-as-dirt single-use microcontroller space eventually.
I am 100% sure that RISC-V will own the cheap-as-dirt single-use microcontroller space eventually.
So the most credible RISC-V critic of the month sat down, worked out from first principles what a cheap microcontroller core should be, arrived at the instruction set a ten cent chip implements, and stated that this segment is going to be RISC-V’s.
He derives the case for the chip and then spends the rest of the article annoyed that the chip exists.
This is almost satirical.
His quarrel is with whether that outcome was earned. That is a real question and I understand why it bothers him. It is not, however, a question that affects anybody deciding what to learn on, because the chip is on the shelf either way.
Where I Actually Disagree, Strongly.
His central claim is the first one in the article, and it is bigger than any of the encoding complaints:
Simply put, the things a high-end CPU needs are diametrically opposed to the things a small cost-saving microcontroller core needs.
Simply put, the things a high-end CPU needs are diametrically opposed to the things a small cost-saving microcontroller core needs.
The conclusion he draws is that no single ISA can serve both ends, and that RISC-V fans are fooling themselves, in theory the premise is true. The conclusion does not follow, and I can show you why from three parts sitting on my desk as we speak.
CH32V003. This is the cheap “RV32EC” with sixteen registers, no multiplier, no divider, machine mode only, 2KB of SRAM, 16KB of flash, ten cents, it’s EXACTLY the core he specified. I shipped two products with these, one is a bin monitor that has a ToF sensor, an LED and an air tag. The other is an agricultural product for a client that opens and closes a door at a certain time. It also makes a good throw away part, as I show case in my whistle switch Clap Switch Is Dead. Here’s the RISC-V Powered Whistle Switch! and which in my view is the BEST part to replace the overpriced, outdated Arduino Did Arduino Q Ruin Arduino? - Here’s how to Switch to RISC-V with the CH32V003.
CH32H417. A dual core MCU that is unmatched in performance to price point and is at the higher end of the MCU line of things. It has a QingKe V5F at 400 MHz alongside a V3F at 144 MHz, 896KB of SRAM, 960KB of flash. USB 3.2 Gen1 with an integrated 5 Gbps transceiver, 100M Ethernet MAC and PHY, a SerDes isolated transceiver, a 500 MB/s high speed interface, SDMMC, a camera interface, a display controller, a graphics accelerator etc etc. I got a web browser running on this thing I Built a Web Browser on a RISC-V Microcontroller (No Linux) Quantum entropy based GAN cat generation Schrödinger’s De/Motivational Quantum Cat: GAN Image Generation on CH32 RISC-V Microcontroller and real-time facial recognition Real Time Facial Recognition on The Edge With CH32H417 RISC-V MCU in under 150KB of ram. I got a host of other projects running but those are just some I got time to record and put up.
Baochip. A VexRISC-V with an MMU built around a stack thats open from silicon to os Baochip-1x: A Mostly-Open, 22nm SoC for High Assurance Applications « bunnie’s blog, that runs Xous betrusted-io/xous-core: The Xous microkernel designed by legendary hardware hacker “bunnie” Huang , a Rust microkernel with real process isolation. Privilege separation, the exact thing he says the cheap end does not need and therefore does not get. In addition to Xous it also supports operating systems like SEL4 vk2seb/bao1x-seL4: seL4 port to baochip-1x and Linux pkoscik/baochip-linux: An attempt to boot mainline Linux on a stock Dabao board. I wrote the bare metal C SDK for the chip ArmstrongSubero/dabao-sdk: Bare metal C SDK for the Baochip-1x RISC-V SoC and it was of course the chip inside the badge of DEFCON 34 The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key | WIRED this year.
I can also point to the NES emulator I wrote for the $1 ESP32C3 RISC-V based chip NES Emulator on $1 ESP32-C3 RISC-V Microcontroller, or experimenting with Linux on the Orange Pi RV2 OrangePi RV2 5 Minute Unboxing and Setup | RISC-V Ubuntu Linux that takes 5 minutes to setup and has been running since the day I boot it up.
Point is I could go on and on about how diverse and accessible currently shipping RISC-V parts are, but then we’ll be straying too much from the topic at hand.
I linked all those to say this, that all these parts all have the same base instruction set and I gained expertise in all in under a year and under US $100 across the entire stack, from disposible silicon to PC level, of course minus data center compute.
For under US $100 including shipping I was able to explore an entire vertical stack using one architecture. Due to the AI race the OrangePi RV2 has now gone up in price but at release it cost $30 and shipped free. For about 7 dollars I got 50 CH32V003s with a debugger, the CH32H417 board is $20 on analog lamb and uses the same cheap (and official) debugger for the CH32V003 and the Baochip Dabao board (which I wrote a book about by the way check it out here (The Dabao Book - Payhip) was $9.50 on crowd supply when I bought it, two with shipping from crowd supply cost me $35, under $100 in total. A debugger for an ARM part alone a Segger J-Link costs about $600, though I guess for that $100, and add another $100 to ship,so about $200 I could get an EDU edition J-link and no chips or boards. Yaay.
Back to RISC-V, across all these parts, the base set is the same. So that means the same register model, same calling convention, same toolchain. Yes the extensions differ, but the thing is what I learned writing assembly on the ten cent CH32V003 part did not stop being true on any of the others. A dual core MCU, an SBC running Linux or an advanced custom security chip running a novel operating system. My skills were transferrable to the point that in each case within a few hours I had toolchains setup, could focus on my applications and when debugging I felt at home. All I need to work with them is the ISA manual and a C compiler.
Now price the same journey on the other side, forget x86 – 64 and that duopoly, patent minefield, with multi-thousand dollar debug probes; we’ll take a look at ARM.
The equivalent to the CH32V003 is the Cortex-M0 is ARMv6-M so something like an STM32F030, step it up we have a Cortex-M7 which is ARMv7-M, to get an MMU in a part for Linux or SEL4 and Xous, you’re looking at an application processor like the ARMv8-A. These are different Arm profiles with significantly different privilege, exception, and system models, so moving up the stack involves substantially more relearning than simply enabling another RISC-V extension. Trust me I’ve used them all.
And at the top of that range the gap is not even about learning curves. There is no Cortex-M microcontroller with an integrated USB 3.0 SuperSpeed PHY. The nearest dual core Arm part is an STM32H747, which is a fine chip and does not have one. If you need USB 3.0 you leave the microcontroller class entirely: an i.MX 8 or an RK3xxx, which means Cortex-A. You want an MMU, Linux, DDR, a PMIC, and a board you are not laying out in two layers. Or you keep the M7 and add an external bridge chip.
The H417 evaluation board is around twenty dollars. The H747 in TFBGA240 carries a twenty week manufacturer lead time, chip only, costs about the same, before you have anything to plug in, and Mouser asks for ID before you can order, Digikey has also been known to deny people parts depending on where they are and their name as Hussein Ali, well known Youtuber from NorthridgeFix describes Starlink Repair - Digi-key refused my order.. Oh and it’s about US $60 – 100+ to ship to my location. I can pick up H417s on the official WCH store on Aliexpress with free shipping and no verification hullabalu. We haven’t even started talking about the Cortex-A parts that have MMUs or thier debugging tools and ecosystem fragmentation.
The Boundary Is Not Technical
Here is the part that undercuts his framing most directly, and it has nothing to do with encodings. He treats the gap between a small core and a large one as an architectural fact, something that falls out of opposed requirements. On ARM chips it is not an architectural fact. It is a PRODUCT boundary, and it is enforced by licensing. Has anyone tried adding an MMU to a Cortex-M? The physical tradeoffs are real, the difference is that with RISC-V, the ISA owner does not decide for you where that boundary must be drawn. If you want virtual memory on ARM you license a Cortex-A instead, which is a different core family, a different profile, a different negotiation, and a different royalty. There is no incremental path. there is a wall, with a sales team on the other side of it.
Compare what happened with Baochip. The RISC-V privileged specification defines supervisor mode and Sv32 paging as optional things an implementation may provide. VexRISC-V is an open core, somebody added an MMU to it. bunnie built a chip around it and runs a microkernel with real process isolation on it that me in Trinidad a country who’s name does not even come up in ISA circles can experiment with at low cost and teach to other people in the region.
That’s what freedom looks like.
Nobody asked permission, nobody signed anything, nobody pays a royalty per unit shipped and anybody can learn down to the RTL the silicon is built on. So when Grinberg in his article lists privilege separation among the things the cheap end does not need and therefore does not get, it is describing a property of ARM’s product segmentation and attributing it to instruction set design. On RISC-V it is a checkbox in the privileged spec, you leave it off in a ten cent part because it costs area you do not want to spend, and you turn it on when you do, and the instruction set underneath is the same either way.
That is the real difference between the two ecosystems, and it is why “one ISA cannot serve both ends” reads differently depending on which side you are standing on. On one side the ends are separated by physics and cost, on the other they are separated by physics, cost, and a contract.
The Thing He Calls Fragmentation
Before I close I want to address his stance on fragmentation. He is not wrong that the extension mechanism fragments the standard. Zcb splitting off from C is annoying and Zicsr not being implied by the base is annoying. Vendors adding proprietary interrupt hardware does fragment things further, I learned first hand porting NuttX to the CH32V307 Porting Apache NuttX RTOS to the WCH CH32V307: A Deep Dive into the PFIC and Everything That Went Wrong.
But that mechanism is the answer to his own opening question. The reason one instruction set can sit in a ten cent part with sixteen registers and also in a chip running a protected multi-process operating system is precisely that the small part is not carrying the large part’s baggage. There is no compromise core in the middle serving both badly, which is what “diametrically opposed requirements” would normally force. Fragmentation and scalability are the same property, you do not get one without the other and whether the tradeoff was worth it is a fair argument and I do not think it has an obvious answer.
What I do think is that he is right about the important part, and right in a way that favours the thing he is criticising. RISC-V is not going to take the cheap microcontroller space because its encoding is elegant. It is going to take it because the part costs ten cents, and because the ladder above it is the same instruction set all the way up. It is going there because an embedded engineer in a 3rd world country can shine a cheap LED and see the transistors in the silicon, Infra-Red, In Situ (IRIS) Inspection of Silicon « bunnie’s blog and get 50 chips with a debugger and free development tools for the price of a cup of coffee and shipped free. It also means that world class engineers can design MMUs onto chips that the gate keepers will never give a license for.
He writes that this will happen “not due to its ISA design, but despite it,” and he means it as a mild indictment. Read it from here and it is not one. Winning on price and availability is not a lesser way to win. It decides who is in the room. An architecture that arrives in my country at ten cents a part, with an open toolchain and no license to negotiate, puts embedded systems within reach of people who were previously going to watch somebody else’s demo board and consume thier products without ever being able to match what they have access to. That’s the power of freedom, openness and is democracy in it’s truest sense.
That is a better reason than elegance. and I want to tell Mr Grinberg, that the word priviledge he tosses around in his article also extends beyond the ISA depending on where you are in the world.
Nuff said.
Armstrong Subero is an embedded systems engineer and published author with Apress/Springer. He builds the Rovari RISC-V education platform from Trinidad and Tobago.
We’re sorry…
… but your computer or network may be sending automated queries. To protect our users, we can’t process your request right now.
Stripe has finalized a deal to acquire OpenRouter, according to a new report in Bloomberg.
OpenRouter helps customers to select different AI models to perform different tasks, depending on their specific needs and budget. The company announced in May that it had raised a $113 million Series B, at a reported $1.3 billion valuation. (Investors include Sequoia, Andreessen Horowitz, Menlo Ventures, and Alphabet’s Capital G.)
At the time, OpenRouter CEO Alex Atallah described the company as the equivalent of Stripe for AI, because it provides customers with a single access point for different systems and prevents lock-in. The startup also claimed to have 8 million global users and to provide access to more than 400 models.
The Wall Street Journal reported last month that Stripe and OpenRouter were in acquisition talks. Now, Bloomberg said those discussions have led to a deal price of more than $7 billion.
A Stripe spokesperson told TechCrunch that the company does not comment on rumors or speculation.
We’ve detected unusual activity from your computer network
To continue, please click the box below to let us know you’re not a robot.
Why did this happen?
Please make sure your browser supports JavaScript and cookies and that you are not blocking them from loading. For more information you can review our Terms of Service and Cookie Policy.
Need Help?
For inquiries related to this message please contact our support team and provide the reference ID below.
Block reference ID:3ca9eb24 – 99fb-11f1-bb7a-b575ea612eea
Get the most important global markets news at your fingertips with a Bloomberg.com subscription.
When I wrote this week about Anthropic’s announcement that all Claude models, worldwide, would soon begin “watermarking” everything they generate, including text, to comply with this EU regulation, we were left to speculate how this was going to work, because Anthropic offered not even a vague description of how it would work — despite the fact that the title of the announcement was, absurdly and insultingly, “How Claude Marks AI-Generated Content”.
My initial speculation was that maybe they’d hide invisible non-printing Unicode characters in the text. Just spitballing. Turns out that’s not what they’re going to do. What they’re going to do is apply a form of steganography, where the choice of words (or other token output) at inference time will leave fingerprints that can later, maybe, be detected probabilistically.
I initially guessed “invisible characters” not because I didn’t think of the semantic word-choice technique, but because I was a fool who took Anthropic at its word in their description of what they would do. Their original support document claims:
When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.
When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.
They say “imperceptible” and “doesn’t change the meaning, quality, or readability”. Their words. Not almost imperceptible. Not slightly changes the meaning, quality, or readability. That made sense to me, because that’s absolutely what I want — nay, demand — from any tools I use personally. It’s unacceptable for a tool to sacrifice an iota of clarity, coherence, meaning, quality, etc. for the purpose of embedding hidden clues within the text to suggest its provenance. That’s what I would and will demand. And Anthropic’s (original) support document unambiguously claims that’s what their system will enable. So if that were true, I couldn’t see what was left other than hiding invisible characters within the text.
My error was believing Anthropic that their system wouldn’t adulterate and corrupt the semantics of the text their models generate. That is in fact exactly what they plan to do. I should have my head examined for believing a single word of a document titled “How Claude Marks AI-Generated Content” that doesn’t explain, at all, how Claude marks (or will mark) AI-generated content.
How It’s Actually Going to Work
Yesterday, on an entirely different website than the original “How Claude marks AI-generated content” article (the one that didn’t explain anything at all about how it works), Anthropic published “How Claude’s Text Watermark Works”, which does actually explain in layman-accessible terms how it’s going to work. I will return to Anthropic’s new highly euphemistic and slightly misleading description below.
There’s a bunch of research on this topic, some of which I have also linked to below. But the very best description of the general idea behind the technique is an interactive essay by James Padolsey, “How AI Text Watermarking Works”. It’s a wonderfully cogent read, and the interactive elements splendidly illustrate the main concepts. A+ work. If you have any interest in this at all, I dare say you must read — and play with — Padolsey’s piece.
But here’s my stab at a layman’s high-level summary. If you toss a coin N times and note the results, you can determine with a degree of certainty whether the coin is fair or biased. LLMs are, in their popular incarnations, non-deterministic. Ask the same question of the same model and you often get at least slightly different answers. Maybe the same meaning, but different phrasing. At each decision point for generating the next token, the model makes a choice. With these semantic watermarking techniques, they make different choices for some tokens based on word lists that could be called “green” and “red”. At each decision point, they’re a little more likely to pick a word from the green list than the red list. That doesn’t mean they never choose words from the red list. Just that they’re less likely to than they would if the adulterated marking technique weren’t in place. (Same way that a crooked 51 – 49 coin will still land “wrong” side up 49 times out of 100 on average.)
Words or word phrases are sorted into the green and red lists deterministically on the fly, at each “next token” generation point. So sometimes a specific word will be on the green list, and other times it will be on the red list. Someone with the secret key can determine which list a word will be on at each token generation point (which is how the watermarking is detected); those without the secret key cannot. This means there will never be a list of words that Claude prefers or eschews.
With coin flipping, the higher N is — the more times you flip — the more confident you can be that the coin is fair or biased. So too with this semantic watermarking. The more words in the text, the more accurate the analysis will be that the text was generated by a specific AI model or not. With too few coin flips, you can’t achieve any confidence at all regarding a coin’s fairness. With too few words (or tokens), there’s no way to achieve any confidence whether a string of text was AI-generated or not.
Given a string of text to examine for signs of a specific watermarking system, if there are more words tagged as green and fewer tagged as red than would otherwise be expected, the text can be flagged — with some degree of confidence — as having been generated, or merely modified, by the AI system that applies the specific secret-key watermarking system. The amount of confidence in the determination will obviously vary, significantly, based on the size of the text string and randomized weights given to words on the green and red lists. But only Anthropic will be able to determine if text was seemingly generated by Claude, and Anthropic will only be able to detect the watermarks that are applied by Claude. Claude can’t detect the hidden watermark signals generated by, say, Gemini, and Gemini can’t detect the hidden watermark signals created by Claude, because each implementation is predicated on secret keys held only by the LLM provider.
Objections to the Technical Premise
One of my fundamental problems with this is that no two synonyms carry the exact same meaning. “He leaped at the chance” and “He jumped at the opportunity” are very similar sentences expressing the same general sentiment, but they are not the same. The exact words we choose when writing matter. I want any LLM I use to choose the very best, most precise words at every single decision point. An obvious constraint that I accept is time and computation. Within the constraint of executing inference quickly, and at a certain cost per token, I want the best words. This constraint matches human writing. I could surely write a better column by taking longer to write it. I write with a sense of how much care I should put into every word and punctuation choice I make. I take more time with certain paragraphs, sentences, or even individual word choices when my gut feeling says I should.
In other words, these are necessary trade-offs. These factors are all in my interest: speed, cost, quality. Ideally I would like perfect writing, at instantaneous generation speed, at zero cost. None of those things are possible. Computation is not free of charge (and cloud-based LLM inference with leading models is actually expensive). Inference is not instantaneous. And great writing, whether natural or artificial, can only approach perfection.
The idea that anything other than my needs should factor into the generation of text for me is patently offensive.
This isn’t just about text one might generate with the intention of passing it off as their own natural work. This isn’t even about LLM proofreading of work written by hand. Anthropic is saying that all new Claude models are going to adulterate every single bit of text longer than 200 tokens (~150 words) they generate, including everything it presents to its users to read. So even in a private conversation between a user and Claude, which will never be read by anyone other than the user, Claude will begin making word choices in the name of marking its output in statistically predictable ways rather than maximizing clarity and precision.
Even today’s so-called frontier models are already decidedly lacking in lucidity. Claude, ChatGPT, Grok, et al. are “better writers” than most humans and produce better prose than the median human. But: no shit. Most people are terrible writers. The “average person” is pretty stupid and half of all people are stupider than that. And there are many smart, interesting people who are miserable writers. So as impressive as LLMs are, the bar is low. The best writing I see come out of these models is worse than anything I would choose to read for pleasure. And now Anthropic is saying they’re going to make it worse, on purpose, for purposes that do not benefit me in any way? Even if only slightly worse?
Get fucked.
Objections to the EU Regulation
Speaking of objections, the relevant EU regulation motivating all of this, “Code of Practice on Transparency of AI-Generated Content”, is red-tape nanny-state pipe-dream nonsense. Here’s Ben Thompson’s summary from a paywalled Stratechery update this week:
The regulation applies to text longer than 200 tokens. The provider must mandate in their terms-of-service that users not remove the watermarking. The solution should be robust in terms of evading “typical processing solutions” like screen shots, scanning and OCR, copy-and-pasting, translations, etc.
The regulation applies to text longer than 200 tokens.
The provider must mandate in their terms-of-service that users not remove the watermarking.
The solution should be robust in terms of evading “typical processing solutions” like screen shots, scanning and OCR, copy-and-pasting, translations, etc.
Taken literally, compliant LLM terms of service must forbid users from rephrasing the output from models that comply with this regulation, because the word choices are the marks. But it’s not the European Union that is trying to impose their absurd, impractical, witch-hunt-fueling regulation on the entire world. That falls on Anthropic.
Complying with this, particularly with regard to text, is only going to create problems for honest users. Dishonest users attempting to pass off AI-generated text as their own writing (students, employees, whoever) will simply circumvent detection through non-compliant AI paraphrasing tools.
James Padolsey — whose interactive visual explanation of how these schemes work I linked to above — explains this in a post titled “Anthropic’s Weak Watermarks Appease a Weak Law” (which, if it rings a bell, I linked to in a standalone post earlier today):
The same thought that led to this law could have applied to calculators at the time of their inception, had their outputs revealed themselves through artefacts. Thankfully, a sum borne of the brain is treated no differently from one produced by a calculator. Likewise with spellcheckers. To make assistance suspect only once the tool becomes capable enough to compose a whole sentence is not a principled boundary. It is a moral premium placed on difficulty itself.
Anthropic has nevertheless chosen a blanket, model-level implementation that appears broader than the law’s minimum requirement. That may be convenient compliance engineering, but it discards distinctions the law expressly attempted to preserve. The result is a signal broad enough to implicate harmless and assistive use, yet fragile enough to be removed by a motivated person through substantial recomposition. It risks concentrating suspicion on ordinary and assistive users while remaining weakest against deliberate deception.
The same thought that led to this law could have applied to calculators at the time of their inception, had their outputs revealed themselves through artefacts. Thankfully, a sum borne of the brain is treated no differently from one produced by a calculator. Likewise with spellcheckers. To make assistance suspect only once the tool becomes capable enough to compose a whole sentence is not a principled boundary. It is a moral premium placed on difficulty itself.
Anthropic has nevertheless chosen a blanket, model-level implementation that appears broader than the law’s minimum requirement. That may be convenient compliance engineering, but it discards distinctions the law expressly attempted to preserve. The result is a signal broad enough to implicate harmless and assistive use, yet fragile enough to be removed by a motivated person through substantial recomposition. It risks concentrating suspicion on ordinary and assistive users while remaining weakest against deliberate deception.
Padolsey is the creator of Declaude, a delightfully simple web app that allows you to “Paste in AI-flavored text and get the same content back as plain prose”. Declaude’s original purpose is cleaning the saccharine Claude personality stink from text (whether it was created by Claude or any other LLM), but, if Anthropic persists in its stated plan to begin adulterating all text Claude generates, Declaude will also serve as a copy-paste single-extra-step way to eliminates those marks. Declaude is interesting and useful already, but it exemplifies how ill-considered and futile this EU regulation is when it comes to prose.
Google SynthID
Google has a watermarking system in place that they call SynthID, which they apply to AI-generated images, video, audio, and text. I’m concerned in this article only with text. With multimedia, embedded watermarks can be metadata within files, and truly not affect the experiential quality of the work when viewed or listened to. With text, we are talking about the actual words that are chosen. From the “AI-generated text” section of Google DeepMind’s own description of SynthID:
We’ve expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience. Large language models generate text one word (token) at a time. Each word is assigned a probability score, based on how likely it is to be generated next. So for a sentence like “My favorite tropical fruits are mango and…”, the word “bananas” would have a higher probability score than the word “airplanes”. SynthID adjusts these probability scores to generate a watermark. It’s not noticeable to the human eye, and doesn’t affect the quality of the output.
We’ve expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience. Large language models generate text one word (token) at a time. Each word is assigned a probability score, based on how likely it is to be generated next. So for a sentence like “My favorite tropical fruits are mango and…”, the word “bananas” would have a higher probability score than the word “airplanes”. SynthID adjusts these probability scores to generate a watermark. It’s not noticeable to the human eye, and doesn’t affect the quality of the output.
In a group chat, a friend of mine quoted the above, and I responded that if a chatbot wrote “My favorite tropical fruits are mango and airplanes”, I’m pretty sure I’d fucking notice. Another friend then responded with this:
Days later, that still cracks me up.
But Google’s absurd description puts the lie to their own claim that it isn’t noticeable, and it serves to show just how little regard the people behind these generated-text fingerprinting schemes have for the actual craft of writing. Of course bananas has a higher probability score than airplanes, because airplanes aren’t fruit. But what about pineapple? Should the sentence complete to “mango and bananas” or “mango and pineapple”? That’s a good question, and the only acceptable answer for why an LLM should choose bananas instead of pineapple (or coconut, or guava, or papaya…) is that it has determined that it’s the best fit for the intended meaning, tone, and sentiment of the text. Not because bananas is on the watermarking “green” list and pineapple is on the “red” list, even though pineapple might be the better fit. Google’s own supposedly jocular description of how SynthID works in fact captures how the scheme perverts the text it generates.
They’re saying you won’t notice because if it only chooses bananas over pineapple for these fingerprinting purposes, well, they’re both tropical fruits and who cares. But it’s utter nonsense that the difference is “not noticeable to the human eye”. The semantic difference between banana and pineapple is just as noticeable to the human eye as the taste of the two are to the human tongue.
If it did produce “My favorite tropical fruits are mango and airplanes”, it’d be incredibly stupid, but it wouldn’t be offensive because we’d all recognize that something completely off-key happened. What’s offensive is that with a system like SynthId in place, where the fingerprinting decisions are motivated by a secret key, we have no idea whether it completed to “mango and bananas” because bananas was determined to be the best next token, or because bananas is in the “green” bucket of words. It calls every single word choice into question.
Here’s a paper published in Nature where Google’s team behind SynthID published their work, after putting it into production with Gemini (née Bard):
We analysed approximately 20 million watermarked and unwatermarked responses and computed the thumbs-up and thumbs-down rates (both as a fraction of the total number of thumbs-up and thumbs-down feedback received). We found that the thumbs-up rate for the two models differed by 0.01% (with the watermarked model being higher); and the thumbs-down rate differed by 0.02% (with the watermarked model being lower). We found both of these differences to be statistically insignificant, and well within the 95% confidence intervals.
From this experiment, we conclude that over a wide variety of real chatbot interactions, the difference in response quality and utility, as judged by humans, is negligible. Subsequently, non-distortionary SynthID-Text has been productionized and is currently watermarking responses in Gemini and Gemini Advanced. To the best of our knowledge, this evaluation represents the first systematic watermarking investigation of its kind within a large-scale production system.
We analysed approximately 20 million watermarked and unwatermarked responses and computed the thumbs-up and thumbs-down rates (both as a fraction of the total number of thumbs-up and thumbs-down feedback received). We found that the thumbs-up rate for the two models differed by 0.01% (with the watermarked model being higher); and the thumbs-down rate differed by 0.02% (with the watermarked model being lower). We found both of these differences to be statistically insignificant, and well within the 95% confidence intervals.
From this experiment, we conclude that over a wide variety of real chatbot interactions, the difference in response quality and utility, as judged by humans, is negligible. Subsequently, non-distortionary SynthID-Text has been productionized and is currently watermarking responses in Gemini and Gemini Advanced. To the best of our knowledge, this evaluation represents the first systematic watermarking investigation of its kind within a large-scale production system.
To this I say:
Gemini/Bard’s thumbs-up/thumbs-down buttons are not a good experiment for evaluating the effect on quality. If a chatbot tells me “My favorite tropical fruits are mango and bananas” instead of “mango and pineapple”, I’m not going to give the response a thumbs down because of the fruit it chose. I’d give it a thumbs down if it said “airplanes”, yes, but that’s a strawman. (The paper in Nature even uses “My favourite tropical fruit is …” as an illustration, but in the paper, the only four next tokens considered are, in order of probability distribution, mango, lychee, papaya, and durian. No airplanes. And, conveniently, in the paper’s example, the “winner” of the watermarking “tournament” just happens to be mango, the one that would have been selected as the best if the watermarking weren’t in place.)
Gemini/Bard’s thumbs-up/thumbs-down buttons are not a good experiment for evaluating the effect on quality. If a chatbot tells me “My favorite tropical fruits are mango and bananas” instead of “mango and pineapple”, I’m not going to give the response a thumbs down because of the fruit it chose. I’d give it a thumbs down if it said “airplanes”, yes, but that’s a strawman. (The paper in Nature even uses “My favourite tropical fruit is …” as an illustration, but in the paper, the only four next tokens considered are, in order of probability distribution, mango, lychee, papaya, and durian. No airplanes. And, conveniently, in the paper’s example, the “winner” of the watermarking “tournament” just happens to be mango, the one that would have been selected as the best if the watermarking weren’t in place.)
A “difference in response quality and utility, as judged by humans” that is “negligible” does not mean imperceptible. What they really mean is that it’s only slightly worse and that everyone is either too stupid to notice or too indifferent to care.
A “difference in response quality and utility, as judged by humans” that is “negligible” does not mean imperceptible. What they really mean is that it’s only slightly worse and that everyone is either too stupid to notice or too indifferent to care.
It’s widely considered that Gemini is behind ChatGPT and Claude in quality. Perhaps the fact that they’ve put SynthID-text into production is one of many reasons why. I personally agree that Gemini’s prose is inferior. Maybe the use of SynthID has nothing to do with the fact that I, along with the general public consensus, consider Gemini to be a second-rate chatbot — but in that case, maybe it’s the fact that Gemini is a second-rate chatbot that makes the difference “negligible” when Google started mixing in SynthID-motivated tokens in its results. It’s a lot more likely that your restaurant customers won’t notice that you replaced your regular coffee with Folgers Crystals if your regular coffee is second-rate to start with.
It’s widely considered that Gemini is behind ChatGPT and Claude in quality. Perhaps the fact that they’ve put SynthID-text into production is one of many reasons why. I personally agree that Gemini’s prose is inferior. Maybe the use of SynthID has nothing to do with the fact that I, along with the general public consensus, consider Gemini to be a second-rate chatbot — but in that case, maybe it’s the fact that Gemini is a second-rate chatbot that makes the difference “negligible” when Google started mixing in SynthID-motivated tokens in its results. It’s a lot more likely that your restaurant customers won’t notice that you replaced your regular coffee with Folgers Crystals if your regular coffee is second-rate to start with.
Anthropic
Now, finally, back to Anthropic’s new “How Claude’s Text Watermark Works”, published yesterday. I have some comments.
To summarize:
We use a method of watermarking that does not have any practical impact on the quality or content of Claude’s outputs; The difference between watermarked and un-watermarked text will not be distinguishable to readers;
To summarize:
We use a method of watermarking that does not have any practical impact on the quality or content of Claude’s outputs;
We use a method of watermarking that does not have any practical impact on the quality or content of Claude’s outputs;
The difference between watermarked and un-watermarked text will not be distinguishable to readers;
The difference between watermarked and un-watermarked text will not be distinguishable to readers;
Translation: Specific words do not matter and we don’t think anyone reads anything closely.
Nothing is added to the text and there are no hidden characters;
Nothing is added to the text and there are no hidden characters;
This would have been worth clarifying at the outset.
Watermarking won’t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.
Watermarking won’t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.
No other AI provider has stated that they will apply such marking, adulterating all generated text, outside the EU.
Take the sentence “The weather today was cold and…”. The next word is very unlikely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most circumstances, it doesn’t matter much to the reader which of these latter two words the model ultimately chooses — the meaning of the sentence is largely the same either way. In cases like this, the choice is settled by a random number.
Take the sentence “The weather today was cold and…”. The next word is very unlikely to be “sugary.” But it is quite likely to be “overcast” or “grey.” Under most circumstances, it doesn’t matter much to the reader which of these latter two words the model ultimately chooses — the meaning of the sentence is largely the same either way. In cases like this, the choice is settled by a random number.
Arguing that grey vs. overcast “doesn’t matter much to the reader” is the crux of my argument that this entire endeavor is a perverse adulteration of what it means to write — or to read. That it’s subtle in some ways makes it more perverse, because it’s sneaky.
In internal testing, we’ve seen no impact of watermarking on the content, level of creativity, or readability of Claude’s text. In the SynthID-Text paper, which introduced the technique we use, Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.
In internal testing, we’ve seen no impact of watermarking on the content, level of creativity, or readability of Claude’s text. In the SynthID-Text paper, which introduced the technique we use, Google DeepMind tested this impact by serving a model that used watermarking to a portion of their Gemini traffic and comparing thumbs-up and thumbs-down ratings. They found no statistically significant differences from the unwatermarked model. And in a controlled study, human raters comparing watermarked and unwatermarked answers side-by-side saw no difference in quality.
See above for my argument that this thumbs-up/thumbs-down data is absolutely worthless in evaluating whether the SynthID-style word-bias watermarking makes text worse. By definition it must make text worse, unless the underlying LLM model’s scoring is wrong, because the nature of the watermarking algorithm requires it to sometimes increase the probability of selecting a worse word choice and decrease the probability of selecting the model’s best choice. It’s only a question of how much worse. What Google’s thumb-counting data shows is only that it isn’t so much worse as to make Gemini users click the thumbs-down button.
Watermarking doesn’t change the meaning or experience for the person reading it, but if you wanted to check after the fact whether the text was likely generated by Claude, the watermark allows you to do so.
Watermarking doesn’t change the meaning or experience for the person reading it, but if you wanted to check after the fact whether the text was likely generated by Claude, the watermark allows you to do so.
No, it does not. Because the entire scheme is tied to secret keys held only by the AI provider, it only allows Anthropic, not “you”, to check anything.
When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person’s, there’s very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude’s involvement detectable. The more Claude writes, the more decisions it has to make, and the more space there is for a watermark.
When Claude proofreads text written by a person, what it gives back has generally only been lightly edited; because nearly all the words are the person’s, there’s very little (if anything) for the watermark to attach to. Depending on the length of the text and how heavily Claude has edited it, those changes might not be enough to make Claude’s involvement detectable. The more Claude writes, the more decisions it has to make, and the more space there is for a watermark.
Translation: No one can ever again use Claude for proofreading their own prose unless they’re willing to risk that the whole thing might be flagged as having been generated by Claude.
For example, once the model has written “2 + 2 =”, there is a very clear best choice for the next token (if the model is completing the sum, there isn’t an answer that’s equally as good as “4”; if it’s talking about George Orwell’s Nineteen Eighty-Four, there isn’t an answer that’s equally as good as “5”). The “nudge” of the watermark wouldn’t be applied here. For the same reason, code — which in very many cases has to be exact — has generally less watermarking than some other forms of text.
Having said that, in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code. But by definition, it will have a negligible effect on the actual code produced.
For example, once the model has written “2 + 2 =”, there is a very clear best choice for the next token (if the model is completing the sum, there isn’t an answer that’s equally as good as “4”; if it’s talking about George Orwell’s Nineteen Eighty-Four, there isn’t an answer that’s equally as good as “5”). The “nudge” of the watermark wouldn’t be applied here. For the same reason, code — which in very many cases has to be exact — has generally less watermarking than some other forms of text.
Having said that, in areas where there is an arbitrary choice between particular words or terms within the code, the watermark can be used, such as comments within code. But by definition, it will have a negligible effect on the actual code produced.
Translation: We value precision in programming code; we do not in prose.
And it is exceedingly rich to cite George Orwell’s Nineteen Eighty-Four, approvingly, in the context of justifying a text adulteration scheme premised on the notion that specific words do not matter. I mean what the actual fuck? Orwell!
Lastly, as to why they’re doing this:
We’re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of “marking” AI-generated text. We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.
We’re implementing watermarking to comply with the EU AI Act. Anthropic, along with several other major AI model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. This requires AI system providers to use methods of “marking” AI-generated text. We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.
This, from a company that the Financial Times just reported is weeks away from an IPO with an intended valuation of $2 trillion, which would make it one of the 10 highest-valued companies in the world — as of today, placing it at #7, between TSMC ($2.2T) and Broadcom ($1.9T).
This leaves us to believe that one of the following must be true:
It’s perfectly reasonable that a technology company valued on par with Amazon and TSMC is technically incapable of complying with an EU regional law only within the EU itself.1 Not a cause for concern at all.
It’s perfectly reasonable that a technology company valued on par with Amazon and TSMC is technically incapable of complying with an EU regional law only within the EU itself.1 Not a cause for concern at all.
Anthropic is in over their heads, wields shockingly little control over their own tech stack, and their imminent IPO is likely to be remembered only as a new high-water mark in the manic global AI bubble.
Anthropic is in over their heads, wields shockingly little control over their own tech stack, and their imminent IPO is likely to be remembered only as a new high-water mark in the manic global AI bubble.
Also, what happens if another major global market makes it unlawful for AI to secretly watermark generated text?
Reasoning scores keep climbing while per-token compute keeps dropping. GLM-5.2 scores 99.2% on AIME 2026 with about 40 billion parameters active per token. Qwen3.5 scores 91.3% with 17 billion active. DeepSeek V4-Flash runs 13 billion active. For scale, GPT-4 was rumored to run around 280 billion active parameters in 2023, and it could barely solve an AIME problem. At the small end, Qwen3.5 9B fits in 6GB of VRAM quantized and roughly doubles the score of the next best model under 10B parameters on Artificial Analysis’s intelligence index. If you only looked at math and code benchmarks, you’d conclude that models are getting smarter per parameter at an absurd rate.
They are, on those benchmarks. Ask the same models a plain factual question and the picture flips. On SimpleQA, a benchmark of factual recall with no tools allowed, the current leader is Gemini 2.5 Pro at 53%, so the best recall money can buy still misses half the questions. The small models barely register. Artificial Analysis measures Qwen3.5 4B and 9B at hallucination rates of 80 to 82% on its knowledge benchmark, which means that when they don’t know a fact, which is most of the time, they make one up. Ask the 9B for the birth year of a minor 19th-century mathematician and you get a confident, plausible, wrong answer. The parameter count didn’t drop for free. Labs are trading world knowledge for reasoning skill, and the trade is deliberate.
What the parameters were for
Facts take space. Research on knowledge capacity (the “Physics of Language Models” series has the cleanest measurements) puts it on the order of two bits of factual knowledge per parameter. If you want a model that knows the birth year of every minor Wikipedia figure, the population of every Dutch municipality, and the argument order of every function in every npm package, you pay for that in weights, and it’s a big part of why frontier models grew to trillions of parameters.
Reasoning compresses much better than facts do, because it’s a relatively small set of procedures applied over and over: break the problem into parts, track intermediate state, check your own work, backtrack when a step fails. Distillation and reinforcement learning on verifiable tasks turn out to transfer those procedures into small models remarkably well. Phi-4 is 14 billion parameters, trained heavily on synthetic textbook-style data, and it’s good at math and bad at trivia, which tells you exactly what its training data contained. That mix used to look like a limitation of the synthetic-data approach. It now looks like the design goal.
The knowledge that survives the trade has a shape. These models are generalists: they know a little about nearly everything and almost nothing in depth. Ask one about PostgreSQL and it knows what it is, what it’s good at, and roughly how MVCC works, but ask which version added a specific planner feature and you’re back to invented facts. That’s the right layer to keep in weights, because breadth is what lets a model understand what a question is about, know what to look up, and judge whether a source is plausible. The depth is cheap to retrieve and expensive to store, so it’s the part that goes.
Facts rot, procedures don’t
A frontier training run takes months and costs hundreds of millions of dollars, and the moment it finishes, the facts inside it start going stale. Library APIs change, prices change, people change jobs, and half of what a 2024 model believed about the JavaScript ecosystem was outdated before the model shipped. Every fact you bake into weights has a shelf life, and the only way to refresh it is another training run.
The procedures don’t rot. Algebra worked the same way in 1970 as it does now, and so does breaking a problem down or spotting a contradiction between two sources. A model that’s mostly procedure and only lightly loaded with facts doesn’t age the way a knowledge-heavy model does. Its training cutoff matters much less, because the current state of the world was never supposed to live in the weights in the first place. I think this is the best argument for the whole approach: it decouples the expensive, slow artifact (the trained model) from the thing that changes daily (what’s true).
The harness carries the knowledge
If the model doesn’t know things, something else has to, and that something is the harness: retrieval over a knowledge base, tool calls, web search, a filesystem full of docs. I wrote earlier that Rust is a harness for agents, a source of cheap machine-checkable feedback. This is the same shape from the other side. The model contributes reasoning, and everything it reasons about gets supplied at runtime.
You can already watch agents work this way. A coding agent doesn’t need to have memorized your dependency’s API surface, because it greps node_modules or reads the docs before calling anything, and its answer is grounded in the version you actually have installed rather than whichever version dominated the training data. The recall that used to be a fixed cost in every forward pass became an on-demand lookup.
A frontier model on your GPU
Follow the trend a couple of years out and I think we get a model with frontier-quality reasoning, Fable-quality, that runs on a single consumer GPU. The compute half is nearly there. DeepSeek V4-Flash reasons with about 13 billion active parameters per token, well within consumer-GPU range. What doesn’t fit is the other 271 billion parameters sitting in its experts, and expert layers are mostly fact storage. That’s the part this whole trade makes optional. Strip the knowledge out and total size shrinks toward active size, and a 20 to 40B model at 4-bit quantization fits on the 24GB card that’s been sitting in gaming PCs since 2022.
The catch is that it won’t know much. Ask it a bare factual question with no tools attached and the right behavior is to say it doesn’t know and go look it up. Paired with a decent harness, that’s most of what I use a frontier model for today, running locally with no per-token bill and no data leaving the machine.
This mostly solves hallucination
The part I find most promising is what this does to hallucination. When a fact lives in weights, a wrong fact is unfindable and unfixable. You can’t grep the weights, you can’t diff them against last month, and correcting one error means a fine-tune that might break who knows what else. The model states the wrong fact with the same fluent confidence as a right one, and there’s no artifact to check it against.
When the fact lives outside the model, a wrong answer has an address. The model cites a document, so you can open the document. If the document is wrong, you edit the document, and every future query gets the correction, which beats waiting for the next training run by roughly a year. Retrieval doesn’t get you to zero, since a model can still misread a source or stitch two of them together wrong, but a claim with a source is checkable and a claim from weights isn’t. A wrong fact in a knowledge base is an ordinary data bug, the kind we already know how to trace, fix, and write a regression test for.
There’s a version of this future where the model card stops listing a knowledge cutoff at all, because what’s left in the weights goes stale on a scale of years instead of weeks. The model just gets handed the world’s current state at runtime, the same way a CPU gets handed a program.
threat-research llm-security
August 10, 2026 Matt Lenhard 5 min read
Share
Where This Started
This is a follow-up article to a piece I recently wrote about the token relay market. Noticeably absent from that piece was a mention of the rise of “token brokers” — people who buy unused credits from startups and then resell them.
I first heard about token brokers while chatting with a good friend of mine who was receiving offers for Anthropic tokens at steep discounts.
It wasn’t just him, though. As I started talking to more founders about what I was building, they said the same thing: they were getting a lot of inbound email from people looking to buy or sell off-market inference.
Startups swapping credits is nothing new, and I knew this was happening in several startup forums and groups, but this was when I realized that the market was being commercialized.
So I did what any normal person would do. I got the brokers’ email addresses and started emailing them to learn more.
Before my own outreach, it’s worth seeing what founders are actually receiving. Both of these were forwarded to me by friends.
I started by sourcing a few email addresses from friends. The first two emails I sent bounced, but the third was a hit. Here’s a screenshot of that conversation:
What’s interesting is the amount of supply. The seller was offering $100k in spend per day.
They aren’t handing out the provider keys directly; instead, they act as a proxy that probably picks from a pool of keys and forwards the request.
The Listings
Credit Marketplaces
There are a few websites promoting credit brokering as well. One of them, AI Credits, bills itself as a credit marketplace. For another flavor of the pure-play credit reseller marketplaces, take a look at AICreditMart.
These sites offer credits at most of the major cloud and inference providers.
AI Credits’ onboarding process is pretty straightforward, and you can even select your preferred delivery method as the seller.
I went ahead and listed my credits, which are still pending approval.
Bulk Discounts
Another site that I found through a friend was CheapCredits. This site positions itself as a router that is able to achieve its discounts through “bulk pricing.”
I noticed that this was a trend with a number of sites that I believe are acting as credit brokers. They present themselves as being able to offer discounts based on bulk purchases. Some other examples include Tokvana and Neokens.
Having spent time in the industry, I’d say that a 40% discount is very unlikely unless you are one of the provider’s top customers. My hunch is that CheapCredits is acquiring the supply in other ways.
CheapCredits even has a Data Processing Agreement for anyone looking to stay GDPR compliant.
The Message Boards
I checked where you’d expect to find underground marketplaces.
Telegram had a few channels, with one being relatively active.
There are also sporadic Reddit posts.
If you’ve been hanging out in any of the closed-off startup groups, I’m sure you’ve seen a number of these posts as well.
So How Big Is This Market?
My rough estimate is that, across the sites, forums, and resellers I looked at, there are probably tens of millions of these credits being offered.
Unfortunately, when you try to offer nice things, abuse isn’t far behind. Tokens have become a pseudo-currency, and there is enough liquidity in the market to allow for a lot of abuse. As we see the market turn and companies become more aware of costs, crackdowns on this type of abuse probably aren’t far behind.
Sources
Company and site names below are as they present themselves publicly. Screenshots are from my own outreach and from browsing the sites as a prospective buyer and seller.
Previous piece: An Inside Look at the Relay Market Powering Token Resellers and Fraud
Credit marketplaces: AI Credits, AICreditMart
Bulk-discount routers: CheapCredits (cheapcredits.ai), Tokvana, Neokens
Direct outreach: email exchange with a broker offering $100k/day in spend
Share
To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".
10HN is also available as an iOS App
If you visit 10HN only rarely, check out the the best articles from the past week.
Visit pancik.com for more.