What Zero Trust Can Teach Us About AI Watermarks

I recently wrote about the mess that is watermarking AI-generated text and how Anthropic's move to add watermarks (in response to the EU AI Act's transparency rules) raises more questions than it answers. If you haven't read that blog, the short version is this: telling AI content apart from human content is getting harder every day – AI is a tool that should be used much in the same way that you use a calculator to do long division, and slapping a watermark on it doesn't change that.

But there's another angle worth talking about, one that happens to be near and dear to my heart: zero trust.

If you've spent any time around IT security, you've heard the phrase coined by my friend John Kindervag that states: "never trust, always verify." (While we're at it, can we all just take a moment and finally end the debate regarding the amazing contributions of John to the cybersecurity industry, especially as being the creator/originator/author/godfather/whatever of zero trust? Please and thank you.)

It used to be that if you had a badge that let you into a building, nobody questioned you once you were inside. Sounds reasonable, except that a little social engineering, a cloned badge, and some strategic tailgating proved that one credential, checked once, isn't worth much. So, security teams stopped trusting people just because they made it through the front door, and started verifying, continuously, no matter who you are or where you came from.

A watermark is basically a badge for content. It's a single flag that says "trust me, I'm AI-generated" or, by its absence, "trust me, I'm not." And just like a badge, it can be cloned, stripped, or never issued in the first place. Anyone determined enough to get around it will. So why would we build a policy around trusting that one factor?

The zero trust answer: we shouldn't. Instead of asking "does this have a watermark?" we should ask the same questions we ought to ask about the voracity of any piece of content: Is it accurate? Does it cite something real? Does it hold up when I check it myself? Those questions work whether a human or a machine did the writing, and they don't require an EU regulation to make them worth doing.

The debates around AI watermarking have just started, but regardless of which side you come down on in this debate, we (analysts, students, professionals, regulators, lawyers [this one is continuously hilarious to me], and everyone else) will continue to utilize the tools that are available. Penalizing those for using a new technology or productivity tool is ridiculous and practically impossible: those who want to find a workaround will likely do so, and those who benefit from using the latest technology to increase productivity will be ostracized.

And this is the lesson in a multi-layered, zero trust-based cybersecurity strategy: the bad guys often find the workaround. It isn’t to say that watermarking is useless – it can be one data point or factor among many. But treating it as THE only factor/data point – the single test of whether something can be trusted – is exactly the kind of perimeter thinking that got network security into trouble for years.

We eventually figured out we needed to verify everything, all the time. Content deserves the same lesson.

This blog – as well as the referenced blog – was written (poorly) by a human, and not edited by AI (or really anyone). Spell checker was used (somewhat) and the grammar detector was also used (marginally).