How Claude Watermarks AI-Generated Text

What it is

The recorded lecture's conclusion (the section the catalog summary notes was truncated) plus the concrete mechanics of the tournament-sampling scoring function. The summary establishes that watermarking = deterministic seeding via secret key + prior tokens, that detection needs the key, and that editing enough positions defeats it. What it omits is how scoring works without the LLM and what Raschka predicts operators will actually do to strip watermarks.

How the scoring works (the reuse trick)

Detection avoids rerunning the LLM. Each candidate token, combined with the preceding ~3–4 tokens and the secret key, is fed through N random watermarking functions G1…Gn (30–50 in practice, 3 in the toy example), each returning a bit (0/1). This yields a per-token "signature." Tournament sampling pairs tokens knockout-bracket style, resolving ties with the keyed seed, so the sampling itself biases toward high-signature tokens. At detection time you re-run only the cheap G-functions over found text, sum bits per position, average across positions, and threshold (e.g. "watermarked if avg > 2"). No LLM, no prompt, no model identity needed — only the key and the G-functions.

The evasion prediction (not in the summary)

Raschka's actual conclusion: watermarking won't deter volume AI-text producers. His predicted workflow is a two-model pipeline — generate with Claude (or any watermarked proprietary model: he expects Gemini, given Google authored SynthID-Text, and likely OpenAI to comply too, citing EU regulation as the driver), then pass the output through a local model to make surgical edits. Because local models don't (yet) implement watermarking, the edited text is no longer watermarked. He notes this likely degrades quality slightly, since the editor blindly changes words without knowing which positions carry the mark.

Caveats

• Watermarking is applied only at positions with two-or-more near-equally-likely tokens; low-entropy positions (his "trees" example) are skipped, so an editor cannot target marks precisely.
• Raschka states he is not affiliated with Anthropic and is inferring detail from a blog post that "explains a lot about why… but not how"; the SynthID-Text mapping is his best guess, not confirmed identical to Claude's implementation.
• Removal by random editing is probabilistic — you defeat the mark only if you happen to change enough watermarked positions.