How Claude Watermarks AI-Generated Text

What it claims

Raschka's lecture explains the mechanism behind Anthropic's announced Claude text watermark. To the end user, the watermark behaves like a fixed random seed at sampling time. Because it only changes which of several near-equally-likely tokens is picked, Raschka argues it should not degrade output quality, which matches Anthropic's claim. No retraining is needed and the model itself is untouched.

Raschka is not affiliated with Anthropic and says Anthropic's post cites SynthID-Text but he does not know whether Claude uses exactly that technique. All numbers in the lecture are toy illustrations, not Anthropic's parameters.

How it works

Generation. The summary names tournament sampling. The page gives these mechanics:

1. The seed comes from the secret key plus roughly the previous 3–4 tokens.
2. Each candidate token, together with that context, is passed through n binary functions G1…Gn. The lecture uses 3; Raschka suggests real systems might use 30, 50 or more. This gives each candidate a bit signature, for example "gray" = 101 and "overcast" = 010.
3. Candidates are paired off, knockout style. When there are too few candidates to fill the bracket, a token is duplicated.
4. Round k compares the pair's Gk bits, and the higher bit wins. Ties are broken randomly using the keyed seed.
5. The last survivor is emitted.

Positions without a near-equal alternative (his example: "trees") are effectively not watermarked.

Detection needs no LLM, no prompt and no knowledge of which model produced the text:

1. Run each token and its context through G1…Gn with the key.
2. Sum the bits per position.
3. Average over the text.
4. Compare the average to a threshold.

In the toy example, the watermarked text averages 2.23. Swapping two words ("today"→"now", "gray"→"overcast") drops it to 1.71, which falls below an illustrative threshold of 2. The G-functions are cheap, so whole texts can be scored quickly.

flowchart LR
  K[Secret key] --> G[G1..Gn functions]
  C[Previous ~4 tokens] --> G
  G -->|generation| T[Tournament picks token]
  G -->|detection| S[Average bits per position]
  S --> D{Above threshold?}
  D -->|yes| W[Watermarked]
  D -->|no| N[Not watermarked]

How to use it

Detection requires the key, so only Anthropic can run it. Anthropic's post mentions a detection API is planned, but its availability is unknown: it might be offered only to platforms such as X or Substack, or opened to the public. The slides and a YouTube version are linked from the page.

Limits

• Removal. Editing enough watermarked positions defeats the watermark. An attacker does not know which positions carry it, so in practice the only option is random editing, which risks awkward text.
• Raschka's prediction. Users will route Claude output through a smaller local model, which is presumably unwatermarked, to make surgical edits. The result is "edited AI-generated text" of somewhat lower quality.
• Regulation and other providers. According to Anthropic's post, an EU regulation motivates the watermark. Raschka speculates, explicitly as a guess, that Google (Gemini) and OpenAI do or will do the same.
• Determinism caveat. Raschka notes that fixing seeds has not always given deterministic output in his experience (Ollama). He also doubts that the Claude or OpenAI APIs expose a seed.