Claude's Text Watermark: How It Works and What It Can't Do

Anthropic recently announced it's watermarking text outputs from its Claude models. Cue the takes: AI is surveilling us, the text will get worse, Big Tech is building a panopticon one token at a time. Most of that heat is generating more noise than light.

Here's what's actually worth understanding: the mechanism itself. And it's genuinely clever—not in a sinister way, but in a "oh, that's how they threaded that needle" way.

ML researcher Sebastian Raschka published a detailed technical walkthrough on YouTube explaining how the system works at the code level. It's dense and worth your time if you're technically inclined. What follows is my read of what matters, and where the limits are.

The watermark isn't in the text. It's in the choices.

Nothing is inserted into your Claude output. No hidden characters, no invisible ink. The watermark lives in which words get selected at moments of near-equal probability—and that distinction is everything.

To understand why, you need a quick detour into how LLMs actually generate text. When Claude responds to a prompt, it isn't retrieving a pre-written answer. It's producing a probability distribution across its entire vocabulary—potentially hundreds of thousands of tokens—and sampling from that distribution one token at a time. The process repeats until the response is complete.

For factual prompts ("What's the capital of Germany?"), this is almost deterministic. Berlin gets an overwhelming probability score; everything else is noise. The "randomness" in sampling barely matters.

But for open-ended text, something different happens. Ask Claude to continue "The weather today is cold and..." and you might get "overcast" or "gray"—two tokens that are essentially interchangeable, each with roughly equal probability. Neither is wrong. The LLM is genuinely indifferent between them.

That indifference is exactly where the watermark lives.

Fixing the coin flip

Without watermarking, which word you get at those ambiguous positions is random. With watermarking, it's secretly deterministic.

Raschka's walkthrough explains the core idea: instead of sampling freely at those ambiguous positions, Claude uses a secret key—combined with information about the preceding tokens—to derive a specific random seed. That seed determines which of the equally-plausible tokens gets selected. The text that comes out reads identically to unwatermarked text. The quality is unchanged. But the pattern of choices is now reproducible.

As Raschka puts it: "The watermarking is nothing else for the end user than fixing a random seed and making this sampling kind of deterministic."

This is also why Anthropic can credibly claim the watermark doesn't degrade output quality. They're not forcing Claude toward worse word choices—they're just locking in which equivalent choice it makes. The tournament sampling mechanism that implements this is more sophisticated than a simple random seed, but the principle is the same.

How tournament sampling actually works

The more technically interesting part is how the watermark is embedded in a way that makes detection cheap without requiring Anthropic to re-run the full language model on every piece of suspected AI-generated text.

The answer is something called tournament sampling. Rather than using standard probability-weighted random selection, Claude runs candidate tokens through a bracket-style competition—think playoff rounds, not a coin flip. Each candidate token gets evaluated by a series of binary watermarking functions (G1, G2, G3, and so on), each of which returns a 0 or 1 based on the token's value combined with the secret key. These functions generate a bit-string signature for each candidate. Then tokens are paired off, the bracket runs, and the winner is selected.

The crucial advantage: later, when Anthropic wants to check whether a piece of text was Claude-generated, they only need to run those same lightweight functions on the text. They don't need to re-run the LLM. They don't need the original prompt. They apply the functions, aggregate the scores across positions, and compare against a threshold. Above the threshold: likely watermarked. Below: likely not.

This makes detection scalable in a way that simple random-seed approaches aren't. Raschka walks through the mechanics in considerable detail in his video, and the elegance of the solution is real—the same structure used during generation is reused during detection, at a fraction of the cost.

The EU AI Act implications of this are worth sitting with separately: Anthropic has acknowledged the EU's AI Act as a driver for this rollout, which means the detection API they're developing isn't purely a voluntary transparency measure. It's infrastructure for compliance.

Who can actually detect this?

Not you. Not yet, maybe not ever—depends on how Anthropic structures access.

Watermark detection requires the secret key. That key lives with Anthropic. They've indicated they'll build an API for detection, but whether that becomes publicly accessible, or stays gated to select partners (platforms wanting to label AI-generated content, law enforcement, media companies), remains an open question.

Raschka is appropriately agnostic about this: "That API might as well be private for some companies like X when they want to label AI-generated posts. Maybe they will make it public for end users. Who knows?"

That's not a rhetorical shrug—it's a genuine uncertainty with real stakes. A detection tool accessible only to Anthropic and its vetted partners creates a very different power dynamic than one available to, say, a teacher trying to evaluate student work or a journalist checking a leaked document. The EU regulatory context adds another layer: if watermarking is legally mandated but detection remains privately controlled, you end up with an asymmetric compliance system where accountability runs in one direction only.

Removing the watermark isn't hard. It's just imprecise.

Here's where the technical picture gets interesting from a security standpoint.

You can defeat this watermark. The method is straightforward: change enough words at the positions where the watermark was embedded, and the statistical signal breaks down. No signal, no watermark.

The catch is that you don't know which positions those are. The watermark only exists at points of near-equal token probability—positions where the model was genuinely indifferent between options. You can't identify those positions without running the LLM yourself and checking which tokens scored similarly high. Without that, you're guessing.

So the realistic removal strategy is brute-force: randomly substitute words throughout the text and hope you've hit enough watermarked positions to drop the score below the detection threshold. This works, but it's imprecise—you're changing words for the sake of changing them, which introduces the risk of awkward phrasing or subtle coherence loss.

Raschka's broader prediction about what this means for determined bad actors: they'll add a second model to their pipeline. Generate with Claude (or Gemini, or whatever high-capability model), then run the output through a local, open-source model that makes light edits. Local models are unlikely to implement watermarking in the near term. The result is AI-generated text that's been lightly laundered—probably still recognizable as AI-generated to a careful human reader, but invisible to watermark detection.

The pipeline gets more complicated. The text quality probably dips slightly. The watermark gets stripped.

What this actually accomplishes

So who does the watermark actually stop?

Not sophisticated actors. Not developers who understand what tournament sampling is. Not anyone running a local model.

It stops casual, low-effort laundering. It creates a paper trail that can be checked retroactively when specific texts become subjects of investigation. It gives Anthropic (and potentially platforms it works with) a tool to audit scale—how much of the content circulating on a given platform came from Claude, even if the watermark doesn't survive determined scrubbing.

That's a narrower use case than the announcement might suggest, but it's not nothing. Provenance infrastructure at this level of technical sophistication didn't exist at all two years ago. Whether it becomes genuinely useful depends almost entirely on who gets access to the detection API and under what conditions.

The mechanism is sound. The governance around it is still being written.

---

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.