How Claude Watermarks AI-Generated Text

Summary

Sebastian Raschka’s lecture explains Anthropic’s proposed watermarking process for Claude-generated text by first reviewing how an LLM selects each next token. A model produces scores across its vocabulary, converts them into probabilities, and samples a token; watermarking changes this sampling step rather than requiring a newly trained model. Claude’s system uses a secret key together with preceding words to derive controlled randomness, making some otherwise plausible token choices more deterministic while aiming to preserve text quality. The watermark is not visible to readers, and detection requires access to the secret key or an Anthropic-provided detection API. To avoid rerunning the LLM for every piece of text found online, the described approach uses keyed random watermarking functions and tournament sampling. Candidate tokens receive binary signatures, compete in successive rounds, and produce text whose scores can later be calculated directly from the text and averaged against a threshold. The detector therefore needs the key and functions, but not the original prompt or model inference. The lecture also explains why the watermark is vulnerable to editing: users do not know which positions were marked, so removing it would require changing enough likely marked tokens. Raschka speculates that organizations could pass Claude output through another, potentially local model to make such edits, which could complicate production workflows and sometimes reduce quality. He presents this consequence as a forecast rather than an established result.