Claude watermarks its text by steering token sampling, not retraining
Anthropic's watermark rides inside Claude's sampling step — a secret key seeds functions that assign bit signatures to candidate tokens, and tournament rounds pick the emitted one — so there is no retraining and no quality hit. Detection re-applies the same functions to suspect text and averages the scores against a threshold, which makes AI-text checks cheap enough to run at scale with no re-inference. Raschka names the ceiling: the signal sits at positions where alternatives are near-equally probable, so editing enough of those positions strips it.
Source: magazine.sebastianraschka.com ↗
This watermarking technique is also a nice way to explain how conventional models or LLMs in general work under the hood.
Sebastian Raschka
Why this matters
- → Watermarking Claude's text requires no retraining — only a sampling-layer tweak.
- → Detection is computationally cheap enough to run at scale without re-inference.
- → The signal degrades predictably when text is edited, defining the security boundary.
Watermarks, not retraining