When Anthropic announced it would watermark text output from Claude models, Sebastian Raschka posted a short explanation of the mechanism. The post went unexpectedly viral — not because watermarking is exciting, but because almost nobody could say concretely what it does. He planned a ten-slide follow-up. It became fifty.

The result is one of the better explainers of the year, and it doubles as a clean walkthrough of how LLM sampling actually works. Raschka is careful to stake out neutrality up front — “I’m not defending watermarks here, I’m just trying to explain” — and the value is in showing that the mechanism is far less exotic than the discourse implies.

First, how a token actually gets picked

The watermarking scheme is a modification to sampling, so Raschka starts with sampling itself.

Given a prompt like “The capital of Germany is”, the text is tokenized into IDs, run through the model, and out comes a score distribution over the entire vocabulary — on the order of 200,000–250,000 possible tokens. The highest-scoring entry gets detokenized back to Berlin, appended to the input, and the loop runs again until an end-of-text token appears.

Always taking the top score is greedy decoding, and most deployed LLMs don’t do it. Greedy decoding makes the model deterministic and pushes it toward regurgitating training data. Instead, scores are converted to probabilities and the next token is sampled from that distribution — enough variation to be useful, not so much that output becomes noise.

This is why the same prompt gives you slightly different answers each time.

The key insight: some positions are coin flips

Raschka’s second example is where the whole scheme becomes obvious. For the prompt “The weather today is cold and…”, plausible completions include gray and overcast.

Unlike the Berlin case, there is no objectively better choice here. Both are reasonable, both score similarly high, and across repeated sampling you’d get roughly half of each. These near-tie positions are the free space in the output — positions where the choice carries no quality cost.

That is exactly where a watermark can hide.

Watermarking is (almost) just a fixed random seed

Raschka then gives a short primer on random number generation. An unseeded generator produces a different sequence each run; a seeded one produces numbers that are still random but reproducible.

The punchline:

“The watermarking is nothing else for the end user than fixing a random seed and making this sampling kind of deterministic.”

Instead of an arbitrary seed, Anthropic uses a secret watermarking key fed into the seed generator. Sampling remains random in character, but which of the equally-good tokens gets chosen is now determined by the key.

This is why Anthropic’s claim that watermarking doesn’t degrade output holds up under scrutiny. The mechanism only operates at positions where multiple tokens are roughly equally good — and it never forces a low-scoring token.

Why naive detection would be unaffordable

If watermarking were only a seeded sampler, detection would require re-running the original prompt through the original model with the key, then comparing outputs. That’s infeasible in practice: you’d need to know which model produced the text, and you almost never know the prompt.

So the scheme needs detection that works on text alone. Raschka notes Anthropic derived their approach from Google DeepMind’s SynthID-Text, published in Nature.

Tournament sampling

The trick is to replace plain probabilistic sampling with a structured bracket.

Given candidate tokens for a position — cloudy, gray, overcast, gloomy — a set of watermarking functions G1…Gn, seeded by the secret key, assign each candidate a 0 or 1. Candidates are then paired off like playoff brackets:

  1. Round 1 uses G1. Pair cloudy vs gray, overcast vs gray, and so on. The candidate scoring 1 advances; ties are broken randomly (again keyed).
  2. Round 2 uses G2 on the survivors, and the bracket narrows.
  3. The final round produces the winner — say gray — which becomes the sampled token.

When candidates run short, the bracket duplicates entries to fill the pairings.

The output is a token that carries a statistical signature of the key across many positions. A detector holding the secret key and the G functions can score text directly, with no model inference and no knowledge of the prompt.

It’s removable, and that’s the interesting part

Raschka is direct about the limits.

Not every position is watermarked. The scheme only touches positions with genuinely competitive alternatives — for a token like trees in a context with no high-scoring substitute, there’s nothing to encode with, so that position is skipped. Since an attacker can’t tell which positions carry signal, removing the watermark reliably means editing throughout the text.

That’s tedious by hand, but trivial to automate. His prediction for what actually happens:

“Instead of getting the text directly from Claude, it’s now using Claude to generate AI-generated text, passing it through a local model, and then having edited AI-generated text which is likely not watermarked anymore.”

A local model, specifically — because the proprietary providers will all be watermarking. The net effect is that watermarking doesn’t stop bulk AI text generation; it adds a laundering step to the pipeline. And since the laundering model is typically weaker than the frontier model that wrote the draft, the paradoxical outcome is that watermarking may make published AI text slightly worse.

Key takeaways

  1. Watermarking operates at the sampling stage, not in training or as a post-processing pass. It’s a small modification to an existing loop.
  2. It exploits near-tie positions where two or more tokens are roughly equally good — which is why it doesn’t measurably degrade quality.
  3. Conceptually it’s a fixed random seed, with a secret watermarking key standing in for the seed.
  4. Naive detection would require re-running the model with the original prompt, which is impractical — hence a scheme that scores text standalone.
  5. Tournament sampling pairs candidate tokens in bracket rounds scored by keyed functions G1…Gn, embedding a detectable signature.
  6. Detection requires the secret key and the G functions, so only the provider can verify their own watermark.
  7. Not all positions are watermarked — only those with competitive alternatives — which is precisely what makes removal hard to target but possible in bulk.
  8. The likely real-world outcome is a laundering step: generate with a frontier model, rewrite with a local one, ship unwatermarked and slightly degraded text.

Source

  • Title: How Claude’s Text Watermarking Works
  • Speaker: Sebastian Raschka (author of Build a Large Language Model From Scratch)
  • Origin: Sebastian Raschka’s YouTube channel
  • Duration: ~48 minutes
  • URL: https://www.youtube.com/watch?v=tLv7qRWFMlw