Anthropic Watermarks Claude's Text Output; Independent Educator Breaks Down the Mechanism

What happened

Anthropic has started watermarking text generated by its Claude models, according to a company blog post published August 14. The stated goal, according to Anthropic, is to let the company later identify whether a piece of text was produced by a specific Claude model — the post references an example of confirming text came from "Claude Opus" — without the watermark being visible or detectable to end users reading the output.

Anthropic's original announcement was largely conceptual, containing no figures or code and only a link to an underlying technical paper. To fill that gap, machine learning educator Sebastian Raschka — author of Build a Large Language Model From Scratch and Build a Reasoning Model From Scratch — published a 48-minute video lecture on August 22 with an accompanying 52-slide deck and full transcript, walking through the mechanics of how such watermarking is implemented at the token-sampling level.

How the mechanism works, according to the explainer

Raschka's walkthrough starts from first principles: when an LLM generates the next token in a sequence, it produces a probability score distribution over its vocabulary, then samples from that distribution to pick the actual output token. Raschka's explanation is that watermarking works by subtly biasing this sampling step — favoring certain tokens over others in a pattern that is statistically undetectable to a casual reader but recoverable by anyone who has the underlying key or algorithm used to bias the sampling in the first place.

This is why, as Anthropic states, only the company itself can reliably decode whether a text carries its watermark: the detection depends on knowledge of the specific sampling bias applied, not on any visible marker in the text.

The lecture also addresses failure modes — cases where watermarking signals can degrade or be removed, for instance through paraphrasing, translation, or other post-processing of the generated text — a limitation inherent to statistical watermarking techniques broadly, not unique to Anthropic's implementation.

Anthropic did not disclose specific detection accuracy rates, false-positive rates, or robustness benchmarks in its public post, and Raschka's video does not reproduce such numbers either; the technical paper Anthropic links to for implementation specifics is not detailed with quoted figures in the available source material.

What this means

Text watermarking addresses a real problem: as LLM-generated content proliferates across the web, distinguishing human-written from AI-generated text has value for content moderation, academic integrity, and misinformation tracking. But the approach described here has a structural limitation — verification is centralized. Only Anthropic can confirm whether text came from Claude, since detection requires the company's private sampling-bias parameters. There is no independent or third-party verification path.

The technique is also not tamper-proof. Paraphrasing or heavy editing can degrade or eliminate the statistical signal, meaning determined bad actors can likely defeat it. That makes watermarking useful as a low-friction attribution signal for casual cases — spotting unedited AI text posted at scale — rather than a forensic-grade guarantee. Anthropic has not published the false-positive/false-negative rates that would let outside researchers judge how reliable the system actually is in practice.