How Claude Watermarks AI-Generated Text: A 48-Minute Deep Dive
On August 22, 2026, Sebastian Raschka, a PhD and author of the books "Build a Large Language Model From Scratch" and "Build a Reasoning Model From Scratch," published a detailed article and video lecture explaining how Anthropic's Claude models watermark AI-generated text. The 48-minute video, which grew from an originally planned 10-minute presentation, walks through the underlying mechanism of token sampling, watermark detection, and watermark removal. Raschka's work arrives just days after Anthropic announced the watermarking of text outputs from their Claude models, a move that has sparked widespread discussion about AI content provenance.
The lecture, titled "How Claude Watermarks AI-Generated Text" and published on Raschka's Ahead of AI platform, uses 52 slides to break down a technique that Anthropic described in a blog post called "How Claude's Text Watermark Works." That blog post, published around August 14, 2026, was updated a couple of times after its initial release and notably contains no figures. Raschka's video fills that gap with visual explanations drawn from his from-scratch coding materials, offering what he describes as a clear path to understanding the implementation.
Raschka is careful to note his position. He is not affiliated with Anthropic, and he states plainly that he is not defending watermarks, just explaining them. The goal, he says, is to help users understand the mechanism well enough to make up their own minds about the pros and cons. His analysis centers on a simple but powerful observation: watermarking is nothing else for the end user than fixing a random seed.
The Core Mechanism: Sampling and Seeds
To understand watermarking, Raschka starts with the basics of how large language models generate text. When you give a model a prompt like "the capital of Germany is," the expected answer is "Berlin." But the process is not a simple lookup. The input is converted to token IDs, passed through the model to get logit scores, and then the next token is sampled from those scores.
Logit scores are raw values that range from minus infinity to plus infinity across the entire vocabulary. In a modern LLM, that vocabulary is around 250,000 possible tokens. The scores themselves are not probabilities. To get probabilities, the model applies a softmax function, which converts the logit scores into a distribution that sums to one.
Raschka illustrates this with a concrete example. In his demonstration, the logit scores range from about -8 or -9 up to 20. The vocabulary index for "Berlin" sits at 19,846, which is the position with the highest score in the example. After softmax normalization, the probability of "Berlin" comes out to 99%. In a realistic, well-trained LLM, that probability would be even higher, around 99.999999%, because the model is so confident in the answer. The difference between 99% and 99.999999% matters for watermarking, as Raschka later shows, because the technique only intervenes where the model is uncertain.
But even a 99% probability leaves room for variation. To show this, Raschka samples from the distribution 10,000 times. The results are striking: "Berlin" is selected 9,997 times out of 10,000. The remaining three samples go to other tokens, with "Hal" appearing 2 times and "Moh" appearing 1 time. This illustrates the fundamental nature of probability sampling in LLMs. A 1% chance of picking something other than "Berlin" means that, over many generations, the model will occasionally produce an unexpected token.
Most LLMs do not use greedy decoding, which simply selects the highest score token. Instead, they use probability sampling to allow for variation in outputs. This is why the same prompt can produce different responses. To make this sampling reproducible, developers use a random seed. A random seed is a number that initializes the random number generator, ensuring that the same seed produces the same sequence of random choices.
Raschka demonstrates this with a simple example. Using the prompt "today's weather is cold," the possible answers include "gray" or "overcast." With a random seed of 42, the sampling selects "overcast." With a different random seed, say 99, it selects "gray." The seed determines the outcome. This is the foundation of the entire watermarking scheme.
This is where watermarking enters the picture. Anthropic's technique uses a secret key, similar to an API key, combined with information from the four previous words to derive a random seed. That seed then influences the sampling at each position. The result is that text generation becomes more deterministic at certain positions, creating a pattern that can be detected later.
Raschka emphasizes that watermarking is applied at the sampling stage, not inside the LLM itself. This means no retraining is required. The model's weights are untouched. The watermark is a minor tweak inside the regular text generation process, a layer on top of the existing sampling mechanism. The model's capabilities, its knowledge, and its fluency remain exactly as they were before the watermark was added.
The choice of the four previous words is not arbitrary. It provides context that is unique to the text being generated. Two different texts will have different preceding words, and therefore different seeds at each position. This is what makes the watermark detectable across a wide range of outputs. The secret key adds a layer of security, ensuring that only those who possess the key can reproduce the exact seed sequence.
Raschka also clarifies a common misconception. The watermark is not embedded in the text itself, like a visible marker or a hidden string of characters. It is a statistical pattern in the token choices. The text reads normally, and a human cannot see the watermark. Only a computational analysis, armed with the key, can reveal it.
The lecture spends considerable time on this point because it is central to understanding both the power and the limits of the technique. The watermark is not a stamp on the output. It is a subtle bias in the sampling process that, when aggregated across many tokens, becomes statistically significant.
How Detection Works
Watermark detection is not a simple process. It requires access to the watermarking key or a scoring function that can evaluate whether a given text contains the watermark pattern. Without that key, detection is impossible. Raschka is explicit on this point: watermark detection is only possible with the key or an API that provides the scoring.
Initially, only Anthropic will have the key. The company plans to develop an API for watermark detection, but the details are not yet public. Raschka notes that he does not know whether the API will be private for companies like X or Substack Notes, or public for end users. Both options are on the table. This uncertainty matters because it determines who can actually use the watermark in practice.
The detection process works by checking whether the text's token choices align with the expected pattern given the secret key and the previous tokens. If a text was generated by a watermarked Claude model, the token selections at watermark positions will match what the key predicts. If the text was written by a human or generated by a different model, the match will be no better than random chance.
To make this concrete, Raschka explains that the watermarking makes text generation more deterministic at certain positions. At those positions, the model is steered toward specific tokens that fit the watermark pattern. A detection algorithm can then scan the text, recompute the expected tokens using the key, and compare them to what actually appears. If the match rate exceeds a threshold, the text is flagged as AI-generated.
The threshold is important. A perfect match is not required because the watermark is probabilistic. The detection algorithm uses a scoring function that accumulates evidence across many positions. The more tokens that match the expected pattern, the higher the score, and the more confident the detection. At its heart, the detection question is simple: "How likely is a certain token to be selected?" Raschka poses this as the core query the scoring function must answer.
Raschka walks through a hypothetical detection scenario to illustrate the process. Suppose a text has 100 tokens. At each token position, the detector computes the probability that the observed token would have been selected under the watermarking scheme. If the text was watermarked, those probabilities will be systematically higher than chance. If the text was not watermarked, the probabilities will hover around the baseline. The detector sums these probabilities and compares the total to a threshold. If the total exceeds the threshold, the text is classified as AI-generated.
The threshold is not fixed. It can be tuned to balance false positives and false negatives. A low threshold catches more AI-generated text but also flags more human-written text. A high threshold reduces false alarms but misses some watermarked text. Anthropic will need to choose a threshold that works for their use case, and that choice will affect how the watermark is perceived in practice.
Raschka also addresses a common question: does watermarking degrade text quality? According to the Claude blog post, watermarking should not make the text worse. Raschka explains why. The watermark only affects positions where tokens are almost equally likely. At those positions, the model is not highly confident, so steering it toward one of several plausible tokens does not harm the output. At positions where the model is highly confident, like the "Berlin" example with its 99% probability, the watermark does not interfere because the token is already determined.
This design is clever. It places the watermark in the "gray zones" of generation, where the model would produce any of several acceptable tokens. The result is a text that reads naturally but carries a detectable pattern. The watermark is invisible to the reader, and it does not change the meaning or the style of the text.
Raschka notes that the watermark is not applied at every token position. It is applied selectively, only where the model's confidence is low enough that the watermark can influence the choice without degrading quality. This selective application is what makes the watermark both effective and unobtrusive.
The detection algorithm does not need to know which positions are watermarked in advance. It can compute the expected pattern for every position using the key and the previous tokens, then compare the observed tokens to the expected distribution. The watermark positions will show a stronger match, and the detector can aggregate the evidence across all positions.
The Role of Random Seeds in Practice
Raschka spends considerable time on random seeds because they are central to understanding the watermark. In standard LLM usage, sampling is often done without a random seed. This means the output is not reproducible. Each generation is a fresh roll of the dice.
Some tools allow users to set a random seed for reproducibility. OpenAI's API, for example, has capabilities for setting random seeds. Raschka notes that setting random seeds may not be possible with Claude and OpenAI APIs in all cases. He also shares his experience with Ollama, a software tool for running LLMs locally. He found that setting random seeds in Ollama did not always produce deterministic results. This is a practical observation that highlights the complexity of implementing reproducible sampling.
The watermarking technique essentially fixes the random seed for the end user, but in a way that is invisible and controlled by Anthropic. The user does not choose the seed. The secret key and the previous tokens determine it. This is why Raschka says watermarking is nothing else for the end user than fixing a random seed. The user sees the same kind of behavior, but the seed is not under their control.
This insight is powerful because it demystifies the technique. Watermarking is not a mysterious black box. It is a deterministic modification of the sampling process. Once you understand how random seeds work, you understand the foundation of the watermark.
Raschka also notes that most people do not use a random seed when sampling. They simply accept the variation that comes with probability sampling. The watermark changes this by introducing a hidden seed that is consistent across generations, enabling detection.
The practical implications of this are significant. For developers who want reproducible outputs, the watermark introduces a new constraint. They cannot simply set a seed and expect the same output every time, because the watermark overrides the seed with its own derived seed. This could be a problem for applications that require exact reproducibility, such as testing or debugging.
Raschka does not speculate on whether Anthropic will provide a way to disable the watermark for users who need reproducibility. He simply notes the tension between reproducibility and watermarking. The two goals are in conflict, and the watermark prioritizes detection over reproducibility.
The lecture also touches on the broader ecosystem of LLM tools. Many open-source models and local tools, like Ollama, give users full control over sampling parameters, including the seed. This control is valuable for experimentation and for building applications that require consistent outputs. The watermark, by contrast, removes that control for Claude models. Users of Claude will not be able to reproduce outputs exactly, even if they try to set a seed.
Raschka's observation about Ollama is particularly instructive. He found that even when he set a seed in Ollama, the outputs were not always deterministic. This suggests that implementing reproducible sampling is harder than it sounds. There are many sources of randomness in the generation process, and a single seed may not control all of them. The watermark, by deriving its seed from the key and the previous tokens, sidesteps this problem by making the seed a function of the text itself.
Watermark Removal: A Guessing Game
No watermark is unbreakable, and Raschka addresses this directly. The watermark can be removed by editing tokens at watermark positions. If you know where those positions are, you can replace the watermarked tokens with alternatives and break the pattern.
But here is the catch: without knowing the watermark positions, removal requires random editing and guessing. You might edit the text, but you might not hit the watermark positions. Raschka gives a concrete example. If the model generated "overcast" at a watermark position, you could replace it with "cloudy." If you guessed correctly, you break the watermark at that position. If you guessed wrong, you have edited a non-watermark position and the watermark remains intact.
The challenge is that the watermark positions are scattered throughout the text. In Raschka's example with 7 interchangeable positions, there are 128 possible output texts (2^7). Each position could be one of two tokens. To remove the watermark, you would need to change the right tokens at the right positions, but you do not know which positions are watermarked.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
This makes removal a guessing game. You could try to edit every position, but that would change the text significantly and might introduce errors. You could try to paraphrase the entire text, but that is a different kind of attack and not always effective. The watermark is designed to be robust against casual editing.
Raschka is careful to note that he is not providing a guide to removing watermarks. He is explaining the mechanism so that users understand the limitations. The watermark is not permanent, but it is not trivially removable either. The difficulty of removal depends on knowing the watermark positions, which are hidden.
The author also notes that the watermark detection is impossible without the key. This means that even if you remove the watermark, you cannot verify that you have done so without access to the detection API. The key is the linchpin of the entire system.
Raschka explores the mathematics of the guessing game in more detail. With 7 interchangeable positions, each having 2 possible tokens, the total number of possible texts is 2^7, or 128. If you randomly edit one position, you have a 1 in 7 chance of hitting a watermark position, and even then, you have a 50% chance of choosing the wrong replacement token. The probability of successfully removing the watermark with a single random edit is therefore quite low.
To increase your chances, you would need to edit multiple positions. But each edit risks introducing errors or changing the meaning of the text. There is a trade-off between removing the watermark and preserving the quality of the text. The watermark is designed to make this trade-off unfavorable for the attacker.
Raschka also discusses the possibility of using another LLM to paraphrase the text. This is a more sophisticated attack, but it is not guaranteed to work. The paraphrasing model might preserve the watermark pattern if it keeps the same token choices at watermark positions. Or it might introduce new tokens that break the pattern. The outcome depends on the specific paraphrase and the watermark's design.
The lecture does not provide a definitive answer on whether the watermark can be removed reliably. Raschka's point is more modest: the watermark is not unbreakable, but breaking it requires effort and knowledge that most users do not have. The watermark raises the cost of undetected AI-generated text, even if it does not make it impossible.
Why From-Scratch Understanding Matters
Throughout the lecture, Raschka emphasizes the value of understanding things from scratch. He uses figures from his from-scratch coding materials in the slides, and he notes that coding from scratch is useful for understanding implementations clearly. This is not just an academic exercise. It has practical benefits.
Raschka observes that LLMs can now do coding, but reading code is still useful. Even in an era of AI-assisted development, understanding the underlying mechanics helps researchers and developers evaluate new techniques, spot weaknesses, and make informed decisions. The watermarking technique is a good example of why this matters. Without a from-scratch understanding, the watermark would remain a black box, and users would have to take Anthropic's word for how it works.
The lecture itself is a testament to this philosophy. Raschka originally planned a 10-slide, 10-minute video. It expanded to 52 slides and 48 minutes because the topic demanded depth. He notes that the video transcript is slightly edited and cleaned up for readability, and the video is also available on YouTube. He provides a link to the slides for those who want to follow along.
The timing is significant. Anthropic announced the watermarking of Claude text outputs a few days before August 22, 2026, around August 14. The announcement was accompanied by the blog post "How Claude's Text Watermark Works," which was updated a couple of times after initial publication. The blog post contains no figures, which is why Raschka's visual explanation fills a gap.
The watermarking applies to Claude models, including Claude Opus 4.8, which is mentioned as an example model whose generated text could be identified via watermarking. The technique is not limited to a specific version, but Opus 4.8 serves as a concrete reference point.
Raschka's from-scratch approach also has pedagogical value. By building the watermark from first principles, he shows that the technique is not magic. It is a combination of well-understood concepts: token sampling, random seeds, and statistical detection. This demystification is valuable for a wide audience, from students learning about LLMs to practitioners who need to evaluate the watermark's implications for their work.
The lecture also serves as a case study in how to analyze a new AI technique. Raschka does not simply accept Anthropic's claims. He examines the mechanism, tests it with examples, and explains the trade-offs. This critical approach is a model for how researchers and users should engage with new AI technologies.
Raschka's decision to make the video 48 minutes long, rather than the planned 10 minutes, reflects his commitment to thoroughness. He could have given a high-level overview, but he chose to go deep. The result is a resource that will remain useful long after the initial announcement fades from the news cycle.
The Bigger Picture: Detection APIs and Platform Integration
Looking beyond the technical mechanism, Raschka discusses the potential applications of watermark detection. Anthropic plans to develop an API for watermark detection. This API could be used by platforms to label AI-generated content.
X, the social media platform, is mentioned as a potential user. Substack Notes, the social media feature of Substack, is also mentioned. Both platforms could use the API to automatically label posts that were generated by Claude models. This would give users more transparency about the content they encounter.
The API might be private for companies like X or Substack Notes, or it might be public for end users. Raschka does not know the details, and he says so. The decision will shape how the watermark is used in practice. A private API would give platforms a tool to moderate content. A public API would empower individual users to check any text they encounter.
The watermarking technique is a minor tweak inside the regular text generation process. It does not require retraining the LLM. It does not change the model's capabilities. It simply adds a layer of determinism at certain positions, creating a pattern that can be detected with the right key.
Raschka's analysis suggests that the watermark should not make text worse because it only affects positions where tokens are almost equally likely. At those positions, the model is not highly confident, so steering it toward one of several plausible tokens does not harm the output. This is a key design choice that makes the watermark practical for real-world use.
The author also notes that without watermarking, sampling is often done without a random seed. This means that most LLM outputs are not reproducible. The watermark changes this by introducing a hidden seed that is consistent across generations, enabling detection.
The lecture covers the full arc of the technique: how it works, how detection works, how removal works, and why it matters. Raschka's from-scratch approach makes the material accessible to a wide audience, from students to researchers to practitioners.
In the end, the watermark is a tool with trade-offs. It provides a way to identify AI-generated text, which can help with transparency and accountability. But it also introduces a level of control by the model provider, since only Anthropic will have the key initially. Users who want to verify whether a text is AI-generated will need to rely on Anthropic's API, which may or may not be publicly available.
Raschka's lecture is a valuable contribution to the ongoing conversation about AI content provenance. By explaining the mechanism in detail, he empowers readers to understand the technique and make up their own minds about its implications. The 48-minute video and 52 slides are a deep dive into a topic that is likely to become increasingly important as AI-generated content becomes more widespread.
The article was published on August 22, 2026, on the Ahead of AI platform. The video is also available on YouTube, and the slides are linked for further study. Raschka's work stands as a clear, thorough, and honest explanation of a complex topic.
The watermark's design also raises questions about the future of AI content. If watermarking becomes standard across major model providers, it could create a new layer of accountability for AI-generated text. Platforms could automatically label AI content, giving users more information about what they are reading. This could help combat misinformation and improve trust in online content.
But the watermark also has limitations. It only works for text generated by Claude models. Text from other models, or text that has been heavily edited, may not be detectable. The watermark is not a universal solution to the problem of AI content identification. It is one tool among many, and its effectiveness depends on how it is deployed.
Raschka does not take a position on whether watermarking is good or bad. He presents the facts and lets readers draw their own conclusions. This neutrality is consistent with his stated goal of explaining the mechanism without defending it. The lecture is a technical resource, not a policy argument.
For researchers, the lecture offers a detailed look at a real-world implementation of a technique that has been discussed in academic literature for years. Watermarking has been proposed as a way to address the challenges of AI content provenance, and Anthropic's implementation is one of the first to be deployed at scale. Raschka's analysis provides a valuable reference point for understanding how the theory translates into practice.
For practitioners, the lecture offers practical insights into how the watermark affects the use of Claude models. The inability to set a random seed, the potential for detection, and the challenges of removal are all factors that developers and content creators will need to consider. Raschka's explanation of these factors is clear and actionable.
The lecture also highlights the importance of transparency in AI development. Anthropic's decision to publish a blog post explaining the watermark, even without figures, is a step toward openness. Raschka's video builds on that transparency by providing the visual explanations that the blog post lacks. Together, the two resources give users a comprehensive understanding of the technique.
As AI-generated content becomes more prevalent, the ability to identify it will become more important. Watermarking is one approach to this challenge, and Anthropic's implementation is a significant development. Raschka's lecture ensures that the technical details are accessible to a broad audience, which is essential for informed public discussion.
The 48-minute video is a substantial investment of time, but Raschka argues that it is worth it. The topic is complex, and a shorter presentation would not do it justice. The expansion from 10 minutes to 48 minutes reflects the depth of the material and the importance of getting it right.
Raschka's work is a reminder that understanding AI technology requires more than just using it. It requires digging into the details, questioning assumptions, and building knowledge from the ground up. The watermark is a perfect example of a technique that seems simple on the surface but has significant implications when examined closely.
The lecture also serves as a bridge between academic research and practical application. Raschka's from-scratch coding materials are designed for education, but they also provide a foundation for understanding real-world implementations. This connection between theory and practice is valuable for anyone working with AI.
In the end, the watermark is a tool with trade-offs. It provides a way to identify AI-generated text, which can help with transparency and accountability. But it also introduces a level of control by the model provider, since only Anthropic will have the key initially. Users who want to verify whether a text is AI-generated will need to rely on Anthropic's API, which may or may not be publicly available.
Raschka's lecture is a valuable contribution to the ongoing conversation about AI content provenance. By explaining the mechanism in detail, he empowers readers to understand the technique and make up their own minds about its implications. The 48-minute video and 52 slides are a deep dive into a topic that is likely to become increasingly important as AI-generated content becomes more widespread.
The article was published on August 22, 2026, on the Ahead of AI platform. The video is also available on YouTube, and the slides are linked for further study. Raschka's work stands as a clear, thorough, and honest explanation of a complex topic.