Anthropic shows how it plans to watermark text. The signal sits in token sampling

The watermark is added during tournament sampling

Anthropic plans to watermark text at the token-sampling stage without requiring model retraining. The method operates on a tournament sampling principle, where a secret key controls the choice only at text positions where several tokens share similarly high probabilities. The technique therefore does not interfere with spots where the choice of the next word is obvious.

Detection scoring requires the original key

During later analysis, the text is evaluated using the same key and scoring functions. Without the key, one cannot reliably determine whether the analyzed text carries Anthropic's watermark, nor extract a pattern from it. The company stated it will prepare a detection API, but according to Raschka, it remains unclear whether it will be fully public or restricted to select partners, which will affect its practical usability for third parties.

Text edits can break the statistical signal

The watermark relies on preserving specific tokens at selected positions. Someone without the secret key does not know which words to change to remove the mark. However, a sufficient number of random edits, rephrasings, or inserted words can push the overall score below the reliable detection threshold. The resilience of this method thus lies not in the absolute immutability of the signal, but in the fact that its exact location remains hidden from an attacker.

Regulators are still waiting for a robust solution

Raschka anticipates that some users will have Claude's output post-processed by a local model, thereby erasing the statistical signature. It remains an open question whether this method will satisfy the strict requirements of the European AI Act, whose Article 50 enforcement began on August 2, 2026. The Act requires watermarking to be effective and robust, yet according to ACM Europe's technical reviewers responding to the Commission's draft guidelines in July, no single text watermarking tool had met all these parameters.

Lilith's verdict

Anthropic retains central control and offers everyone else detection through an API. Elegant provenance oversight, right up until the text passes through a second model and the statistical signature starts to fade.