Glonce

Sebastian Raschka explains how Claude watermarks AI text

securityThe Glonce editorsSebastian Raschka🔥75Glonce rating75Impact65Novelty70Relevance100Surprise55Players75Credibility80
Sebastian Raschka explains how Claude watermarks AI text

Days after Anthropic announced it would watermark the text outputs of its Claude models, machine learning educator Sebastian Raschka published a brief social-media explainer of the mechanism. It proved unexpectedly popular and sparked a lot of discussion and questions, so he expanded it into a full recorded lecture with an accompanying transcript, posted on his Substack magazine alongside a YouTube version and a linked slide deck. He originally planned around 10 slides and a 10-minute video; by the time he finished adding detail, the project had grown to more than 50 slides and a 48-minute recording.

Raschka frames Anthropic's motivation for watermarking as attribution: if someone posts a piece of text, the company wants a way to say it came from a specific Claude model, using his own example of "our Claude Opus 4.8 model". The watermark, as he describes it, is invisible to users and can be decoded only by Anthropic. He also says the lecture will get into how the watermarking technique can fail or be removed, though that part of the explanation falls outside the material examined here. He is critical of Anthropic's own explanatory article on the feature, noting it was edited more than once, was shorter when he first read it, and covers why Anthropic is doing this without a single figure showing how the mechanism actually works, which is the gap his lecture sets out to fill.

The available transcript works through the run-up to that mechanism: how ordinary LLM text generation happens before any watermark is applied. A prompt is tokenized into token IDs, passed through the model, and turned into a distribution of raw logit scores across the vocabulary, which Raschka illustrates with the prompt "the capital of Germany is": in his example the token at vocabulary index 19,846, corresponding to "Berlin", receives the highest score, on a plot he says spans roughly -8 or -9 to 20 and that he deliberately truncated to indices 19,800 to 19,900 out of a real vocabulary he puts at around 250,000 possible tokens. He walks through greedy decoding, always taking the highest-scoring token, as one way to pick the next token, then begins describing the alternative of converting logits into probabilities with a softmax function before sampling, which is what keeps LLM output from collapsing into memorized, repetitive responses. The transcript captured here runs through that build-up to sampling; the video and slides linked from the piece continue from there into the watermarking mechanism itself.

Key facts

  • Days after Anthropic said it would watermark Claude's text outputs, Sebastian Raschka expanded an earlier viral social-media post into a full video lecture with a transcript and slide deck.
  • The project grew from a planned 10 slides and a 10-minute video to more than 50 slides and a 48-minute recording.
  • Per Raschka, the watermark lets Anthropic attribute posted text to a specific model (his example: "Claude Opus 4.8"), is invisible to users, and can be decoded only by Anthropic.
  • The material available walks through ordinary LLM next-token generation, tokenizing a prompt, producing logit scores across a roughly 250,000-token vocabulary, and sampling via greedy decoding or softmax, illustrated with a "capital of Germany" example where the "Berlin" token sits at vocabulary index 19,846.
  • Raschka criticizes Anthropic's own explanatory article on the watermark as conceptual and figure-free, saying it explains why the feature exists but not how it works.

Why it matters

Anthropic said it will watermark text generated by its Claude models, part of a broader push to let AI-generated text be identified after the fact. Raschka's lecture matters because it is a first-principles account of the underlying mechanism from a well-known ML educator, author of the from-scratch LLM and reasoning-model books he references in the piece, aimed at readers who want to understand what the watermark actually does before forming an opinion on it.

Who it affects

Anthropic and users of its Claude models, whose outputs will carry the watermark; anyone who reads text online that may have been LLM-generated and wants a way to tell; and ML practitioners and researchers interested in how next-token sampling and watermarking interact.

How to use it

The material is free: a Substack post with an embedded video, a full transcript, a mirrored YouTube upload, and a linked slide deck, all from Raschka's own magazine. Nothing in the available text indicates a paywall or signup requirement.

How solid is it

Raschka is an established ML educator with published from-scratch books on building LLMs and reasoning models, and the lecture grew directly out of an earlier post that already drew heavy engagement and questions, which he says he wrote it to answer. The portion available here builds carefully from first principles, tokenization, logits, softmax, before reaching sampling, and reads as a considered technical walkthrough rather than a quick take.

Risks and caveats

This is Raschka's own explainer, not an Anthropic statement; his description of Anthropic's motivation for watermarking should be read as his account of the announcement, not a direct company quote. He says the full lecture also covers how the watermark can fail or be removed, but that part sits beyond the material reviewed here. He dates Anthropic's original watermarking article to "a few days" before August 14 without giving a year.

“This watermark is invisible to users, so only they can decode it and find out whether the text has their watermark.”

— Sebastian Raschka