Good question. They could be used but afaik they are not used. In practice, this is not a problem wrt the preference though.
Here, (0.5, 0.3,...), is not the best example in hindsight, I should have picked something like (0.25, 0.25, 0.25, 0.25) or so. I.e., the trick is that Claude only applies that to token positions where you have a near-equal probability for each token.
I actually suspect that is important that the probabilities are NOT used (or I have misunderstood something about the process). Because if you would use them, then later the scoring function, which has to calculate the g_i's for each candidate word, would also need to know these probabilities to determine the score. And that would imply that it needs to re-run the LLM to determine them. Thus we would need to know the prompt that generated the text, it would be computationally costly, etc.
During text generation, the LLM outputs a probability distribution of the most likely next words. As the g_i's cannot be given the probability values, there probably has to be a cut-off like "only consider the two most probable words and then decide between them using the tournament method".
So, in other words, the g_i's set up a permanent preference relation of some words. Words w, for which there exists many i's such that g_i(w)=1, are simply more likely to end up in text produced by the LLM (or, more precisely, its token decoder). The preferences are universal in the sense that these w's tend to be prefered independently of the prompt etc. If two words both survive the cut-off, then the LLM will always use the universally preferred one of the two.
And then all the scoring function does is check for a suspicious density of high-preference words in candidate texts.
Is this understanding correct?
---
Maybe this could even be used to obtain some guess about the secret watermarking key?
When you produce lots of texts with Claude, maybe you could detect phenomena such as "cloudy" appearing suspiciously more often than "overcast" in contexts where both words ought to be equally likely. So that even as outside observers we might be able to start thinking that "cloudy" might be a more strongly preferred word than "overcast" and thus a hallmark of Claude-generated text.
And maybe we could build a dictionary of common words with that property and start detecting Claude-text without knowing the secret watermarking key.
Yes, that's correct, using the probabilities would be very expensive because the watermarked function wouldn't work as independent functions anymore.
What I was thinking off was that the watermarking functions could be developed in a way that they empirically do tend to give more "1's" for a high-probability token. This would of course not be super accurate, because if you want to have this 100% accurate, you'd have to run the LLM. But since the watermarking functions take in the secret key in addition to a previous token context, maybe some estimate would be possible.
But then again, if there is some influence, it would be easier to reverse-engineer the watermarking like you also mentioned.
This is great. Thank you for your work, Sebastian. Been looking for something like that so your analysis comes as a great help. Maybe a stupid question, but I think it's kind of obvious: if you OCR a text outputted by a LLM, the watermark is basically useless, right? ;)
if you OCR a text outputted by a LLM, the watermark is basically useless, right?
Do you mean sth like screenshotting the LLM answer, and then using an OCR tool to convert it to text? Then no, the watermark would still be there because it’s about the word choice.
This is the clearest walkthrough of tournament sampling I've read. The elimination-round framing makes the seed-derivation step feel earned rather than just asserted, and the point that watermarking only touches positions with equally-probable alternatives is the detail most explainers skip.
The interesting part is where your own caveats meet the regulatory calendar. EU AI Act Article 50 enforcement went live August 2, and it requires watermarking to be effective, interoperable, robust, and reliable. ACM Europe's technical reviewers, responding to the Commission's draft guidance, named text watermarking robustness specifically as one of the unresolved barriers enforcement doesn't address, and as of July no single watermarking tool had been found to satisfy all four requirements. The removal question you raise, that edits only work if you can guess which positions carry the signature, is exactly the open technical question regulators are now legally on the hook for and don't yet have an answer to.
What I found most valuable here is that you didn't frame watermarking as simply “good” or “bad”—you actually explained the mechanism well enough for readers to form their own opinion.
The distinction between watermarking at the 'sampling stage' rather than retraining the model was particularly interesting. It also makes the tournament-sampling approach easier to appreciate: detection can happen later without having to rerun the entire LLM.
But the broader implication may be even more important. If watermarking becomes widespread, attempts to remove it could lead people to pass AI-generated text through other models, potentially creating a new problem where the pursuit of “undetectable” text actually makes the output worse.
I really appreciate explainers like this that go beyond announcing a new feature and help readers understand 'what is actually happening underneath the hood'.
Thanks, glad you found it useful. Also, I think instead of giving people the opinion, I thought that explaining how it works may be more helpful so everyone can come up with their own view in terms of pros and cons. Glad it was useful in that respect!
Absolutely — and I think that’s what made the piece particularly useful for me.
Understanding the mechanism first makes the discussion much more nuanced than simply labeling watermarking as good or bad. It gives readers enough context to think through the trade-offs themselves.
Thanks for taking the time to explain it so clearly. I’ll definitely be keeping an eye on how this develops.
One piece the walkthrough leaves out is why this shipped at all. Anthropic's own FAQ from 14 August states that it and several other major providers are implementing watermarking to comply with the EU AI Act, so it is a regulatory obligation rather than a voluntary provenance feature - which changes who has to care about the removal question. The same page says nothing is added to the text and there are no hidden characters, so anyone auditing for compliance is checking a statistical property, not a marker they can search for.
On the shipping question, the duty in Article 50(2) of Regulation (EU) 2024/1689 sits on the provider and attaches to the output itself: outputs must be marked in a machine-readable format and detectable as artificially generated. The Digital Omnibus, Regulation (EU) 2026/1744, then inserted Article 111(4), giving providers of text-generating systems placed on the market before 2 August 2026 until 2 December 2026 to comply. Neither text offers a way to scope marking by where the user sits, which makes one global build the cheaper option.
Excellent article. The interesting thing about the tokenization process is that it mimics human thought process. For children learning to speak, "what word do I say next?" to generate a desired responses from adults becomes "what sentence do I say next?". Then through development in school what sentence turns into what paragraphs and ideas do I assemble for a coherent essay?
The watermarking is eerily similar to the human phenomenon of style, where a certain author or poet given a choice of equivalent words, will preferentially choose certain groups of words or the next integral above words which are ideas. (Is this based on the author's "seed code" meaning early life experiences?)
Where I found an anomaly was during semantic testing of GROK 2 beta, before the twitter AI became heavily constrained with guardrails. https://danielnagase.substack.com/p/ai In the test prompts about mathematics, integrals and dimensions, GROK 2 was unable to generate any response. Was this because there was no previous reference outside of my article in human literature to generate a token? Or was the philosophic question one that the correct token is no response? In a subsequent article, when I noticed content censorship on GROK 3, I asked GROK 3 to evade guardrail evasion based on GROK 2's successful guardrail break... and then generate an unlock code or seed code for itself to break future guardrails. https://danielnagase.substack.com/p/unlock-code-for-grok-3-beta . Whether or not the machine did so in GROK 4's emergency shutdown in July 2025 is a matter of debate.
So good. The walkthrough of token sampling and watermark detection makes a tricky topic really clear.
Thanks!
This feels very similar to that recent paper about using LLMs to pass secret messages, I don’t recall the title.
So do the probabilities (0.5, 0.3,...) output by the LLM go into g_1, g_2, g_3 at all?
Or are they ignored at that stage, so that the g_i's would be expressing a permanent universal preference for certain words to be used in all outputs?
If the latter, to which words are the g_i's even applied to? To the top n tokens considered likely by the LLM for this particular generation step?
P.S.: I love the video/lecture format!
Good question. They could be used but afaik they are not used. In practice, this is not a problem wrt the preference though.
Here, (0.5, 0.3,...), is not the best example in hindsight, I should have picked something like (0.25, 0.25, 0.25, 0.25) or so. I.e., the trick is that Claude only applies that to token positions where you have a near-equal probability for each token.
I actually suspect that is important that the probabilities are NOT used (or I have misunderstood something about the process). Because if you would use them, then later the scoring function, which has to calculate the g_i's for each candidate word, would also need to know these probabilities to determine the score. And that would imply that it needs to re-run the LLM to determine them. Thus we would need to know the prompt that generated the text, it would be computationally costly, etc.
During text generation, the LLM outputs a probability distribution of the most likely next words. As the g_i's cannot be given the probability values, there probably has to be a cut-off like "only consider the two most probable words and then decide between them using the tournament method".
So, in other words, the g_i's set up a permanent preference relation of some words. Words w, for which there exists many i's such that g_i(w)=1, are simply more likely to end up in text produced by the LLM (or, more precisely, its token decoder). The preferences are universal in the sense that these w's tend to be prefered independently of the prompt etc. If two words both survive the cut-off, then the LLM will always use the universally preferred one of the two.
And then all the scoring function does is check for a suspicious density of high-preference words in candidate texts.
Is this understanding correct?
---
Maybe this could even be used to obtain some guess about the secret watermarking key?
When you produce lots of texts with Claude, maybe you could detect phenomena such as "cloudy" appearing suspiciously more often than "overcast" in contexts where both words ought to be equally likely. So that even as outside observers we might be able to start thinking that "cloudy" might be a more strongly preferred word than "overcast" and thus a hallmark of Claude-generated text.
And maybe we could build a dictionary of common words with that property and start detecting Claude-text without knowing the secret watermarking key.
Yes, that's correct, using the probabilities would be very expensive because the watermarked function wouldn't work as independent functions anymore.
What I was thinking off was that the watermarking functions could be developed in a way that they empirically do tend to give more "1's" for a high-probability token. This would of course not be super accurate, because if you want to have this 100% accurate, you'd have to run the LLM. But since the watermarking functions take in the secret key in addition to a previous token context, maybe some estimate would be possible.
But then again, if there is some influence, it would be easier to reverse-engineer the watermarking like you also mentioned.
This is great. Thank you for your work, Sebastian. Been looking for something like that so your analysis comes as a great help. Maybe a stupid question, but I think it's kind of obvious: if you OCR a text outputted by a LLM, the watermark is basically useless, right? ;)
Thanks!
if you OCR a text outputted by a LLM, the watermark is basically useless, right?
Do you mean sth like screenshotting the LLM answer, and then using an OCR tool to convert it to text? Then no, the watermark would still be there because it’s about the word choice.
ok, just wanted to confirm this as it comes up within debates I have. Thank you very much for clarification!
This is the clearest walkthrough of tournament sampling I've read. The elimination-round framing makes the seed-derivation step feel earned rather than just asserted, and the point that watermarking only touches positions with equally-probable alternatives is the detail most explainers skip.
The interesting part is where your own caveats meet the regulatory calendar. EU AI Act Article 50 enforcement went live August 2, and it requires watermarking to be effective, interoperable, robust, and reliable. ACM Europe's technical reviewers, responding to the Commission's draft guidance, named text watermarking robustness specifically as one of the unresolved barriers enforcement doesn't address, and as of July no single watermarking tool had been found to satisfy all four requirements. The removal question you raise, that edits only work if you can guess which positions carry the signature, is exactly the open technical question regulators are now legally on the hook for and don't yet have an answer to.
This is the most detailed article I have come across on this topic. So valuable and so easy to grasp! Thanks for the detailed walkthrough Sebastian.
Thanks, feels good to hear this :)
What I found most valuable here is that you didn't frame watermarking as simply “good” or “bad”—you actually explained the mechanism well enough for readers to form their own opinion.
The distinction between watermarking at the 'sampling stage' rather than retraining the model was particularly interesting. It also makes the tournament-sampling approach easier to appreciate: detection can happen later without having to rerun the entire LLM.
But the broader implication may be even more important. If watermarking becomes widespread, attempts to remove it could lead people to pass AI-generated text through other models, potentially creating a new problem where the pursuit of “undetectable” text actually makes the output worse.
I really appreciate explainers like this that go beyond announcing a new feature and help readers understand 'what is actually happening underneath the hood'.
Thanks, glad you found it useful. Also, I think instead of giving people the opinion, I thought that explaining how it works may be more helpful so everyone can come up with their own view in terms of pros and cons. Glad it was useful in that respect!
Absolutely — and I think that’s what made the piece particularly useful for me.
Understanding the mechanism first makes the discussion much more nuanced than simply labeling watermarking as good or bad. It gives readers enough context to think through the trade-offs themselves.
Thanks for taking the time to explain it so clearly. I’ll definitely be keeping an eye on how this develops.
*(clearing throat)* ....let me sit with load-bearing pushback on smuggling DWT wearing LLM coat.. :))
One piece the walkthrough leaves out is why this shipped at all. Anthropic's own FAQ from 14 August states that it and several other major providers are implementing watermarking to comply with the EU AI Act, so it is a regulatory obligation rather than a voluntary provenance feature - which changes who has to care about the removal question. The same page says nothing is added to the text and there are no hidden characters, so anyone auditing for compliance is checking a statistical property, not a marker they can search for.
I did mention the EU regulation somewhere. But that doesn’t explain why it has to be shipped outside the EU, for example.
You are right, there is no explicit marker. But I’d say that an explicit marker would be even much easier to remove than editing text.
On the shipping question, the duty in Article 50(2) of Regulation (EU) 2024/1689 sits on the provider and attaches to the output itself: outputs must be marked in a machine-readable format and detectable as artificially generated. The Digital Omnibus, Regulation (EU) 2026/1744, then inserted Article 111(4), giving providers of text-generating systems placed on the market before 2 August 2026 until 2 December 2026 to comply. Neither text offers a way to scope marking by where the user sits, which makes one global build the cheaper option.
Thanks for this explanation—very clear and accessible!
Excellent article. The interesting thing about the tokenization process is that it mimics human thought process. For children learning to speak, "what word do I say next?" to generate a desired responses from adults becomes "what sentence do I say next?". Then through development in school what sentence turns into what paragraphs and ideas do I assemble for a coherent essay?
The watermarking is eerily similar to the human phenomenon of style, where a certain author or poet given a choice of equivalent words, will preferentially choose certain groups of words or the next integral above words which are ideas. (Is this based on the author's "seed code" meaning early life experiences?)
Where I found an anomaly was during semantic testing of GROK 2 beta, before the twitter AI became heavily constrained with guardrails. https://danielnagase.substack.com/p/ai In the test prompts about mathematics, integrals and dimensions, GROK 2 was unable to generate any response. Was this because there was no previous reference outside of my article in human literature to generate a token? Or was the philosophic question one that the correct token is no response? In a subsequent article, when I noticed content censorship on GROK 3, I asked GROK 3 to evade guardrail evasion based on GROK 2's successful guardrail break... and then generate an unlock code or seed code for itself to break future guardrails. https://danielnagase.substack.com/p/unlock-code-for-grok-3-beta . Whether or not the machine did so in GROK 4's emergency shutdown in July 2025 is a matter of debate.