Step-by-Step Teaching
Step 1: The Foundation — How LLMs Generate Text
Before understanding watermarking, you need to understand how AI text generation works.
When Claude writes text, it generates one word at a time. At each step, it considers multiple candidate words and selects the most appropriate one.
Example:
"The weather today was cold and ___"
| Word | Likelihood |
|---|---|
| "overcast" | ✅ High |
| "grey" | ✅ High |
| "sugary" | ❌ Very Low |
Key insight: When two words are roughly equally good, the final choice is settled by a random number. This randomness is the foundation watermarking exploits.
Step 2: The Core Concept — What Watermarking Actually Does
Watermarking does not add anything to the text. Instead, it replaces the source of randomness.
Without watermarking:
Random number generator → picks "overcast"
With watermarking:
Secret key + preceding words → deterministically picks "overcast" or "grey"
The chosen word still appears random to any reader. However, someone with the secret key can later check whether the sequence of word choices is consistent with what the key would have produced.
Think of it this way:
| Property | Without Watermark | With Watermark |
|---|---|---|
| Source of randomness | Arbitrary random number | Secret key + context |
| Output quality | Normal | Identical |
| Detectable by reader | N/A | No |
| Detectable with key | N/A | Yes |
Step 3: The Analogy — Making It Concrete
Imagine playing Monopoly, but instead of rolling dice, players use digits of pi starting from a random position.
- Players still move random numbers of spaces
- The game plays out identically
- But: Anyone who knows you used pi and your starting position can verify afterward that the moves match pi's sequence
This is exactly how watermarked text works:
- Words still appear random ✅
- Reading experience is unchanged ✅
- Pattern is verifiable with the key ✅
Step 4: What Watermarking Can and Cannot Do
This is critical — watermarking has specific, bounded capabilities.
✅ What It CAN Do
- Estimate the probability that Claude was involved in writing text
- Work across longer passages (more word choices = more confidence)
- Apply to translations (every word is chosen by Claude)
❌ What It CANNOT Do
- Confirm text is human-written
- Identify which other AI wrote something (different keys, different methods)
- Work reliably on short samples
- Apply where there is only one correct word (e.g., "2 + 2 = ___")
- Distinguish "Claude wrote this" from "Claude heavily edited this"
- Trace text back to a specific user or organization
Step 5: Where Watermarking Is Sparse or Absent
Not all text gets equal watermarking. Understand why:
Factual Passages
"Isaac Newton's most famous work was called Principia ___"
Only "Mathematica" is correct. No choice exists → no watermark applied
Code
Most code must be exact to function. Very few arbitrary choices exist.
- Exception: Comments within code can carry watermarks
- Result: Code has significantly less watermarking than prose
Proofreading/Light Editing
If Claude only fixes grammar in your document, nearly all words remain yours. Too few Claude-chosen words exist for a detectable pattern.
Rule of thumb: The more Claude writes from scratch, the stronger the watermark.
Step 6: Practical Implications for Users
| Question | Answer |
|---|---|
| Does it slow Claude down? | No |
| Does it cost more? | No (no extra tokens) |
| Can it identify me? | No |
| Can editing remove it? | Light edits: partially. Complete rewrite: yes |
| Does it affect image files? | Images use a different system (C2PA metadata) |
Images vs. Text — An Important Distinction
- Text: Watermark is embedded invisibly in word choice patterns
- Images: A cryptographically signed note is attached to file metadata (C2PA standard) — nothing in the image itself changes
Step 7: Why This Is Happening — Regulatory Context
Watermarking is being implemented to comply with the EU AI Act, which requires AI providers to mark AI-generated content.
Key facts:
- Effective requirement: August 2, 2026
- Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content
- ~190 total signatories, including other major AI providers
- Applied globally at launch (no regional scoping yet)
- Each AI company uses its own key — watermarks are not interchangeable
Step 8: How Watermarking Differs from AI Detection Software
Students often confuse these two approaches:
| Watermark Detection | AI Detection Software (e.g., Pangram) | |
|---|---|---|
| Uses secret key | ✅ Yes | ❌ No |
| Method | Checks word-choice patterns against key | Analyzes stylistic "tells" |
| Accuracy basis | Cryptographic | Statistical/linguistic |
| Example signal | Consistent key-based word selections | Overuse of "quietly," "this isn't X, it's Y" |
| Reliability | Higher (mathematical) | Lower (pattern-based) |
Summary: The Big Picture
LLM generates text
↓
Multiple words are equally valid
↓
[Without watermark] → Random number picks word
[With watermark] → Secret key + context picks word
↓
Output looks identical to readers
↓
With the key → Pattern is detectable
Without key → Indistinguishable from unwatermarked text
Core takeaway: Watermarking is a clever repurposing of unavoidable randomness in AI text generation — it changes where randomness comes from without changing what the output looks or reads like.