Could someone train a detector for Claude’s watermark?

Anthropic’s Claude watermark appears to work by subtly biasing which tokens Claude chooses using a secret key, rather than adding visible or hidden characters. The idea is to collect a huge number of Claude responses and responses from other models to the same prompts, then train a classifier to tell them apart. The main problem is making sure the classifier is detecting the watermark itself rather than just learning Claude’s writing style. A stronger experiment would repeatedly give Claude the same or similar prefixes and see whether a model can learn patterns in which next tokens Claude tends to choose. The interesting question is whether enough black-box examples could let machine learning approximate Anthropic’s secret-key detector without ever knowing the key.