That doesn't match my understanding of how the watermark works. Let's say we have your distribution of (0.985, 0.01, 0.005). The AI somehow has to sample that distribution, let's say the pre-watermark model picks as many uniform (i.i.d.) bits as it needs to do the sampling, then does a Smirnov transform or something to get the correct distribution.

The AI with watermark picks its bits from a CSPRNG, then does the same transform to get the distribution. The result I think is that you can reduce distinguishing the distribution to breaking the CSPRNG.

In this example the entropy after the transform is around 0.13 bits, so the watermarking scheme cannot add any useful information. Once you have hundreds or prehaps thousands of bits of entropy, it starts to become feasible to add information into that 'spare' space.