KGW / 2023 baseline

The Kirchenbauer watermark: green lists, logit bias and statistical detection

Kirchenbauer et al.'s 2023 paper became the canonical LLM watermark because the construction is simple enough to implement, easy to detect statistically, and explicit about the quality-versus-detectability tradeoff.

Updated 11 Aug 202611 min readPaper explainer

Core mechanism: use recent context to pseudorandomly select a “green” subset of the vocabulary, boost those token logits by a small amount, and later test whether a candidate text contains significantly more green tokens than the null expectation.

How the green-list watermark is generated

At token position t, the language model has a probability distribution over vocabulary V. The watermark algorithm derives pseudorandomness from the recent token context and uses it to choose a green set Gₜ containing a fraction γ of the vocabulary.

In the practical “soft” version, tokens in the green set receive an additive logit bonus δ:

l′ᵢ = lᵢ + δ if i ∈ Gₜ l′ᵢ = lᵢ if i ∉ Gₜ

The model then samples from the adjusted distribution. The decoder does not force a fixed vocabulary: the green set changes from position to position as the context changes.

Why readers do not see the pattern

If the model considers several candidate tokens plausible, a modest bias can alter which synonym or continuation is chosen without making the sentence obviously unusual. Over a long passage, however, the cumulative preference for green tokens becomes statistically detectable.

The watermark is not a list of special words. A token can be green in one context and red in another because the partition is derived pseudorandomly from the preceding context.

How the detector works

A detector with the same rule tokenizes the candidate text and reconstructs the green set at each testable position. It counts how many observed tokens are green.

Under a simplified null hypothesis of unwatermarked text, if the green-list fraction is γ and there are T testable positions:

N_green ~ Binomial(T, γ) z = (N_green − γT) / √(Tγ(1−γ))

If the observed green-token count is far above its null expectation, the z-score becomes large and the text is flagged at a chosen statistical threshold.

A concrete example

Suppose γ = 0.5 and a 400-position candidate contains 250 green tokens. Under the simplified null, 200 are expected. The standard deviation is √(400 × 0.5 × 0.5) = 10, producing z = 5. That is extremely unlikely under the idealized null model.

Real deployment is more complicated because tokens are not independent Bernoulli trials, repeated n-grams can create dependence, text can contain copied passages, and adversarial edits can change context. The follow-up reliability paper addresses several of these calibration issues.

The three parameters that control the tradeoff

γ — green-list fraction

Controls how much of the vocabulary is favored. A value around one-half is easy to illustrate, but the framework permits other fractions.

δ — logit bias

Controls watermark strength. Larger δ increases the green-token excess and generally improves detection, but also increases distributional distortion and possible quality cost.

T — usable length

Longer passages give the detector more samples. Confidence generally improves sublinearly with length rather than one-for-one.

h — context width

Controls how much previous context determines the next pseudorandom partition. Larger context can improve security but can amplify the downstream impact of edits.

Context hashing creates a security–robustness tradeoff

The simplest presentation seeds pseudorandomness from a preceding token. More secure variants can use a keyed pseudorandom function over several previous tokens.

Short context

Pros: local edits affect fewer future positions; easier detector resynchronization.
Cons: fewer unique states and potentially more repeated contexts for an attacker to study.

Long context

Pros: larger state space and harder local inference of the token preference rule.
Cons: one substitution can change several downstream green lists, amplifying edit damage.

This is one reason later schemes explore alignment-based detection, semantic keys, repeated-context masking and other synchronization mechanisms.

How robust is the Kirchenbauer watermark?

The original and follow-up work evaluates several classes of attack. The correct summary is not “paraphrasing instantly removes it” and not “the watermark survives rewriting.” Robustness depends on how much text remains, how aggressively it changes, and the detector threshold.

Attack	Typical effect	Reason
Light human editing	Often partial survival	Many original token choices remain.
Random token substitutions	Gradual degradation	Some watermark-bearing positions are destroyed.
Insertion/deletion	Can cause local cascades	Context-derived partitions shift downstream.
Paraphrasing	Strong dilution	The paraphraser regenerates many token choices.
Translation	Usually stronger	Nearly the whole token sequence is replaced.
Truncation	Less evidence	The remaining text can still be marked, but T decreases.

The follow-up reliability paper reports detection under substantial human and machine paraphrasing in tested settings, but more surviving text is needed as the signal is diluted.

What the basic KGW scheme does not automatically guarantee

The green-list construction is a statistical watermark, not by itself a full cryptographic provenance protocol. A deployment must separately reason about key secrecy, detector access and spoofing.

Distribution preservation: the basic soft scheme intentionally changes token probabilities.
Undetectability: strong outsiders may potentially detect distributional artifacts unless additional cryptographic properties are designed in.
Unforgeability: a detector that can be queried may become an oracle for constructing text that triggers it.
Key recovery: repeated access to a globally keyed generator can leak information about preferences if the context rule is learnable.
Public verification: publishing enough information for anyone to test a watermark can also make scrubbing easier.

Later papers attack these gaps with distribution-preserving sampling, formal undetectability, robust signatures, multiple keys and other cryptographic machinery.

Is Claude's 2026 watermark based on Kirchenbauer?

Anthropic has confirmed an imperceptible model-level text watermark that survives copy/paste, may persist through some editing, becomes unreliable on very short passages, and can be weakened by heavy editing, paraphrasing, translation or mixing.

Those properties are strongly compatible with KGW-style statistical token watermarking. But they are also compatible with other generation-time schemes. Anthropic has not disclosed green lists, γ, δ, context hashing, z-score detection or any equivalent implementation detail.

Evidence level: “Claude uses a statistical generation-time watermark” is a strong inference from Anthropic's public description. “Claude uses the Kirchenbauer algorithm” remains speculation as of 11 August 2026.

Read the complete Claude watermark evidence analysis →

Kirchenbauer watermark FAQ

What is the Kirchenbauer or KGW watermark?

A decoding-time LLM watermark that pseudorandomly labels part of the vocabulary green at each step and biases generation toward those tokens.

Why is it called a green-list watermark?

The preferred subset is conventionally called the green list; the complementary vocabulary is often called the red list.

How is it detected?

The detector reconstructs the context-dependent green lists and tests whether the observed text contains an unexpectedly high fraction of green tokens, commonly using a z-score.

Does it require model retraining?

No. The canonical construction can be applied at decoding time by modifying token logits or restricting sampling.

Does Claude use KGW?

Unknown. Anthropic has not published enough algorithmic detail to establish that connection.

Related ZK-F guides

01Kirchenbauer et al. — A Watermark for Large Language ModelsOriginal paper, submitted January 2023↗02Kirchenbauer et al. — On the Reliability of Watermarks for Large Language ModelsRobustness, attacks and statistical reliability↗