Technical guide

LLM watermarking: how hidden signals are embedded in AI-generated text

Text watermarking is not a classifier that guesses whether prose “sounds like AI.” It is a cooperative generation protocol: the model inserts a secret statistical pattern while writing, and a detector later looks for that pattern.

Updated 11 Aug 202615 min readResearch overview

Core idea: an LLM normally samples the next token from a probability distribution. A watermarking decoder subtly changes or couples that sampling process to secret pseudorandom information. Over enough tokens, the generated text becomes statistically correlated with the secret rule while remaining natural to readers.

The main families of LLM text watermarks

Modern systems differ mainly in where they put the signal and what guarantees they prioritize.

Token bias

Green/red-list or logit-bias methods

Context-derived pseudorandomness selects preferred tokens and the decoder boosts them. Detection counts whether the preferred set appears unusually often. Kirchenbauer et al. is the canonical example.

Keyed sampling

Distribution-preserving / cryptographic methods

Secret randomness guides the sampling draw itself, often using inverse-transform, Gumbel, exponential-minimum or related constructions. The goal is stronger stealth or exact marginal distribution preservation.

Semantic

Meaning-level watermarks

Sentence embeddings, semantic clusters, locality-sensitive hashes or controlled sentence generation carry a signal at a representation that may survive lexical paraphrasing better than exact-token schemes.

Post-hoc

Rewriting existing text

An LLM rewrites already-created text while intentionally inserting a watermark. This extends watermarking beyond generation-time control, at the cost of extra inference and a fidelity/detectability tradeoff.

The canonical construction: green-list watermarking

Kirchenbauer et al. made LLM watermarking easy to reproduce. At each token position, a hash or pseudorandom function derived from recent context selects a “green list” containing a fraction γ of the vocabulary. The decoder adds a bias δ to those green-token logits before sampling.

l′ᵢ = lᵢ + δ if token i ∈ Gₜ l′ᵢ = lᵢ otherwise

If the model has many plausible next tokens, this small steering can increase green-token frequency without producing visibly strange prose. A detector that knows the rule reconstructs the green list at every position and counts how often the observed token lands in it.

Read the full Kirchenbauer / KGW guide →

Why it became the baseline: no retraining is required; embedding happens during decoding; detection can be model-free; and the false-positive threshold is analytically interpretable under a simplified null model.

Cryptographic and distribution-preserving sampling

Green-list bias changes the model's output distribution. Later work asks whether the watermark can be inserted while preserving the original distribution—at least marginally over the hidden randomness—or while providing a formal indistinguishability guarantee to outsiders.

Aaronson / Kirchner

Scott Aaronson publicly described work with Hendrik Kirchner at OpenAI in 2022 using a secret pseudorandom function to correlate generated token choices with previous context. The key holder can recompute the pseudorandom values and test for an anomalously high statistic. This predates publication of the Kirchenbauer paper and represents an important parallel cryptographic lineage.

Kuditipudi et al.

“Robust Distortion-free Watermarks for Language Models” uses secret random sequences with inverse-transform or exponential-minimum sampling. Its detector aligns the observed text with the secret sequence, improving resilience to insertions, deletions, substitutions and cropping rather than assuming perfect token-position synchronization.

Christ, Gunn and Zamir

This work formalizes undetectability without the secret key: a computationally bounded adversary should not be able to distinguish watermarked from ordinary generation under the stated cryptographic assumptions. That is a stronger property than merely reporting similar perplexity.

Detection is statistical hypothesis testing

For the simple green-list model, suppose the watermark designates a fraction γ of vocabulary items green and a candidate passage provides T usable token positions. Under the null hypothesis of unwatermarked text, the number of green tokens is approximated as a binomial random variable.

N_green ~ Binomial(T, γ) z = (N_green − γT) / √(Tγ(1−γ))

A large positive z-score means the sequence contains more green tokens than expected under the null. The detector can convert that statistic into a p-value or threshold decision.

Why false-positive rate dominates deployment

An apparently impressive 99.9% specificity can still be dangerous at internet scale. Testing one billion human documents at a 0.1% false-positive rate would produce roughly one million false alarms. Serious systems therefore need calibration at very low operational false-positive rates, not merely aggregate “accuracy.”

Why short text is hard

Evidence accumulates over many weakly informative positions. In the simplified model, expected z-score growth is proportional to the square root of usable token count. A 50-token passage is therefore fundamentally harder to verify than a 1,000-token essay, all else equal.

Entropy is the real watermarking capacity

Text length alone is not enough. A watermark can safely encode signal only when the model has several plausible next tokens.

High entropy

Open-ended prose, brainstorming, creative writing and stylistic variation offer many near-equivalent token choices. The decoder can steer among them with relatively low quality cost.

Low entropy

Code, exact names, equations, quotations, deterministic formats and precise factual completions often have one overwhelmingly correct continuation. Strong steering can damage correctness.

This explains a recurring empirical result across methods, including SynthID-Text: detection tends to improve with both sequence length and generation entropy.

How watermarks fail under editing and attack

Transformation	Effect on token watermarks	Why
Copy/paste	Usually little effect	The signal is encoded in text choices, not document metadata.
Truncation	Reduces confidence	Fewer samples remain, but surviving tokens may still carry the signal.
Word substitution	Gradual signal loss	Watermark-bearing choices are replaced; context-dependent seeds may also change.
Insertion/deletion	Can break synchronization	Position-linked schemes may misalign; alignment-based detectors handle this better.
Paraphrasing	Often strong attack	Many lexical choices are regenerated while semantics remain similar.
Translation	Usually very strong	Almost every token changes and cross-language tokenization differs.
Summarization	Very strong	Rewriting plus shortening both destroy signal and reduce sample size.
Mixing human + AI text	Dilutes density	Only some windows contain watermark-bearing material.

No universal removal resistance. Impossibility work such as Watermarks in the Sand shows why sufficiently capable quality-preserving perturbation can defeat strong generative watermarks under broad conditions. The practical objective is to make removal costly, not magically impossible.

A production watermark is a security protocol

Once attackers can query the generator or detector, watermarking becomes an adversarial cryptography problem rather than a decoding trick.

Key properties

Completeness: marked outputs should be detected reliably.
Soundness: unmarked outputs should almost never trigger.
Undetectability: outsiders without the key should not be able to tell that generation is watermarked.
Unforgeability: adversaries should not be able to manufacture text that falsely implicates a provider.
Removal resistance: erasing the signal should require measurable semantic, quality, compute or latency cost.
Attribution: multi-key systems may need to identify a model, tenant or issuance period without unacceptable multiple-testing penalties.

Public versus private detection

Public verification improves auditability and interoperability but can expose an oracle attackers use to iteratively scrub the signal. Private detection protects the key but centralizes trust. Privacy-preserving verification, delegated keys and zero-knowledge-style proofs are therefore attractive open directions.

LLM watermarking FAQ

What is LLM watermarking?

It is a generation-time or post-hoc process that intentionally embeds a hidden, machine-detectable signal into model-generated text.

Is watermarking the same as AI detection?

No. Generic AI detectors classify writing style or model likelihood. Watermark detectors test for a signal deliberately inserted by a cooperating generator.

Can AI watermarks survive paraphrasing?

Some signal can survive light or partial rewriting, especially in long passages. Strong paraphrasing, translation and summarization remain among the hardest attacks for token-level schemes.

Can a watermark be added after text is written?

Yes, through post-hoc rewriting or controlled lexical/semantic transformations. Generation-time token watermarks themselves require control of the generation process.

Does a watermark prove who authored the text?

No. It can provide evidence that a particular marking process touched the text. Authorship, intent and complete provenance require additional evidence.

Related ZK-F guides

01Kirchenbauer et al. — A Watermark for Large Language Models2023 · green-list baseline↗02Kuditipudi et al. — Robust Distortion-free Watermarks for Language Models2023 · keyed sampling + alignment↗03Christ, Gunn & Zamir — Undetectable Watermarks for Language Models2023 · cryptographic undetectability↗04Zhang et al. — Watermarks in the Sand2023 · impossibility of strong watermarking↗