Text watermarking

What it is

Text watermarking is the practice of embedding a signal into the output of a language model. The signal is invisible to human readers — the text still reads like ordinary prose — but it can be detected algorithmically from a short span of tokens^[1]. The aim is not to conceal anything from the reader in a cryptographic sense; it is to give the text a statistical fingerprint that a detector can confirm.

How it works

The scheme proposed by Kirchenbauer and co-authors acts at generation time. Before a word is produced, a randomised set of "green" tokens is selected, and the sampling procedure then softly promotes the use of green tokens — nudging the model toward them without forcing its hand^[1]. Because the promotion is soft, the model can still pick a non-green word when that is clearly the better continuation, so the sentence stays fluent.

A small illustration: suppose the model is writing a sentence and the current green set happens to contain several plausible next words. The sampler raises their probability a little, so the sentence that comes out contains somewhat more green words than chance alone would produce. A single green word proves nothing. But across a passage of a few dozen tokens the excess accumulates, and the pattern becomes statistically visible.

Detection uses an efficient open-source algorithm that does not require access to the language model's API or its parameters^[1]. A detector therefore does not have to be the model's owner and does not need to query the service. The authors propose a statistical test that yields an interpretable p-value, and they derive an information-theoretic framework for analysing the sensitivity of the scheme — how much text is needed and how firm the verdict can be^[1]. A p-value here is best read as an answer to one question: if the text were not marked, how unlikely would this many green tokens be?

Where it came from

The framework was proposed by Kirchenbauer et al. in January 2023, aimed at proprietary language models^[1]. The motivation is direct: a provider serving a model behind an API has no easy way to show that a given piece of text came from its system. A watermark gives such a provider a way to mark outputs and check them later.

The authors tested the method on a multi-billion parameter model from the Open Pretrained Transformer family and reported that the watermark could be embedded with negligible impact on text quality^[1]. That trade-off is the central practical question for any such scheme: a mark heavy enough to damage the writing is unusable, and a mark too faint to detect is pointless.

Limits

The paper also discusses robustness and security, noting that a watermark which can be removed by paraphrasing or editing offers weaker provenance guarantees^[1]. The reason is structural. The mark lives in the choice of individual tokens, so any process that rewrites those choices — a paraphrase, a heavy edit, a round trip through another model — tends to wash out the bias the detector looks for.

A second, more general limit is statistical. A test returns a confidence level, not a proof: shorter passages give shakier verdicts, and the conclusion is only as good as the assumptions behind the test. Detection also does not require the model itself, but it does require following the same marking rules, since the green sets have to be reproducible for the count to mean anything^[1].

Why it matters

For anyone trying to establish where a piece of text came from, a watermark turns an unanswerable question into a measurable one. It is not a proof of authorship and not absolute traceability; it is a statistical signal with a stated confidence, together with a known weakness to rewriting.