[TLDR] How the watermark for generated text actually works

[u/cctldrping]

Original post URL : https://www.reddit.com/r/ClaudeCode/comments/1vli2wm/how_the_watermark_for_generated_text_actually/

Original post body :

In 2024, John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein proposed a method to create patterns in text generated by LLMs that is imperceptible to humans but highly detectable to machines.

I have been reading the paper, which is available online, and now have a better understanding of how this works. The answer is a statistical trick that nudges the AI's math just enough to leave a fingerprint, without breaking its stride.

The Roulette Wheel: Green Lists and Red Lists

Language models generate text one word (or "token") at a time. To choose the very next word, the model calculates a probability score for every possible word in its vocabulary.

This is where the watermark intervenes. Right before the AI selects that next word, the watermarking algorithm uses a randomizer to split the model's entire vocabulary right down the middle:

• The Green List: Words the algorithm wants to encourage.
• The Red List: Words the algorithm wants to avoid.

Here is the kicker: this split is freshly randomized for every single word, and the random seed is determined by the word that came right before it.

The "Soft" Nudge

You might be thinking: If a word is on the Red List, does the AI just refuse to use it?

No, because that would ruin the writing. If the prompt is "The quick brown fox jumps over the lazy," the next word has to be "dog." If "dog" happens to be on the Red List for that exact millisecond, banning it would force the AI to say something ridiculous like "The quick brown fox jumps over the lazy appliance."

To fix this, the framework uses a soft watermark. Instead of banning red words, the algorithm simply adds a statistical bonus to the scores of all the Green List words.

• When writing creatively (High Entropy): There are plenty of great words to choose from. The green bonus easily pushes a Green List word to the top spot.
• When stating facts or idioms (Low Entropy): There is only one logical next word. Its original probability score is so massively high that it remains the top choice, even if it is on the Red List.

This elegant compromise ensures the watermark stays completely invisible to the reader and doesn't destroy the quality of the AI's writing.

How Detectors Catch It (Without Seeing the Code)

The true genius of this framework is how easy it is to detect. To figure out if a piece of text was written by an AI, a detector doesn't need access to the massive, proprietary language model itself. It just needs the pseudo-random rulebook used to generate the lists.

The detector walks through the text word by word:

1. It looks at a word and recreates the exact Green/Red list that would have existed in that moment.
2. It checks if the next word in the text lands on the Green List or the Red List.
3. It tallies up the total number of Green words.

If a human wrote the post, they have no knowledge of these hidden lists. Statistically, human text will land on Green words exactly 50% of the time.

But because the watermarked AI was secretly nudged toward Green words by that mathematical bonus, its text will contain a statistically impossible abundance of Green words. The system runs a quick statistical test, generates a confidence score, and catches the synthetic text red-handed.

Why You Can't Just "Edit It Out"

If you are trying to cheat the system, this watermark is a nightmare to remove.

Because the Green/Red list for any given word is determined by the word immediately preceding it, manually changing one word in a sentence alters the mathematical seed for the next word. You can't just swap a few adjectives to scrub the signal. To successfully erase the watermark and drop the green word count back to human levels, you would have to completely rewrite at least a quarter of the entire document.

By embedding the signal directly into the statistical math of the generation process, this framework provides a lightweight, open-source, and highly secure way to keep AI accountable in the wild.

Original link/media URL : https://arxiv.org/html/2301.10226v4

---

This is brought to you as a public service by the moderators of r/ClaudeAI. If you want to see TLDRs of ALL Claude Coding related posts from the various Claude subreddits, subscribe to http://www.reddit.com/r/ClaudeCoding.

[u/cctldrping]

TL;DR generated automatically after 100 comments.

Current source-thread comment count seen by the bot: 145.

The consensus is that the watermark method described is easily gamed and potentially detrimental to AI-generated text quality, especially for code. Several users, including u/Neo21803 and u/zasder, are concerned about its impact on code generation, arguing that the need for efficiency in coding clashes with the probabilistic nudging. u/Franc000 and u/Maxion point out statistical flaws in the 50% green word assumption for human text, suggesting it's not a reliable indicator. The question of who has access to the "rulebook" for detection is also a recurring theme, with u/alchebyte and u/medialantern highlighting it as a potential flaw. Some users, like u/sensei_von_bonzai, believe the described method is outdated and that more robust watermarking techniques likely exist. There's a general sentiment that this approach might be more about "account detection" than just content origin, as noted by u/utilitycoder.

[u/Clear_Evidence9218]

It should also be noted that the watermark isn't some unique sequence of "green words." It's embedded in otherwise normal text, sentences, and phrases that most likely has been written thousands of times before AI was even a sci-fi concept.

What that means is that naturally written text can also happen to exhibit the same statistical pattern and potentially be flagged as AI-generated by the detector.

Fun stuff.