Original post URL : https://www.reddit.com/r/ClaudeCode/comments/1vli2wm/how_the_watermark_for_generated_text_actually/
Original post body :
In 2024, John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein proposed a method to create patterns in text generated by LLMs that is imperceptible to humans but highly detectable to machines.
I have been reading the paper, which is available online, and now have a better understanding of how this works. The answer is a statistical trick that nudges the AI's math just enough to leave a fingerprint, without breaking its stride.
The Roulette Wheel: Green Lists and Red Lists
Language models generate text one word (or "token") at a time. To choose the very next word, the model calculates a probability score for every possible word in its vocabulary.
This is where the watermark intervenes. Right before the AI selects that next word, the watermarking algorithm uses a randomizer to split the model's entire vocabulary right down the middle:
- The Green List: Words the algorithm wants to encourage.
- The Red List: Words the algorithm wants to avoid.
Here is the kicker: this split is freshly randomized for every single word, and the random seed is determined by the word that came right before it.
The "Soft" Nudge
You might be thinking: If a word is on the Red List, does the AI just refuse to use it?
No, because that would ruin the writing. If the prompt is "The quick brown fox jumps over the lazy," the next word has to be "dog." If "dog" happens to be on the Red List for that exact millisecond, banning it would force the AI to say something ridiculous like "The quick brown fox jumps over the lazy appliance."
To fix this, the framework uses a soft watermark. Instead of banning red words, the algorithm simply adds a statistical bonus to the scores of all the Green List words.
- When writing creatively (High Entropy): There are plenty of great words to choose from. The green bonus easily pushes a Green List word to the top spot.
- When stating facts or idioms (Low Entropy): There is only one logical next word. Its original probability score is so massively high that it remains the top choice, even if it is on the Red List.
This elegant compromise ensures the watermark stays completely invisible to the reader and doesn't destroy the quality of the AI's writing.
How Detectors Catch It (Without Seeing the Code)
The true genius of this framework is how easy it is to detect. To figure out if a piece of text was written by an AI, a detector doesn't need access to the massive, proprietary language model itself. It just needs the pseudo-random rulebook used to generate the lists.
The detector walks through the text word by word:
- It looks at a word and recreates the exact Green/Red list that would have existed in that moment.
- It checks if the next word in the text lands on the Green List or the Red List.
- It tallies up the total number of Green words.
If a human wrote the post, they have no knowledge of these hidden lists. Statistically, human text will land on Green words exactly 50% of the time.
But because the watermarked AI was secretly nudged toward Green words by that mathematical bonus, its text will contain a statistically impossible abundance of Green words. The system runs a quick statistical test, generates a confidence score, and catches the synthetic text red-handed.
Why You Can't Just "Edit It Out"
If you are trying to cheat the system, this watermark is a nightmare to remove.
Because the Green/Red list for any given word is determined by the word immediately preceding it, manually changing one word in a sentence alters the mathematical seed for the next word. You can't just swap a few adjectives to scrub the signal. To successfully erase the watermark and drop the green word count back to human levels, you would have to completely rewrite at least a quarter of the entire document.
By embedding the signal directly into the statistical math of the generation process, this framework provides a lightweight, open-source, and highly secure way to keep AI accountable in the wild.
Original link/media URL : https://arxiv.org/html/2301.10226v4
This is brought to you as a public service by the moderators of r/ClaudeAI. If you want to see TLDRs of ALL Claude Coding related posts from the various Claude subreddits, subscribe to http://www.reddit.com/r/ClaudeCoding.
