Unlike image or audio watermarking, text offers no continuous signal to perturb — no pixel channel, no sub-audible frequency band. A generated string is a discrete sequence of tokens, and any two outputs that "look different" are different by definition.
The watermarking problem for LLMs is therefore a narrow one: embed a signal detectable by a party holding a secret key, without materially changing token-level quality, and without altering the surface text in a way a human reader would notice.
The approach that has become the de facto reference implementation across the industry exploits a structural property of autoregressive generation. At almost every decoding step, several candidate tokens are close enough in likelihood that biasing the choice among them costs little in perceived quality, while accumulating a statistically detectable pattern over a long enough sequence.
The Green/Red-List Watermarking Algorithm
Introduced by Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein in A Watermark for Large Language Models (ICML 2023), this scheme runs entirely at the sampling step. It requires no model retraining, and needs only the token sequence — not model access — to detect.
Generation-time embedding
1. Partition the vocabulary. At each decoding step *t*, a keyed hash function h(s₍ₜ₋₁₎, key) — seeded by the preceding token(s) and a secret key — pseudorandomly splits the full vocabulary V into a green list G (a fraction γ, typically 0.5) and a red list R (the remaining 1−γ). The partition changes at every step because it depends on the rolling context.
2. Bias the logits. Before the softmax, add a constant δ to the logits of every token in G:
l'ᵢ = lᵢ + δ for i ∈ G
l'ᵢ = lᵢ for i ∈ RSampling then proceeds as normal over the biased distribution. Larger δ produces a stronger, more detectable signal at greater cost to output naturalness. The original paper reports negligible perplexity degradation at moderate δ (roughly 2–4) on multi-billion-parameter models.
3. Repeat per token. Because the hash reseeds on each new context, this is not a fixed word-substitution list — the same word can be green in one sentence and red in the next, depending on what precedes it.
A "hard" variant restricts sampling to G entirely when the top candidate falls in G. The "soft" variant above — logit bias only — is preferred in practice because it degrades quality less on low-entropy continuations, such as a token that is contextually almost forced (completing "New " → "York").
Why low-entropy text is the hard case
The bias only has room to operate when the model is genuinely uncertain between multiple tokens. Highly deterministic continuations — proper nouns, code syntax, fixed idioms, numerical output — leave the green/red split almost no leverage, since nudging toward G would require sampling an objectively worse token.
This is the single biggest source of watermark strength variance across text types, and it is why code and dense factual writing watermark far less reliably than free-form prose.
Statistical Detection
Detection does not require access to the model, only the token sequence and the key used at generation time (or, for public detectors, a documented key-derivation scheme).
z = (|s|_G − γT) / √(Tγ(1−γ))| Symbol | Meaning |
|---|---|
| ∣s∣_G | Observed number of green-list tokens in the candidate text |
| T | Total number of scoreable tokens (excludes the first token and any position where G/R can't be recomputed) |
| γ | Green-list fraction used at generation time (commonly 0.5) |
Under the null hypothesis — ordinary, unwatermarked text — each token lands in G at the base rate γ, independent of the others under a simplifying approximation. The z-score above is a one-proportion z-test against that null. Kirchenbauer et al. treat z ≥ 4 (p ≈ 3×10⁻⁵ under the normal approximation) as strong evidence of watermarking.
Detection therefore returns a confidence level, not a boolean — and that confidence is a direct function of T. Short passages simply do not accumulate enough tokens for the standard error term to shrink far enough to clear typical significance thresholds. This is precisely why the EU AI Act's own text exempts very short outputs from the marking requirement as "not technically feasible."
Provider Implementations Compared
| Provider | Mechanism | Detector access | Public disclosure |
|---|---|---|---|
| Google (SynthID) | A tournament/Gumbel-sampling variant: a pseudorandom function keyed by the context window scores candidate tokens, and a tournament procedure biases selection toward higher-scoring candidates. Preserves the output distribution more closely than a hard green/red cut, at the cost of a somewhat weaker per-token signal that is compensated for with more watermarked layers. | Private, semi-private, and public detector modes, offering different tradeoffs between confidentiality and third-party verifiability | Published in *Nature* (2024) with accompanying open documentation and code |
| OpenAI | Built and internally tested a logit-bias watermarker broadly consistent with the Kirchenbauer-style approach | Not broadly deployed for text as of this writing; OpenAI has instead invested in C2PA cryptographic content credentials for image (DALL·E 3) and video (Sora) outputs | Tradeoffs disclosed publicly — notably equity and false-positive concerns for non-native English writers; algorithmic internals not released |
| Anthropic (Claude) | Not publicly specified. Independent observation is consistent with a keyed green/red-list logit-bias scheme, but Anthropic has not confirmed implementation details | Not independently documented at time of writing | Least public technical detail of the three; rolled out fastest and broadest (API, Claude.ai, Claude Code, Cowork) in August 2026 |
Robustness Limits and Known Attacks
Signal degradation
- Short text. Below roughly 200 tokens, the standard error term in the z-score formula is too large relative to any plausible bias to reach conventional significance. This is a mathematical floor, not an implementation gap.
- Paraphrase and translation. Rewriting a passage regenerates token choices under a different (or no) bias, eroding the green-token count toward the chance rate γ. Round-trip translation is especially destructive since it forces a full re-tokenization in a different language's vocabulary.
- Low-entropy / structured text. Code and highly deterministic prose offer little room to bias tokens without visibly degrading correctness, weakening the achievable signal strength.
Watermark Stealing
Jovanović, Staab and Vechev, *Watermark Stealing in Large Language Models* (ETH Zurich SRI Lab, ICML 2024), demonstrated that an attacker who repeatedly queries a watermarked model's API can statistically approximate its green/red key well enough to mount two distinct attacks:
- Scrubbing — paraphrasing AI text using the recovered key to selectively avoid green tokens, stripping a genuine watermark.
- Spoofing — generating text, including human-authored-looking text, that is deliberately biased toward the recovered green list, forging a watermark that was never legitimately applied.
Reported success rates exceeded 80% across multiple watermarking schemes, at a total querying cost under $50.
This result matters because it shows the failure mode is not merely "sometimes doesn't detect" but "can be actively weaponized in either direction" — against a company's own content, or against a third party by planting a false positive.
Regulatory Context: EU AI Act, Article 50
The EU AI Act entered into force in August 2024, with obligations phasing in over roughly two years: prohibitions on unacceptable-risk practices from February 2025, obligations for general-purpose AI model providers from August 2025, and Article 50's transparency requirements — including machine-readable marking of synthetic content — binding from August 2, 2026.
Article 50(2) requires that AI-generated audio, image, video, and text be marked "in a machine-readable format and detectable as artificially generated or manipulated," but qualifies this with "as far as this is technically feasible," and exempts content that has undergone only basic editing or does not substantially alter input data.
That caveat is a direct acknowledgment of the limitations described above — the regulation does not assume, and does not require, an unbreakable scheme.
Open Problems
- Semantic watermarking. Current schemes bias token surface forms; research on watermarking at the level of meaning (robust to paraphrase) remains early-stage.
- Cross-lingual robustness. No production scheme currently survives translation reliably.
- Key management against querying attacks. Watermark Stealing suggests that any scheme exposed via a queryable API needs rate-limiting or key-rotation strategies as a first-class design constraint, not an afterthought.
- Independent auditability. Anthropic and OpenAI's limited public disclosure makes third-party robustness evaluation difficult; Google's more open approach with SynthID is the closest current model for how this could work industry-wide.
What This Means in Practice
If you are building on top of these models, three things follow directly from the mechanism.
Treat detection output as provenance evidence, not proof. A z-score is a confidence level that can be degraded by ordinary editing and forged by a motivated attacker. Any policy that triggers a consequence — an academic penalty, a content takedown, a contract dispute — on a detector's output alone is resting on a statistical test that was never designed to carry that weight.
Expect the signal to be weakest exactly where teams most want it. Code, structured data, short marketing copy, and product descriptions are all low-entropy or short-form, which is where the mathematics gives the least. The passages that watermark most reliably are long-form free prose.
Plan for marking obligations rather than detection guarantees. Article 50 asks providers to mark machine-readable output as far as technically feasible. It does not ask anyone to prove that a given piece of text is or is not AI-generated — and the distance between those two requirements is where most of the practical confusion currently sits.
References
- Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T. (2023). *A Watermark for Large Language Models.* ICML 2023. proceedings.mlr.press/v202/kirchenbauer23a.html
- Google DeepMind. *SynthID Text — Responsible Generative AI Toolkit.* ai.google.dev/responsible/docs/safeguards/synthid
- Jovanović, N., Staab, R., & Vechev, M. (2024). *Watermark Stealing in Large Language Models.* ICML 2024 (ETH Zurich SRI Lab).
- European Union. *Artificial Intelligence Act, Article 50 — Transparency Obligations.* artificialintelligenceact.eu/article/50
- OpenAI. *Understanding the Source of What We See and Hear Online.* openai.com/index/understanding-the-source-of-what-we-see-and-hear-online
