AI Watermarking — AI Glossary

Reference details

Related terms

• AI Alignment

How it works

1. Before each token is sampled, the previous token's hash seeds a pseudorandom generator that partitions the whole vocabulary into a greenlist and a redlist, typically half each.
2. A small positive bias is added to every greenlist logit, so greenlist tokens win sampling more often than chance without any single choice being forced.
3. Generation proceeds normally, and because the partition is reseeded at every position the greenlist membership of a given word changes from one position to the next.
4. Detection replays the same hash over the text under test, recovers the partition at each position, and counts how many of the observed tokens fell in their position's greenlist.
5. The count is converted to a z-score against the null hypothesis that the text is human-written, where greenlist membership should occur at exactly the partition fraction.
6. The decision is a statistical threshold on that z-score, which is why detection is a confidence statement about a span of text rather than a yes-or-no property of a sentence.

Example: Why watermark detection has a minimum length

Take a half-and-half partition, so human text should land 50% of its tokens in the greenlist. The detector computes z = (green - 0.5T) / sqrt(0.25T) for a span of T tokens. A 200-token watermarked passage in which 150 of the 200 tokens are greenlist gives a numerator of 150 - 100 = 50 and a denominator of sqrt(50) ≈ 7.07, so z ≈ 7.07 — a result that would essentially never arise from unwatermarked text. Now truncate the same passage to 24 tokens and keep the same 75% greenlist rate, which is 18 tokens: the numerator is 18 - 12 = 6 and the denominator is sqrt(6) ≈ 2.45, so z ≈ 2.45. The per-token signal strength did not change at all, yet the confidence collapsed, because z grows with the square root of length: sqrt(200/24) ≈ 2.89, and 7.07 / 2.45 ≈ 2.89 to match. Against a common one-sided threshold of 4.0, the 200-token span is detected and the 24-token span is not. Paraphrase attacks exploit the same arithmetic from the other side. A paraphrase that preserves 70% of the original tokens and re-randomises the rest yields a greenlist rate of 0.7 x 0.75 + 0.3 x 0.5 = 0.675, so a 200-token span now has 135 greenlist tokens, a numerator of 35 and z = 35 / 7.07 ≈ 4.95. That is still above 4.0, but the margin fell by exactly the 30% of tokens the paraphrase replaced.

Commonly confused with

Watermarking is not the same as AI-text classification, and the difference is who controls the signal. A classifier such as a perplexity-based detector inspects text it had no part in producing and infers origin from statistical fingerprints, which is why its false-positive rate on non-native English writing has been bad enough for several products to be withdrawn. A watermark is deliberately embedded by the generating system and verified with the key that embedded it, so its false-positive rate is a calculable property of the statistical test rather than an empirical hope. The cost of that rigour is coverage: watermarking tells you nothing about text from any model that did not watermark it, so it establishes provenance for participating generators and is silent about everything else. It is also not a content credential such as C2PA, which signs a file's metadata and breaks when the file is re-encoded; a watermark lives in the token choices themselves and survives copy-paste.

When to use it

Reach for it when:

• When a platform generates content at scale and needs to attribute its own output later, which is the case the key-holder model fits exactly.
• For provenance in regulated publishing or academic settings, where a calculable false-positive rate matters more than broad coverage.
• On long-form generations, where the square-root growth of the detection statistic gives a comfortable margin above threshold.
• As a layer alongside provenance metadata, since the two fail in different ways — metadata to re-encoding, watermarks to paraphrase.

Reach for something else when:

• To police text of unknown origin, since a negative result means only that this watermark is absent, not that the text is human.
• On short spans such as a tweet or a code comment, where the statistic cannot reach a usable confidence at any per-token signal strength.
• Where outputs are routinely paraphrased or machine-translated downstream, both of which attack the token-level signal directly.
• As a plagiarism or academic-integrity verdict about a person, which is a decision a confidence threshold should inform rather than make.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to AI Watermarking — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path