Text Watermarking: Token Bias and Limitations

The watermark applied to texts generated by models adjusts the probability of tokens to embed a verifiable statistical signature. Its detection can be reduced to a z-score test with a key. Despite this, operations like paraphrasing or translation can weaken or erase it, making it a circumscribed measurement tool for platforms rather than a universal detector.

Attacks Weaken or Destroy the Watermark

Text watermarking is a limited but useful measurement tool for platforms and does not constitute a universal AI detector. Its robustness against determined attackers has a theoretical ceiling. Several transformations can destroy or weaken the signal: paraphrasing, translation, source mixing, and tokenization manipulations. These attacks reduce the reliability of binary detection and limit the use of watermarking to controlled contexts.

Active Watermarking Biases Token Sampling

In systems that employ it, watermarking relies on biasing the sampling of tokens at each generation step to embed a statistical signature. The classic "green list" method partitions the vocabulary at each step via a hash of the previous token combined with a secret key, then adds a delta to the logits of favored tokens. Detection is then reduced to a z-score test comparable to a coin flip experiment, requiring only the key and the text. The trade-offs are governed by the delta and gamma parameters: a bias that is too strong harms both the quality of the text and its markability. Distortion-free variants exist that preserve the distribution while encoding a correlation signal. The precise scheme cannot be reliably deduced from the outputs alone due to cryptographic unpredictability.

Misconceptions About Invisible Characters and Classifiers

Common explanations cite invisible Unicode characters, zero-width spaces, imposed vocabulary, or style classifiers to identify AI. Some of these techniques exist, but for other purposes. None correspond to the mechanism employed by systems that actually watermark text, and a simple pass through an editor without enrichment would circumvent these superficial markings.