Watermarking › Summary

Watermarking embeds a hidden statistical signal into LLM outputs at inference time by modifying the decoding process. The main families of schemes are token-level logit-bias methods (the KGW scheme and its variants) and distortion-free schemes that preserve the output distribution while still enabling detection through the controlled use of sampling randomness.

The core mechanism of the KGW scheme is vocabulary partitioning. At each generation step, a hash of the previous token and a secret key splits the vocabulary into a green list and a red list. Green-list logits are boosted by $\delta$, biasing token selection toward green tokens without forcing them. Because the partition changes with each context token, the signal is unpredictable to anyone without the key.

Detection is a hypothesis test. The KGW detector counts the fraction of green tokens in the candidate text and computes a z-score. The null hypothesis holds that each token is independently green with probability $\gamma$. A high z-score, above the chosen threshold corresponding to the desired FPR, provides statistical evidence that the text was generated with the watermark active. Detection power increases with text length, growing proportionally to $\sqrt{T}$, and reliable detection typically requires 100-200 tokens at standard significance levels.

Robustness is the central challenge. Paraphrase attacks, word substitution, and translation can reduce TPR significantly by replacing green-list tokens with red-list alternatives. Context-dependent partitioning, extended hash windows, and robust test statistics improve resistance but do not eliminate it. The theoretical limit is that a sufficiently capable paraphraser can remove any token-level watermark while preserving meaning.

Evaluation covers three dimensions: detection reliability (TPR/FPR and AUC), text quality (perplexity, semantic similarity, human judgments), and robustness (TPR after attack). These dimensions trade off against each other, and the right operating point depends on the deployment context. Distortion-free schemes require different quality metrics because they do not change the output distribution, but they also provide weaker detection signals per token.

Watermarking works best when model weights are private, outputs are long, and the stakes of false attribution are moderate. It is less effective for open-weights models, short outputs, or settings where false positives carry severe consequences. The scheme cannot guarantee robustness against a capable paraphraser, and text length requirements make it inapplicable to the shortest forms of AI-generated content. Used within its appropriate scope, and combined with human review at the margins, watermarking provides a powerful accountability primitive that would otherwise be technically impossible.