Watermarking › Watermarking

When an LLM generates text, it leaves no fingerprint. The output looks like any other human-written paragraph. You cannot tell whether a news article, a homework essay, or a product review came from a language model just by reading it. This opacity creates a serious problem: if AI-generated text can circulate undetected, it becomes impossible to enforce academic integrity policies, identify AI-driven misinformation campaigns, audit model outputs for safety, or attribute text to its source.

Watermarking addresses this by embedding a hidden statistical signal into generated text at inference time. The signal is invisible to readers but detectable by anyone who knows the key. Unlike post-hoc classifiers that try to guess whether text was machine-written based on stylistic patterns, watermarking schemes work proactively. The LLM's decoding process is modified to produce text that carries a verifiable, cryptographically secured signature.

The core idea is elegant: if you can influence which tokens the model selects during generation, you can bias those choices in ways that are statistically detectable but imperceptible to human readers. A detector with the right key can compute a test statistic over a piece of text and determine, with high statistical confidence, whether the signal is present. The signal strength accumulates with text length, so longer passages become increasingly certain attributions while shorter ones remain ambiguous.

What makes this different from simply adding metadata to a file? Metadata is trivially stripped. A watermark, by contrast, is woven into the fabric of the text itself, residing in the specific word choices rather than in any attached wrapper. You cannot remove it without changing the words, and changing the words costs something: either effort, quality, or both.

This chapter covers the main families of watermarking schemes, the statistical machinery used for detection, the robustness challenges that attackers exploit, and the metrics used to evaluate watermark quality. Watermarking applies information theory and hypothesis testing to language model decoding. The upcoming chapter on Model Cards connects back to watermarking in the context of documenting model capabilities and responsible disclosure of watermarking policies.