Text Watermarking and the Detectability Tradeoff

Because text has far less redundancy than an image: every token is semantically load-bearing, so there is nowhere to hide a signal in imperceptible modifications. The only spare capacity is the choice among acceptable next tokens, which is why watermarking biases the sampler rather than perturbing the output.

At each step, hash the preceding token(s) with a secret key to seed a generator, use it to split the vocabulary into a green list of fraction \(\gamma\) and a red list, and add bias \(\delta\) to green logits before sampling. The output then contains more green tokens than chance, detectably, while remaining fluent.

Because under the null hypothesis of unwatermarked text the green-token count is binomial with probability \(\gamma\), so \(z = (|s|_G - \gamma T)/\sqrt{T\gamma(1-\gamma)}\) gives a calibrated \(p\)-value with a controllable false positive rate. A classifier returns an opaque score; this returns a number whose error rate is derived rather than measured.

Because detection power grows with \(\sqrt{T}\), so the signal in a tweet-length output is too weak to separate from chance without a bias large enough to visibly degrade quality. This is an entropy limit rather than an implementation weakness: short text simply does not carry enough token choices to encode a reliable signal.

Because low-entropy text, a factual answer, a code completion with one correct continuation, a quotation, leaves the sampler no freedom to encode anything. The watermark needs alternatives among which to choose, and the more constrained the model is by correctness, the less signal it can carry.

Paraphrase. Rewriting the text resamples the token choices and destroys the green-list statistics, and it costs the attacker one cheap model call. Semantic watermarking schemes are more robust to it and correspondingly harder to make statistically precise.

Because a negative result is consistent with human writing, a different model, an unwatermarked configuration, or successful removal, and the test cannot distinguish them. Using it as evidence that text is human-written inverts what it measures, and that misuse has already caused harm in education.

Because across a million documents that is a hundred wrong accusations. The threshold must be set against the deployment volume and the cost of being wrong, and research-evaluation defaults are chosen to balance a benchmark rather than to bound harm at scale.

Because text has far less redundancy than an image: every token is semantically load-bearing, so there is nowhere to hide a signal in imperceptible modifications. The only spare capacity is the choice among acceptable next tokens, which is why watermarking biases the sampler rather than perturbing the output.

At each step, hash the preceding token(s) with a secret key to seed a generator, use it to split the vocabulary into a green list of fraction \(\gamma\) and a red list, and add bias \(\delta\) to green logits before sampling. The output then contains more green tokens than chance, detectably, while remaining fluent.

Because under the null hypothesis of unwatermarked text the green-token count is binomial with probability \(\gamma\), so \(z = (|s|_G - \gamma T)/\sqrt{T\gamma(1-\gamma)}\) gives a calibrated \(p\)-value with a controllable false positive rate. A classifier returns an opaque score; this returns a number whose error rate is derived rather than measured.

Because detection power grows with \(\sqrt{T}\), so the signal in a tweet-length output is too weak to separate from chance without a bias large enough to visibly degrade quality. This is an entropy limit rather than an implementation weakness: short text simply does not carry enough token choices to encode a reliable signal.

Because low-entropy text, a factual answer, a code completion with one correct continuation, a quotation, leaves the sampler no freedom to encode anything. The watermark needs alternatives among which to choose, and the more constrained the model is by correctness, the less signal it can carry.

Paraphrase. Rewriting the text resamples the token choices and destroys the green-list statistics, and it costs the attacker one cheap model call. Semantic watermarking schemes are more robust to it and correspondingly harder to make statistically precise.

Because a negative result is consistent with human writing, a different model, an unwatermarked configuration, or successful removal, and the test cannot distinguish them. Using it as evidence that text is human-written inverts what it measures, and that misuse has already caused harm in education.

Because across a million documents that is a hundred wrong accusations. The threshold must be set against the deployment volume and the cost of being wrong, and research-evaluation defaults are chosen to balance a benchmark rather than to bound harm at scale.