Watermarking and Content Provenance

Post-hoc AI-text detectors do not work well enough to act on. They produce false positives on non-native English writing, they degrade whenever a new model ships, and the base rate problem is brutal: at a 1 percent false-positive rate against a corpus that is 99 percent human-written, most flagged documents are innocent.

Watermarking takes the opposite approach. Instead of detecting AI text after the fact, embed a signal at generation time that the generator can later verify with a statistical test. This changes the problem from inference to detection of a known code, which is a far better-posed problem.

The red-green list scheme

The first practical construction hashes the previous token to seed a pseudorandom generator, which partitions the vocabulary into a "green" list of size \(\gamma |V|\) and a red list, then adds a constant \(\delta\) to the logits of green tokens before sampling (Kirchenbauer et al., ICML 2023, arXiv:2301.10226).

Nothing about the output announces itself. But a verifier holding the same hash key can recompute which tokens were green and count them. Under the null hypothesis of unwatermarked text, the count of green tokens in a sequence of \(T\) tokens is approximately binomial with mean \(\gamma T\), so the standardised statistic

is roughly standard normal. Watermarked text pushes \(z\) high. Detection strength grows with \(\sqrt{T}\), which is why watermarks are reliable on essays and useless on tweets.

The parameter \(\delta\) is the whole trade. Large \(\delta\) makes detection easy and distorts the text. Small \(\delta\) preserves quality and needs more tokens to detect.

Tournament sampling and production deployment

SynthID-Text replaced the logit bias with a sampling-time tournament. Each of several layers assigns a pseudorandom \(g\)-value to candidate tokens and keeps the winners, so the watermark is carried by which sample is chosen rather than by a distorted distribution (Dathathri et al., Nature 634, 818–823, 2024).

Two properties made this deployable. It offers a configurable non-distortion guarantee, meaning the marginal distribution over text is preserved in expectation. And it was validated at scale: a live experiment across roughly 20 million Gemini responses found no detectable quality degradation in user feedback. That is the first watermarking result with an industrial-scale human-preference check behind it, and it is the reason the scheme is worth studying over the many that only report perplexity.

Entropy is the binding constraint

Every generative watermark has the same ceiling. The signal is carried by the generator's freedom to choose among plausible next tokens. Where there is no freedom, there is no signal.

Low-entropy output cannot be watermarked: a factual list, a quoted passage, a short SQL statement, a function that has one idiomatic implementation. Code is the worst case in practice, and it is also the case people most want to attribute.

When it breaks

Paraphrasing removes it. Round-tripping through a different model destroys the token-level signal. There is no scheme robust to a rewriting attacker with access to a second model, and there probably cannot be one at the token level.

Open weights defeat it. Watermarking is applied by the decoder. Anyone running the weights themselves simply does not apply it, which means watermarking constrains hosted APIs and nothing else.

Detection is a hypothesis test, not a verdict. The output is a \(z\)-score and a \(p\)-value over a threshold you chose. Consequential decisions require picking a false-positive rate you can defend, and at essay length the honest one is conservative.

Provenance and watermarking solve different halves. C2PA-style signed manifests attach cryptographically verifiable origin metadata to an asset, which is stronger evidence when present and trivially stripped when not. Watermarking survives stripping and is weaker evidence. Serious deployments run both, and neither answers "was this written by a human", only "did this come from that generator".