The signature is in the choices, not the characters

How text watermarking went from a 2022 research idea to production infrastructure — and why the thing that makes it work is that it adds nothing at all.

Two posts appear in a cat forum, both titled “10 tips for your new kitten”. One was written by a person, one by a language model. No reader can tell them apart, and neither can a classifier that guesses from style — those are unreliable enough that their false accusations do real harm to real writers.

There is a way to tell, but it has to be built in when the text is generated. It is called text watermarking, it moved from a research idea in 2022 to published science in 2024 to production rollout, and the mechanism is counterintuitive on first contact: the watermark adds nothing to the text. No hidden characters, no zero-width spaces, no peculiar spellings — all of which are stripped by the first copy-paste anyway.

It hides somewhere else entirely.

Language is full of free choices

“The sky was overcast.” Grey would have worked. So would cloudy. Three words, all ordinary English, none better than the others in that sentence. The model had to emit exactly one, and whichever it emitted, you would not have noticed.

That is where the signal goes. Not into the text — into which of the equally good options got chosen.

Entropy is the budget

At every position, a language model scores the whole vocabulary, softmax turns those scores into a probability distribution, and then it samples. Generation rolls dice. And wherever dice are rolled, someone can load them.

How much room there is depends on the position. After “My cat is …” the top candidates might sit at 0.31, 0.28 and 0.25 — sleepy, drowsy, tired. Nearly interchangeable. After “Isaac Newton’s most famous work:” there is essentially one right answer, and the distribution collapses onto it.

One choice carries nothing — a single loaded coin flip proves nothing at all. But ordinary prose offers dozens of medium-entropy choices per paragraph, and the budget adds up. The signal is faint everywhere and unmistakable in total. That tension is the whole design.

Replacing the dice

The naive approach — give the model a fixed list of favourite words and always prefer them — fails three ways at once. The text becomes measurably biased, the pattern is visible to anyone who looks for it, and quality drops. What is needed is something that looks exactly like randomness to everyone who does not hold a particular secret.

So: replace the dice. Instead of drawing true randomness, compute a pseudo-random number from a secret key and the few tokens just emitted.

One text, two worlds. To an observer without the key it is noise. To the key holder every choice is checkable.

Why seed on only the last k tokens instead of the whole text? Locality. If someone edits a sentence in the middle, only the choices immediately after it are disturbed; the rest of the signature survives. It is a small design decision that turns out to carry most of the robustness story.

The classic scheme: red and green

The 2023 version works with lists. At every step, a hash of the previous token and the key paints the entire vocabulary — a fraction γ of it green, the rest red. The split changes at every position, and only the key holder can reproduce it.

Then the nudge: every green token’s logit gets a small bonus δ before softmax. The model now prefers green words — slightly. Each individual word still looks perfectly normal. Only the share of green words across the whole text drifts upward.

Detection is pleasingly blunt. Repaint the lists with the key and count.

The scheme has a real cost, though, and it is worth being blunt about it too: the output distribution is genuinely shifted. Turn δ up and the watermark gets louder while the text quietly gets worse. Quality is traded against detectability. The modern schemes refuse to pay that.

Watermarking with zero bias

The goal is a watermark that leaves the output distribution exactly unchanged — over many generations, watermarked and unwatermarked text statistically identical. Same quality, same diversity, same everything. It sounds paradoxical. It isn’t.

For every candidate token i with probability p_i, the key produces a number r_i ∈ (0,1). Emit the token maximising

Over random keys, this selects each token with exactly probability p_i. The distribution is untouched, yet the winner is fully determined by the key. The proof is one line, and it is the part worth carrying home:

The variant rolling out at scale, published as SynthID-Text, runs a small tournament instead: candidate tokens compete in rounds, key-derived functions referee each match, the champion is emitted. Same guarantee, engineered for production — no added latency, no extra tokens. In large-scale side-by-side ratings, human evaluators found no significant difference between watermarked and plain outputs.

The key no longer hides in how likely a token was. It hides in which sample you got.

Detection is a hypothesis test

The detector holds the key and replays the game. For every position it recomputes the key’s numbers and asks: is this token the one the watermark would have favoured? Each position answers with a small score, and the scores are summed.

Under the null hypothesis — no watermark — that total follows a known distribution. A watermarked text lands far out in the tail, and the p-value is the probability of getting there innocently. This is the same statistics that runs every scientific experiment, pointed at a forum post.

Length is power. A two-line comment barely moves the needle — too few free choices. A full essay is a landslide. Which is exactly why honest detectors report confidence rather than verdicts: short texts stay genuinely uncertain, and no amount of wanting an answer changes that.

Where to put the threshold is not a statistics question but a cost question. Missing a watermark is a shrug. Falsely accusing a human author is serious. So real detectors set thresholds where false positives are vanishingly rare, and accept missing some short or heavily edited texts in exchange.

What it does not do

• Low entropy kills it. Dense facts, code, formulas, tabular text — often there is exactly one right token, so the signature turns sparse. The same document can be loud in one paragraph and silent in the next.
• Rewriting removes it. Light edits barely dent the signal; locality saves it. Heavy paraphrase erodes it token by token. A full rewrite or a translation replaces every choice the model made, and the watermark is gone. It is a seatbelt, not a fortress: it raises the cost of laundering text, it cannot make it impossible.
• A hit proves involvement, not authorship. Detection says this model was likely involved. It cannot distinguish wrote-it-all from assisted from quoted. And a non-detection proves nothing at all — the text may be human, from another model, or scrubbed.
• It only covers models that carry it. Open weights anyone can run at home need not cooperate. Watermarking will cover a growing share of AI text and never all of it. It shifts the landscape; it does not close it.

Why this is happening now

Regulation. New rules require that machine-generated content be detectable by machines, and watermarking is the most practical answer anyone has produced. The alternatives have been tried and have stumbled: classifiers that guess “AI or human” from style are unreliable, and their false accusations land on real people. Provenance metadata and signatures vanish the moment someone copies the text out of the page. The watermark travels inside the text and yields honest statistics. Its price is that only the key holder can check.

What remains open is governance, not mathematics. Should detection be public, or does a public detector simply teach attackers to evade it? Will providers converge on a shared standard? And how should platforms treat the enormous grey zone of human–AI co-writing, which is where most real documents now live?