How statistical text watermarking actually works

01How generation works without a watermark

A language model writes one token at a time. At each step it produces a probability distribution across its whole vocabulary — after 'the weather today is', it might assign meaningful probability to sunny, warm, cloudy, mild and many others. A sampler picks one according to those probabilities, the choice is appended, and the process repeats.

Crucially, many different choices are acceptable at each step. Sunny and warm both produce fluent, sensible text. That redundancy is the space a watermark occupies.

02How a watermark changes it

A watermarking scheme uses a secret key to partition the vocabulary at each step into a preferred group and the rest, then nudges the sampler toward the preferred group. The nudge is small enough that quality is preserved, because there are usually many acceptable next tokens and the scheme only has to favour some of them.

Over a single word this is invisible and meaningless. Over several hundred, the accumulated bias becomes statistically detectable: a detector holding the same key can recompute which tokens were preferred at each position and count how often the text landed on them. Ordinary human writing lands on the preferred group at chance rate. Watermarked text lands there far more often than chance allows.

The output reads completely normally. There is no marker character, no hidden field, nothing to highlight. The evidence is a statistical pattern across the sequence of words.

03What this means for removal

Deleting characters cannot help. Removing a zero-width space does not change which words were chosen, so the detector's count is unaffected. This is the single most common misconception about watermark removal, and it is the reason character-stripping tools cannot deliver what their names imply.

What does degrade the signal is changing the words. Substantial paraphrase replaces the token sequence with a different one, and the new sequence was not produced under the watermarking key, so the correlation weakens. Translation has a similar effect. Light editing does not: fixing punctuation or swapping the occasional adjective leaves most of the sequence intact, and the detector only needs enough of it.

Short passages are also weak carriers. The detection is statistical, so it needs length to reach confidence. A single sentence rarely provides enough signal to distinguish from chance.

04Why nobody can certify removal

Detection keys are not public. Without the key you cannot run the detector, and without the detector you cannot verify whether a given piece of text still carries the mark. Any tool asserting that its output is undetectable is making a claim it has no way to test.

This applies equally to paraphrase-based tools, which use the right mechanism but still cannot verify the outcome. The honest position for any such tool is that rewriting is known to weaken the signal, by an amount that cannot currently be measured from outside the organisation holding the key.

A related asymmetry is worth stating: a detected mark indicates the text passed through a marked system, but it says nothing about who wrote the underlying ideas. Someone who drafted an argument themselves and used a model to tidy the prose will produce marked text describing their own work.

Questions