Watermarking

Definition

Watermarking biases the generation towards a secret “green” token list (KGW: add $\delta$ to the logits of a keyed, context-dependent fraction $\gamma$ of the vocabulary). A detector that knows the secret counts the green tokens and computes a z-score: human text has about the expected share of green tokens, watermarked text has far too many (Kirchenbauer et al., ICML 2023).

Detection

$$z=\frac{|s{|}_G-\gamma T}{\sqrt{T\gamma (1-\gamma )}}$$

Example from Lecture 1: no watermark z = 0.31; with watermark z = 7.4 (p = 6e−14), the text is statistically “too green”.

Why it matters: as models improve, their text becomes indistinguishable from human text, so detection without a watermark may become impossible.

Appears in

• Lecture 1, Detecting AI-Generated Content
• Lecture 5, Embedding the Watermark: KGW green/red lists
• Lecture 5, Detecting the Watermark: the z-test
• Lecture 5, Aaronson’s Gumbel Scheme and undetectable watermarks
• Lecture 5, Attacks: paraphrase, cipher, oracle, copy-paste, stealing and spoofing
• Lecture 5, The Volume Argument
• Lecture 11, Steganography and Watermarking: resist removal vs. resist detection