Why You Cannot See a Watermark in AI Text

Summary of Technical Concepts and Product/Feature Claims

• Anthropic plans to watermark Claude outputs so the provider can verify text provenance, claiming that watermarking “does not impact” output quality.
• The video explains why text watermarking is harder than image watermarking:
  • Text has a small number of characters.
  • Simple approaches (e.g., special Unicode) are easy to spot and remove.
  • Good watermarking requires robustness (i.e., it must be hard to remove).

---

LLM Watermarking Methods Covered

1) Kirchenbauer et al. (2023): Hard Red-List Watermarking

Core idea: During decoding, split the vocabulary into two sets:

• Green list (allowed)
• Red list (forbidden)

Mechanism

• For each next-token step:
  • Compute next-token probabilities.
  • Apply a watermarking function that deterministically assigns candidates to green vs red using a seed derived from:
    • the previous token
    • a secret watermark key (e.g., provider identity)
  • Then sample only from green tokens, so watermarked outputs contain only green-list tokens.

Detection

• The detector recomputes green/red assignments using the secret key plus known prior tokens.
• It checks whether the output is “green enough.”

Quality tradeoff (entropy problem)

• In high-entropy contexts (many plausible continuations), forcing green tokens has less impact.
• In low-entropy contexts (one answer dominates), banning red tokens can degrade output noticeably.
• The video shows failure modes (e.g., degraded outputs like “lord of the rum”) when important words land in the red list.

Key parameters discussed in the playground/demo

• Gamma: fraction of vocabulary that’s green
• Context width: how many prior tokens are used for seeding
• Secret key

Important limitation

• Using the wrong/changed secret key breaks detection, because the detector can’t reproduce the original green/red lists.

---

2) “Soft” Watermark (Soft Red-List)

Goal: Reduce quality loss relative to hard banning.

Mechanism

• Instead of banning red tokens, add a bias to logits for green tokens.
• Green tokens receive a constant boost (parameter delta in the demo).
• Red tokens are still allowed, so quality collapse is less likely.

Detection

• Becomes statistical rather than binary.
• Because red tokens may appear, detection uses a one-sided z-test:
  • Count observed green tokens
  • Subtract the expected green count (often based on gamma; e.g., ~half if gamma = 0.5)
  • Normalize by standard deviation
• Thresholding example:
  • z-score > 4 to classify as watermarked (tuned to keep false positives low)

Demo behavior

• With too little bias, detection can fail (z-score too low).
• Increasing bias improves detection but can approach hard watermark quality issues.

Core critique from the video

• Soft watermarking reshapes token probabilities everywhere, including regions where the model was already confident, requiring manual tuning of delta.

---

3) Google (2024): SynthID-Text / Tournament Sampling

Motivation: Avoid probability drift from soft bias while staying detectable.

Tournament Sampling (described in the video)

1. At each step, sample 2 to m candidate tokens from the model distribution (independent samples).
   • Example: m = 3 → 8 candidates (as described in the walkthrough).
2. Run single-elimination tournaments (multiple rounds).
3. In each match, the watermark function labels candidates green vs red deterministically (using a seed):
   • If one is green and the other red → the green one wins.
   • If both are the same color → winner is random (50/50).
4. Each round uses a different seed (e.g., include the round number in the hash), yielding different green/red partitions.
5. The tournament winner becomes the emitted next token.

Practical parameters discussed

• m is large in practice (Google uses m = 30), implying huge candidate sets conceptually and many tournament decisions (e.g., 30 rounds).

Why quality should remain similar

• Unlike soft watermarking, tournament selection:
  • does not directly modify model logits/probabilities,
  • only chooses which already-sampled candidate survives based on green/red status.
• Reported evaluation in the video:
  • ~20 million responses analyzed
  • thumbs-up/down differences around 0.01% (statistically insignificant)

Detection

• The detector can’t replay the exact tournament bracket because it doesn’t know pairings/tie outcomes.
• Instead, it aggregates “green-ness” across multiple verdicts per token:
  • averages watermark green/red outcomes across tournament rounds
  • applies a z-test similarly to earlier methods
• Baseline behavior:
  • Without watermarking, verdicts act like coin flips (score near ~0.5).
  • With watermarking, the score should be significantly higher.

---

Practical Conclusions and Limitations Emphasized

• Watermarking likely works best when outputs contain high-entropy token choices, such as:
  • summaries with varied wording, giving watermarking room to influence generation without destroying coherence.
• Watermarking can fail when:
  • prompts are yes/no, multiple-choice, or otherwise force low-entropy tokens,
  • outputs are very short, limiting how often the watermark signal appears.
• Removing watermark isn’t as simple as deleting punctuation/em dashes.
  • Suggested tactic: use another LLM to rephrase, potentially stripping the watermark.
• Detection typically requires the watermark key, so ordinary users usually can’t verify provenance unless the system shares the key (or an equivalent verification method).

---

Main Speakers/Sources Mentioned

Speakers

• The video’s narrator/author (name not given in subtitles).

Primary academic sources

• Kirchenbauer et al. (2023): “A Watermark for Large Language Models”
• Google (2024): “Scalable watermarking for identifying large language model outputs” (method: SynthID-Text)

Models used in demos

• Qwen-4B (described in the playground experiments).