This article explores the mechanics of AI text watermarking, specifically following the methodology of Kirchenbauer et al. (2023). The technique works by partitioning a model's vocabulary into "green" and "red" lists, where the green list is dynamically generated at each step by using a hash of the previous token to seed a pseudo-random number generator (PRNG) for a Fisher–Yates shuffle. During token sampling, a small constant, delta (δ), is added to the logits of all green candidates, subtly tilting the softmax distribution toward the green list without compromising linguistic quality. To detect the watermark, a model-blind detector employs a z-test to measure the frequency of green tokens. Since human writing should result in a green token probability of approximately 50%, a watermarked text will yield a high z-score. A threshold of z > 4 is cited as providing a false-alarm rate of roughly 1-in-30,000. However, the method is fragile; because the green list is dependent on the specific sequence of tokens, paraphrasing or synonym substitution breaks the chain, causing the z-score to collapse toward zero and rendering the watermark undetectable.

Read original