The video begins with the hard red-list methodHard red-list language model watermarking forbids one keyed subset of tokens and allows sampling only from the complementary preferred set. proposed by Kirchenbauer and colleagues. A secret key and the previous token seed a deterministic function that divides the vocabulary into green and red lists. The model is forced to sample only green tokens, allowing a detector with the same key to replay the assignments, but the restriction can damage quality when the correct continuation falls into the red list.
Soft watermarking avoids banning red tokens. It adds a fixed bias to green-token logits, so high-probability answers such as Paris can still win while ambiguous, high-entropy choices lean toward the green list. Detection then becomes statisticalStatistical language model watermark detection tests whether keyed token choices occur more often than would be expected by chance.: the detector calculates whether a passage contains more green tokens than chance would predict, commonly using a one-sided z-test.
Google's SynthID-Text replaces the fixed logit bias with tournament sampling. It draws many honest samples from the model's original probability distributionA language model sampling distribution assigns a probability to each possible next token after model scores and decoding controls are applied., pairs them in repeated rounds, and uses keyed green-list decisions to choose each winner. Google reported no statistically significant quality difference in an analysis of roughly 20 million rated watermarked and unwatermarked responses, while the detector aggregates the keyed verdicts across tokens and rounds.
The method has practical limits. Short answers and low-entropy tasks may not offer enough interchangeable token choices to encode a detectable pattern, while paraphrasing with another model can weaken or remove itA language model watermark paraphrase attack rewrites watermarked text to preserve meaning while weakening the original keyed token pattern.. Detection also requires access to the secret watermarking keySecret-key language model watermark detection uses a protected key to reconstruct the token-selection rule and test whether text follows its hidden pattern., so a provider can identify its own outputs or share a detector without making the watermark universally visible.
Watch on YouTube
