Hard red-list language model watermarking deterministically partitions the vocabulary for each generation step using a secret key and contextual seed. The decoder excludes red-listed tokens and samples from the green list, creating a strong pattern that a detector with the key can reproduce.
The restriction improves detectability but can reduce quality. When the best continuation is red-listed, the model must choose a less suitable token, and the effect is especially noticeable when only a few continuations are semantically or factually correct.
ELI5
Hard red-list language model watermarking secretly divides possible next tokens into allowed and forbidden groups at each step. The model samples only from the allowed group, creating a pattern that a detector with the key can recognize.
For example, if the most accurate next word is temporarily forbidden, the model must choose another allowed word. This strengthens detection but can reduce writing or factual quality when only a few continuations fit well.
Why is hard red-list watermarking easy to detect?
The generator strongly favors the keyed green list, so a sufficiently long passage contains far more allowed tokens than chance predicts.
Why can hard red-list language model watermarking reduce quality?
It can ban the most appropriate next token, forcing the model to choose a weaker continuation solely to preserve the watermark.
