AI Text Watermarking Explained: Green List Mechanism and Detection Methods

Why We Need AI Text Watermarking

As large language models (LLMs) rapidly advance in capability, AI-generated text has become nearly indistinguishable from human writing. This creates a series of real-world problems: academic cheating, mass production of fake news, automated phishing emails, and the "contamination" of training data by AI-generated content—where subsequent models trained on unfiltered internet data inevitably absorb large volumes of AI-generated text, potentially leading to degraded model capabilities or amplified biases. This phenomenon is known in academic literature as "model collapse." Against this backdrop, how to reliably identify whether a piece of text was produced by AI has become a core issue of shared concern in both industry and academia.

AI Text Watermarking is one of the key technologies addressing this challenge. Its core idea is: during the model's text generation process, quietly embed a "signal" that is imperceptible to the human eye but detectable by algorithms. This way, even if content is copied and distributed, as long as sufficient original text is preserved, it can be traced back as AI-generated.

Technical Principles of AI Text Watermarking

The Green List Mechanism Based on Vocabulary Partitioning

The most representative text watermarking scheme to date was proposed by John Kirchenbauer's team at the University of Maryland in 2023, based on vocabulary partitioning. Its core logic is not complex, yet remarkably clever.

When a large language model generates each token, it essentially computes a probability distribution over the entire vocabulary and then samples from it. It's important to understand that modern LLM text generation is an autoregressive process: the model predicts the next token one at a time, computing logit values over the entire vocabulary (typically containing tens of thousands to hundreds of thousands of token units) based on preceding context at each step, normalizing them into a probability distribution via softmax, and then selecting the final token through specific sampling strategies (such as top-k, top-p sampling, or temperature adjustment). The watermarking algorithm intervenes precisely in the stage between logits and final sampling.

Specifically, the watermarking algorithm intervenes at the sampling step: based on the hash value of several preceding tokens, it randomly partitions the entire vocabulary into two groups—a "green list" and a "red list." The cryptographic hash function used here (such as SHA-256) has two key properties: determinism (the same input always produces the same output) and unpredictability (tiny input changes lead to completely different outputs). This means that as long as the key and hashing rules are known, the detecting party can precisely reproduce the green/red list partition at any text position, while third parties without the key cannot forge or reverse-engineer the watermark signal. The algorithm then applies a small positive bias (logit bias) to the generation probabilities of words in the green list, making the model more inclined to select green list words.

Embedding Watermark Signals Without Compromising Text Quality

The key is that this bias is extremely subtle. For any individual sentence, human readers can barely notice the change in word preferences, and the text's fluency and semantics remain essentially unaffected. However, from a statistical perspective, a sufficiently long AI-generated text will exhibit a significantly elevated "green list word ratio."

The detection side only needs to know the hashing rules used during generation to reproduce the green list/red list partition, then count the frequency of green list words in the text being examined. If this ratio is far higher than expected under random conditions (normal human writing is approximately 50%), statistical hypothesis testing (such as the z-test) can determine with high confidence that the text was very likely generated by a watermarked model.

Here's how the z-test works in this scenario: the null hypothesis is set as "the text was written by a human or generated by an AI without watermarking," in which case each token has approximately a 50% probability of falling into the green list (due to random partitioning). For a text of length N, if the observed green list word ratio is significantly above 50%, the larger the z-value, the higher the confidence in rejecting the null hypothesis. For example, if 140 out of 200 tokens fall into the green list (70%), the z-value is approximately 5.66, corresponding to an extremely small p-value (less than 10^-7), providing strong evidence for the presence of a watermark. This probabilistic framework gives detection results a quantifiable false positive rate, providing watermark detection with a rigorous mathematical foundation.

Advantages and Limitations of Watermarking Technology

Advantages Over Traditional AI Detectors

Compared to post-hoc trained classifiers that "guess" the text's origin (such as OpenAI's discontinued AI Text Classifier, GPTZero, and similar tools), watermarking schemes have several notable advantages:

• Active embedding: The signal is deterministically embedded during generation, resulting in higher detection accuracy and lower false positive rates
• No access to the original model required: Detection can be completed with just a key, at extremely low computational cost
• Quantifiable confidence: Watermarks have some detection capability even for short texts, and can theoretically output statistical confidence levels

Unavoidable Technical Limitations

However, text watermarking is far from a silver bullet. It faces several fundamental challenges:

• Paraphrasing attacks: If an attacker uses another model or manual effort to substantially rewrite the text with synonym substitutions, the green list signal is gradually diluted or even eliminated. Since watermark signals are bound to specific token sequences, when a token is replaced with a semantically equivalent but different word, the green list signal at that position is lost. Research shows that a single round of high-quality paraphrasing can weaken the watermark signal by 60%-90%. More advanced attacks include back-translation (translating through an intermediate language) and contextual rewriting (preserving core information while completely restructuring the expression). This adversarial vulnerability means watermarking cannot serve as the sole basis for judgment.

• Text length dependency: The reliability of watermark detection is highly dependent on text length. For texts of only a few dozen words, the statistical signal is often insufficient to support reliable conclusions.

• Low-entropy text dilemma: For code, mathematical formulas, or highly structured content, the model has almost no "word choice freedom," making it difficult to embed watermarks without compromising correctness. "Entropy" here refers to the model's uncertainty in word choice at each position—high entropy means multiple tokens have relatively high probabilities of being selected, giving the model ample freedom in word choice and allowing the watermark to guide selection toward green list words without affecting quality; low entropy means the correct answer is nearly uniquely determined. Researchers have proposed "adaptive watermark strength" strategies: embedding watermarks only at high-entropy positions while keeping the original distribution unchanged at low-entropy positions. However, this reduces signal density per unit length, requiring longer texts for reliable detection.

• Ecosystem collaboration challenges: Watermarks are only effective when model developers actively deploy them. Open-source models and malicious actors can simply choose not to add watermarks or directly remove the relevant logic.

Industry Deployment and Future Directions

Google DeepMind has open-sourced a text watermarking tool called SynthID-Text and integrated it into their Gemini model, marking the transition of watermarking technology from academic research to industrial-grade deployment. This solution employs an improved mechanism called "tournament sampling"—unlike traditional green list methods that directly add bias to logits, tournament sampling first draws multiple candidate tokens from the probability distribution, then conducts an "elimination tournament"-style selection among candidates based on watermarking rules, preferentially selecting tokens that conform to the watermark signal. The advantage of this approach is that the finally selected token always comes from the original high-probability region, guaranteeing a floor for generation quality while making the watermark signal embedding more robust. SynthID-Text has been integrated into Google's Responsible AI Toolkit, supporting deployment in large-scale production environments.

Looking ahead, AI text watermarking will likely not exist as a standalone defense but rather form a combined approach with other methods. Particularly noteworthy is the C2PA (Coalition for Content Provenance and Authenticity) content provenance standard—a content provenance standards alliance jointly initiated by Adobe, Microsoft, Intel, BBC, and other organizations. Its core concept is to attach tamper-proof metadata "nutrition labels" to digital content, recording creation time, tools used, editing history, and other information. Unlike text watermarking, C2PA focuses on metadata-level provenance rather than signal embedding within the content itself, creating a complementary relationship: watermarks address "whether this text is AI-generated," while C2PA addresses "what production pipeline this content went through." Since 2024, mainstream social platforms and news organizations have begun gradually supporting the display and verification of C2PA standards.

Additionally, retrieval-based comparison and model fingerprinting technologies are developing in parallel. The real challenge lies not only in the technology itself but also in establishing cross-vendor, cross-platform collaboration standards and regulatory frameworks. After all, a rule that only some participants follow will inevitably have limited protective effect.

For everyday users, understanding the existence and boundaries of watermarking technology is equally important: it can provide a certain degree of credibility reference, but should never be treated as an absolute standard for determining content authenticity. In an era where AI and human content are increasingly intertwined, maintaining critical thinking remains our most reliable "detector."

Key Takeaways