AI Text Watermarking

Text watermarking is a proactive scheme that makes slight, rule-based adjustments to the probability distribution of a language model during the generation of each token, causing the output text to carry a signature that can be recovered algorithmically.

When generating each token, the watermarking algorithm randomly partitions the vocabulary into a green list and a red list based on a hash of the preceding context, and slightly increases the probability of green list tokens being selected.

AI text watermarking does not add visible marks to the surface of text; instead, it leaves a statistical fingerprint during the model's generation process through subtle manipulation of token selection.

The detecting party only needs to hold the key used during generation to determine through statistical testing whether a text was generated by a specific model, without needing to store the original text.

In normal human writing, approximately 50% of words fall on the green-list side, because the vocabulary is randomly partitioned.

Text watermarks have lower sensitivity for short texts; the longer the text, the more reliable the statistical signal.

AI rewriting is currently one of the most effective methods of watermark evasion, disrupting the original watermark signal by reintroducing a new vocabulary distribution.

Synonym substitution, text blending, and round-trip translation can all weaken or eliminate the watermark signal.

The stronger the watermark signal, the higher the robustness, but the more restricted the vocabulary choices become, and the more easily text fluency and diversity decline.

Watermark reliability can be broken down into three mutually constraining dimensions: imperceptibility, robustness, and false positive rate.

In high-stakes scenarios such as academic integrity or legal forensics, an overly aggressive detection threshold may result in unjust accusations against innocent authors.

By detecting the degree of attenuation in watermark signal strength, it is theoretically possible to estimate the depth of human intervention, but this method is still in the stage of theoretical exploration.

Simple editing operations such as replacing synonyms, adjusting word order, and inserting or deleting words can also weaken watermarks, and modifying a sufficient proportion of tokens can bring the green-list statistics back to a random level.

There is currently no single watermarking scheme that can resist all known removal attacks while guaranteeing text quality.

Watermarking has practical significance in governing large-scale, low-barrier AI abuse scenarios (such as bulk generation of spam content and automated cheating), but it is difficult to constitute a reliable line of defense against adversaries with strong motivation and technical capabilities.

More robust watermarking research directions include watermarks based on semantics rather than surface tokens, or the adoption of more sophisticated hash-window strategies.

Paraphrasing is the most straightforward watermark removal attack: using another language model to synonymously rephrase the text can scramble the token sequence, breaking the hash dependency between the green list and red list and causing the watermark signal to significantly attenuate or even disappear.

The larger the weighting magnitude of the watermark, the easier detection becomes, but the more noticeable the damage to text quality, requiring a balance between detectability and generation quality.