Statistical Watermark
A technique that embeds a detectable marker into generated text by slightly biasing token sampling probabilities. The detecting party must hold the key and determine whether the watermark is present on the basis of statistical significance.
Timeline (last 90 days)
When generating each token, a statistical watermark uses a key held only by the vendor to pseudo-randomly partition the candidate vocabulary and slightly raise the sampling probability of one subset (the green list).
Statistical watermarks are fundamentally different from AI detectors based on perplexity, sentence-pattern features and other heuristic signals: the latter are probabilistic guesses, while the former can give statistical confidence provided the key stays secret.
A watermark's robustness and detectability are in tension: the larger the perturbation, the easier it is to detect, but the weaker its resistance to rewriting, translation and synonym substitution.
Handing the text to another model with a request to rewrite it entirely (a laundering-style attack) resamples almost every token, completely defeating the original watermark bias.
Statistical watermarks for open-ended text struggle to be simultaneously robust to benign edits and immune to malicious rewriting.
All Facts (5)
When generating each token, a statistical watermark uses a key held only by the vendor to pseudo-randomly partition the candidate vocabulary and slightly raise the sampling probability of one subset (the green list).
50%UnverifiedStatistical watermarks are fundamentally different from AI detectors based on perplexity, sentence-pattern features and other heuristic signals: the latter are probabilistic guesses, while the former can give statistical confidence provided the key stays secret.
50%UnverifiedA watermark's robustness and detectability are in tension: the larger the perturbation, the easier it is to detect, but the weaker its resistance to rewriting, translation and synonym substitution.
50%UnverifiedHanding the text to another model with a request to rewrite it entirely (a laundering-style attack) resamples almost every token, completely defeating the original watermark bias.
50%UnverifiedStatistical watermarks for open-ended text struggle to be simultaneously robust to benign edits and immune to malicious rewriting.
50%