LLM Text Watermarking Explained: Working Principle, Detection, and Ecosystem Impact

1. Why AI-Generated Text Needs a “Watermark”

Large language models (LLMs) can now produce fluent prose at scale, which makes the origin of plain text increasingly hard to identify. A well-written article may come from a human or from a model that generated it in seconds. That ambiguity creates three practical problems:

• Uncertain authenticity: AI-generated text can be used to spread misleading narratives.
• Harder originality checks: It is difficult to judge whether academic or creative work is genuinely original.
• Compliance challenges: Platforms struggle to govern large volumes of automatically generated content.

A “text watermark” does not insert a visible marker into the words. Instead, it makes the model apply a statistically detectable bias to the sequence of tokens it generates. It leaves the meaning and readability unchanged, survives copying and pasting, and can leave a residual signal even after light editing. Its value lies not in making text impossible to forge, but in providing probabilistic evidence of where content came from.

2. Core Principle: Biased Sampling Based on the Probability Distribution

Most current approaches come from a widely studied family of methods based on green-list / red-list bias. Normally, at each generation step, the model samples a token according to the probability distribution it outputs. A watermarking scheme first hashes the preceding context to divide the vocabulary into a “green list” and a “red list”. It then slightly increases the sampling probability of green-list tokens.

For a single step, this shift is virtually imperceptible. For a full passage, however, the proportion of green-list tokens is significantly higher than random chance would predict if the text was produced by a watermarked model. The detector exploits exactly this statistical difference.

3. Generator-Side Implementation

The generator-side logic is illustrated by the following pseudocode:

import hashlib
GREEN_RATIO = 0.5   # green list ratio γ
BIAS_DELTA  = 2.0   # bias strength δ
def get_green_list(prev_token, vocab_size):
    # Use the preceding token as the hash seed so the same context always gets the same split
    seed = int(hashlib.sha256(str(prev_token).encode()).hexdigest(), 16)
    green, x = set(), seed
    for _ in range(int(GREEN_RATIO * vocab_size)):
        x = (x * 1103515245 + 12345) % (2 ** 31)
        green.add(x % vocab_size)
    return green
def biased_sample(logits, prev_token, vocab_size):
    green = get_green_list(prev_token, vocab_size)
    for i in range(vocab_size):
        if i in green:
            logits[i] += BIAS_DELTA   # boost green-list tokens only
    return softmax(logits)            # normalize, then sample from the distribution

Three parameters determine how strong and how stealthy the watermark is:

• γ (green list ratio): A larger green list means a weaker bias at each step and better stealth, but a longer text is needed for reliable detection. A smaller green list works the other way around.
• δ (bias strength): A larger δ makes detection more sensitive, but it also affects generation quality more, and word choices can start to sound awkward.
• Hash seed choice: Using the preceding token as the seed keeps the split consistent for the same context. This consistency is what allows the detector to reproduce the same split.

In practice, the watermark bias is usually inserted between the sampling logic and the softmax step. This is a lightweight change to post-inference processing and requires no model retraining.

4. How Detection Works

Detection is essentially a hypothesis test. The null hypothesis is that the text was generated without a watermark, in which case the share of green-list tokens should be close to γ. If the observed share is clearly higher, the null hypothesis is rejected:

import math
def detect_watermark(tokens, vocab_size):
    green_count = sum(
        tok in get_green_list(tokens[i-1] if i > 0 else BOS, vocab_size)
        for i, tok in enumerate(tokens)
    )
    n = len(tokens)
    expected = GREEN_RATIO * n
    std = math.sqrt(n * GREEN_RATIO * (1 - GREEN_RATIO))
    z = (green_count - expected) / std
    return z > THRESHOLD     # a z-score above the threshold flags the text as likely AI-generated

The key consideration here is the trade-off between the threshold and text length. In shorter texts, statistical variation is larger and the risk of misjudgment is higher. In longer texts, the z-score is more stable. As a result, watermark detection becomes noticeably less reliable on very short texts, such as a single sentence or a headline.

5. Robustness and Attack Surface

A watermark cannot stop every attack, and its limitations should be recognized clearly:

• Paraphrasing / content laundering: Rewriting the text with another model for paraphrasing can disrupt the statistical distribution of green-list tokens and break the watermark.
• Translation: Cross-language translation reorders the token sequence. Most schemes trained for a single language struggle to preserve the signal.
• Short-text degradation: As noted above, the statistical test loses its power when the text is too short.
• False positives: Some high-frequency human phrases happen to fall on the green list and can produce false positives on unwatermarked text. Thresholds and minimum-length requirements help keep this under control.

For these reasons, a watermark is better treated as “circumstantial evidence” than as definitive proof. It is usually combined with other measures, such as content hashing and storage, generation logs, and account attribution.

6. Practical Engineering Recommendations

To build similar capabilities into your own product, start with these general engineering steps:

1. Integrate into the inference pipeline: Add the bias post-processing at the sampling stage of your model service. Keeping it decoupled from the main inference path makes canary rollouts and rollbacks easier.
2. Make parameters configurable: Expose γ and δ as configuration options so you can balance stealth against detection rate for each scenario.
3. Combine with logging and record-keeping: Use general capabilities such as object storage and logging services to retain the watermark parameter version, detection thresholds, and generation request metadata for later audits and dispute resolution.
4. Run detection as a separate service: Build detection as a standalone service that compliance and risk-control systems can call, so it stays decoupled from the generation pipeline.
5. Ensure observability: Use monitoring and alerting systems to track metrics such as detection hit rate and false-positive rate, and keep tuning the thresholds over time.

On Baidu AI Cloud, these capabilities can be assembled from general-purpose product categories such as object storage, message queues, container platforms, logging services, and monitoring and alerting. Together they can form a complete watermark generation–detection–audit loop without relying on any vendor-specific interfaces.

7. Deeper Impact on the Content Ecosystem

If watermarking becomes widespread, it could reshape the relationships among three groups:

• Platforms: It gives them a practical tool for governing large-scale automatically generated content. However, they should guard against the mistaken logic of treating “no watermark detected” as proof of “human-written”.
• Creators: Human creators may deliberately go “unwatermarked” as a declaration of originality, creating a new kind of trust label.
• Ordinary users: They need to understand that a detection probability is not an absolute verdict, and should not rely on a single signal.

What will truly change the ecosystem is not the watermark itself, but the content provenance standards and consensus mechanisms built around it. Only when generation, detection, record-keeping, and auditing form a closed loop can this technology move from a “probability game in the lab” to trustworthy content infrastructure.

On the technical side, a watermark is a lightweight change on the generation side plus a statistical test on the detection side. On the ecosystem side, it tests the whole industry’s ability to define and govern what “trustworthy content” means. For developers, understanding how the technology works and where its limits lie matters more than following one vendor’s announcement after another.