Sampling-Based Text Watermarking for LLMs: How Statistical Encoding Works and Where It Breaks

1. Why Watermark Generated Text?

As AI-generated content becomes more common, many applications need to answer a basic question: was a piece of text generated or processed by a language model? Content provenance, platform moderation, copyright attribution, and fraud prevention all depend on this distinction.

A watermark adds a detectable signal that indicates the likely source of text. A simple approach is to insert full-width spaces, invisible characters, or alternative quotation marks. These methods exist, but they are generally unsuitable for production use:

1. They are fragile: invisible characters can disappear during copy-and-paste, rich-text conversion, or encoding changes.
2. They can affect presentation: changes to spaces or punctuation may alter layout or render incorrectly on some devices.
3. They are easy to remove: a basic formatting-cleanup step can eliminate the watermark.
4. They can produce false positives: these characters may also appear in human-written content, making source attribution unreliable.

Modern approaches therefore tend to move the signal into the sampling layer. Instead of modifying the visible form of the text, they encode the watermark through the probabilities used to select tokens.

2. Comparing the Main Approaches

Approach	Signal location	Advantages	Main limitations
Character-level steganography	Invisible characters, full-width or half-width substitutions	Simple to implement; does not require model access	Lost during format conversion; easy to remove; may affect layout
Formatting-based markers	Whitespace, punctuation habits, paragraph structure	Usually difficult to notice visually	Weak signal; easily removed by stylistic rewriting
Sampling-based statistical watermarking	Probability of selecting the next token	Independent of surface characters; quality impact can be tuned; supports statistical testing	Requires intervention during generation; weak on short text
Training-time watermarking	Model parameters or training data	Theoretically decoupled from the inference process	Requires retraining or fine-tuning; expensive and difficult to verify

Sampling-based statistical watermarking offers a practical balance between detectability and text quality, making it one of the most widely discussed approaches. The rest of this article focuses on this method.

3. How Sampling-Based Statistical Watermarking Works

At each generation step, a language model produces logits for every candidate token in its vocabulary. Softmax converts the logits into probabilities, and a token is then sampled from that distribution. A watermarking method modifies this process in two ways.

3.1 Partitioning the Vocabulary with Context and a Secret Key

At each generation position, a pseudorandom function uses the previous token and a server-side secret key to divide candidate tokens into two groups:

• Green list: approximately a proportion γ of the vocabulary, such as 0.5.
• Red list: all remaining tokens.

Because the key is held only by the service, external parties cannot reproduce the same partition without access to it.

3.2 Applying a Bias to Green-List Tokens

Before sampling, the system adds a fixed bias δ to the logits of green-list tokens. These tokens become slightly more likely to be selected, while red-list tokens become slightly less likely.

The bias is deliberately small, so its effect is difficult to notice at any individual position. Across many positions, however, the proportion of green-list tokens becomes measurably higher than the random baseline.

3.3 Detecting the Signal with a Statistical Test

The detector does not generate text. It checks whether each token transition in the text belongs to the green list. Without a watermark, the green-list proportion should be close to γ. A significantly higher proportion suggests that the text contains a watermark.

The decision can be based on a z-score:

[
z = \frac{G - \gamma T}{\sqrt{T\gamma(1-\gamma)}}
]

Here, (T) is the number of token transitions included in the test, and (G) is the number of transitions that fall into the green list. A larger z-score provides stronger evidence for the presence of a watermark.

4. Illustrative Code

The following code demonstrates the underlying idea. It does not represent the parameters or interfaces of any particular implementation. A production system would vectorize vocabulary operations and handle repeated token transitions, special tokens, and other edge cases.

import hashlib
import math
def is_green(prev_id: int, cur_id: int, key: str, gamma: float) -> bool:
    """Use the key, previous token, and candidate token to identify green-list tokens."""
    digest = hashlib.sha256(f"{key}|{prev_id}|{cur_id}".encode("utf-8")).digest()
    value = int.from_bytes(digest[:8], "big") / 2**64  # Map to [0, 1)
    return value < gamma
def biased_logits(logits: list, prev_id: int, key: str, gamma: float, delta: float) -> list:
    """Add a bias to green-list candidate tokens before sampling."""
    out = list(logits)
    for token_id in range(len(out)):
        if is_green(prev_id, token_id, key, gamma):
            out[token_id] += delta
    return out
def z_score(tokens: list, key: str, gamma: float) -> float:
    """Calculate the watermark z-score for a tokenized sequence."""
    n = len(tokens) - 1
    if n <= 0:
        return 0.0
    green = sum(
        1 for i in range(n) if is_green(tokens[i], tokens[i + 1], key, gamma)
    )
    expected = gamma * n
    std = math.sqrt(n * gamma * (1 - gamma))
    return (green - expected) / std

Several implementation details are important:

• The z_score function must use the same tokenization scheme as the generation system. Otherwise, the statistical test is no longer valid.
• If the same token transition appears repeatedly, the implementation must define whether repeated transitions are deduplicated. Otherwise, duplicated passages can amplify the signal.
• Iterating through the entire vocabulary in biased_logits is inefficient. Production systems typically use vectorized mask operations to perform the same calculation.

5. The Trade-Off Between Quality and Detectability

The bias strength δ and green-list ratio γ determine both watermark strength and its effect on output quality.

• A larger δ makes green-list tokens more likely to be selected and strengthens detection, but it moves the output distribution farther from the original model distribution. Diversity and fluency may decline.
• A smaller γ concentrates the bias over a narrower set of tokens, potentially increasing the information carried by each hit. However, the available candidate set also becomes smaller.

Token entropy is another important factor. In open-ended writing and creative generation, many candidate tokens may be reasonable, so a small bias often has little effect on quality. In code, fixed terminology, and mathematical expressions, the correct answer may have only one viable continuation. Applying a forced bias in these positions can introduce errors.

For this reason, practical systems often apply the bias only at high-entropy positions and preserve the original sampling distribution at low-entropy positions.

This also means that detectability depends on the content itself. Text containing substantial code or formulas may retain only a weak watermark signal, even when it was generated by a watermarked model.

6. False Positives: Why Human-Written Text Is Usually Not Misclassified

False positives are one of the main concerns for users. The risk can be understood from three perspectives.

6.1 A Single Sentence Is Not Enough

Detection depends on the statistics of many token transitions. A single sentence usually contains too few transitions for its z-score to exceed a meaningful threshold. In practice, detection may require dozens to hundreds of tokens, depending on γ, δ, and the entropy of the text.

6.2 The Threshold Controls the False-Positive Rate

Under the no-watermark assumption, the z-score is approximately normally distributed. If the threshold is set at (z > 4), the one-sided tail probability is approximately (3 \times 10^{-5}). In theory, this represents a very low probability of classifying human text as watermarked.

Actual false-positive rates also depend on the distribution of text lengths and on the deduplication strategy. They should therefore be measured using real-world samples rather than inferred from theory alone.

6.3 The Real Sources of False Positives

False positives generally do not occur because a human writing style “looks like” model output. More common causes include:

• An author copies a large portion of model-generated text and makes only minor edits, leaving many original token transitions intact.
• Text is polished, translated, or summarized by a model, allowing the signal from an intermediate generation step to remain.

The key distinction is that watermark detection estimates whether text was generated or processed by a watermarked model. It does not determine whether an author’s writing style resembles model output. Style similarity is a separate classification problem and is generally less reliable than statistical watermarking.

7. Robustness and the Attack Surface

Watermark stability depends on what an attacker is able to do to the text.

• Synonym replacement and rewriting: token transitions are disrupted, causing the green-list ratio to move toward random and lowering the z-score.
• Translation, summarization, and structural reorganization: the signal can be substantially weakened or disappear entirely.
• Mixed authorship: human-written sections dilute the overall z-score, so detection may need to operate by paragraph or with a sliding window.
• Text from an unwatermarked model: a watermark exists only along the generation path of the watermarked model. Text from other sources does not inherently contain the signal.

Watermarking is therefore better treated as one layer of provenance evidence than as the sole basis for a decision. A detection result should be interpreted as probabilistic evidence that a watermark is present, not as an absolute conclusion.

8. Engineering Recommendations

8.1 Key Management

The secret key is the core security asset of the watermarking scheme. It should be stored in a dedicated key-management service rather than in source code, configuration files, or logs.

The system should support key rotation and record the key version used for each generated text segment so that the content can be verified later. Generation and detection services should have separate permissions, and the detection service should access only the information required for verification.

8.2 Detection API Design

A detection API should not return only “yes” or “no.” It should also provide the z-score, sample length, and threshold used for the decision.

Different applications may choose different thresholds. Content moderation may prioritize a low false-positive rate, while an early risk-warning system may accept more false positives to reduce missed detections. False-positive samples should be retained under an appropriate data policy so that thresholds can be calibrated continuously.

8.3 Combining Multiple Signals

Watermarking can be combined with other signals, such as content fingerprints, account behavior, and human review. When the errors of one signal are offset by others, the overall decision becomes more reliable.

8.4 Privacy and Data Retention

Text submitted for detection may contain personal or confidential information. Systems should follow data minimization principles, retain only what is necessary to complete detection, and define a clear retention period.

8.5 Evaluation Metrics

Before deployment, evaluate at least the following:

• False-positive rate (FPR) and true-positive rate (TPR): measure performance separately on labeled human-written and model-generated samples.
• Length curves: measure detection rates at different text lengths to identify the minimum practical detection length.
• Edit-strength curves: measure detection rates under different levels of rewriting to understand the robustness boundary.
• Quality impact: compare output quality before and after watermarking using human evaluation, perplexity, and other relevant metrics.

8.6 User Disclosure

When generated content carries a statistical watermark, product documentation should disclose this fact and follow applicable regulations in the relevant jurisdictions. The presence of a watermark should not be hidden in a way that prevents users from understanding how the product handles their content.

9. Practical Boundaries

Sampling-based statistical watermarking is a good fit for:

• Batch provenance analysis across large volumes of generated content.
• Open-ended generation with sufficient text length and relatively high content entropy.
• Applications that can tolerate some missed detections while requiring false positives to remain controlled.

It is less suitable for:

• Per-item decisions on single sentences or extremely short text.
• Strong provenance requirements for code, formulas, structured data, and other low-entropy content.
• High-risk scenarios involving adversarial rewriting or conversion through other models.

Understanding these boundaries is essential. Sampling-based watermarking can provide useful statistical provenance evidence, but it should not be treated as a universal or definitive tool for determining authorship.