Embedding a signal into generated text that is invisible to humans but algorithmically detectable — by softly promoting a hash-seeded "green list" of tokens at every generation step.
Kirchenbauer et al. propose a watermarking framework for language models: at every generation step, the previous token is hashed with a secret key to seed a pseudorandom partition of the vocabulary into a "green" list and a "red" list, and sampling is then biased toward the green list. A one-proportion z-statistic test recomputes the green list at each position of a candidate text and yields an interpretable p-value for whether the text was watermarked — without needing access to the model's API or weights. The paper was tested on Meta AI's Open Pretrained Transformer (OPT) family and won an Outstanding Paper Award at ICML 2023.
Authors: John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein — University of Maryland, College Park. Reference implementation: github.com/jwkirchenbauer/lm-watermarking.
At each generation step, the previous token is hashed with a secret key to seed a pseudorandom partition of the vocabulary into a green list and a red list; sampling is then biased toward the green list using the previous-token hash function.
A baseline scheme using a single fixed red list of banned tokens applied uniformly across all generation steps. Limitation: a static, position-independent red list is easy to characterize and produces noticeably degraded, low-diversity text.
The green/red partition is re-derived at every position by hashing the immediately preceding token, then sampling is restricted to the green list only (hard constraint). Limitation: hard exclusion can be too restrictive at low-entropy positions.
Instead of forbidding red-list tokens, the hardness parameter delta is added to green-list logits before sampling, softly promoting green tokens while preserving text quality at low-entropy positions. Limitation: detection strength depends on the entropy of the generated text.
Detection recomputes the green list at each position of a candidate text using the same hash function and secret key, counts the observed green tokens, and computes a one-proportion z-statistic against the null hypothesis of no watermark to derive an interpretable p-value.
The paper derives an information-theoretic framework, including a spike entropy measure, to analyze how the watermark's detectability depends on the entropy of the token distribution at each generation step.
The watermark is evaluated on a multi-billion parameter model from Meta AI's Open Pretrained Transformer (OPT) family, measuring detectability and perplexity impact on text quality.
The paper discusses the watermark's robustness to text modification and paraphrasing, and security considerations such as an adversary attempting to spoof or remove the watermark without knowledge of the secret key.
At each generation step, hash the immediately preceding token using a secret key.
Use the hash value to seed a pseudorandom partition of the vocabulary into a green list and a red list for this position.
In the hard variant, restrict sampling to green-list tokens only; in the soft variant, add the hardness parameter delta to green-list token logits.
Apply softmax to the adjusted logits and sample the next token from the resulting distribution.
Repeat the hash, partition, bias, and sample steps for each subsequent token to embed the watermark across the generated text.
Given a candidate text, recompute the green list at each position using the same hash function and secret key.
Count how many observed tokens fall in their position's green list and compute the one-proportion z-statistic against the null hypothesis of no watermark.
Compare the resulting p-value against a chosen significance threshold to decide whether the text is watermarked.
A concrete, illustrative numeric walkthrough of one embedding step and one detection step of the hash-seeded green-list watermarking scheme, for readers new to the method.
Suppose the text generated so far ends in the token 'the', and the model is about to generate the next token.
Compute hash(secret_key, token_id_of('the')) to produce an integer seed value, for example seed = 738291.
Use the seed to initialize a pseudorandom number generator and pseudorandomly split the full vocabulary into a green fraction gamma (for example gamma = 0.5) and the remaining red fraction.
The language model computes a raw logit score for every token in the vocabulary as the candidate next token, for example logit('cat') = 3.1 and logit('dog') = 3.4, with 'cat' in the green list and 'dog' in the red list.
Add the hardness parameter delta (for example delta = 2.0) to the logits of every green-list token only: new logit('cat') = 3.1 + 2.0 = 5.1, while logit('dog') remains 3.4.
Convert the biased logits into a probability distribution with softmax and sample the next token; 'cat' (green, biased) is now more likely to be chosen than 'dog' (red, unbiased) even though 'dog' had the higher raw logit.
With 'cat' now the previous token, repeat steps 2 through 6 using hash(secret_key, token_id_of('cat')) to derive a fresh green/red partition for the following token.
Continue this process token by token until generation stops, producing a complete passage of text 'the cat ...' whose token choices are subtly but consistently biased toward each position's green list.
Given the text and the same secret key, walk through it token by token, recomputing each position's green list from the hash of the token immediately before it, and count how many tokens landed in their own position's green list (here, 'cat' after 'the').
Compute z = (observed_green_count - gamma * total_tokens) / sqrt(total_tokens * gamma * (1 - gamma)); a large z (for example z > 4) yields a very small p-value and indicates the text is watermarked.
It aims to mitigate potential harms from large language models by embedding a detectable signal into generated text, so machine-generated content can be identified even though it is invisible to human readers.
At each generation step it selects a randomized set of ‘green’ tokens before a word is generated and then softly promotes the use of green tokens during sampling.
The model vocabulary is partitioned at each position into a ‘green’ subset that is favored during sampling and a ‘red’ subset that is not, using a pseudorandom split.
The immediately preceding token is hashed with a secret key, and the resulting value seeds a pseudorandom permutation of the vocabulary that determines that position's green/red partition.
It makes the green list unpredictable without the secret key while remaining exactly reproducible by anyone who holds that key, which is what allows detection without model access.
Delta is a logit bias added to green-list tokens before sampling in the soft-watermark variant; larger delta strengthens the watermark signal at the cost of greater potential impact on text quality.
The hard variant restricts sampling to green-list tokens only, while the soft variant adds a logit bias to green-list tokens without forbidding red-list tokens, preserving quality at low-entropy positions.
A detector recomputes the green list at each position of a candidate text using the same hash function and secret key, then counts how many observed tokens fall in their position's green list.
It is a one-proportion statistical test comparing the observed count of green tokens against the count expected under the null hypothesis of no watermark, yielding an interpretable p-value.
No. Detection uses an efficient open-source algorithm and only requires the secret key and the candidate text, not access to the language model API or parameters.
Spike entropy is part of the paper's information-theoretic framework for analyzing watermark sensitivity; it captures how concentrated a token distribution is, which determines how strongly the watermark signal can be embedded at that position.
The authors tested the watermark using a multi-billion parameter model from Meta AI's Open Pretrained Transformer (OPT) family.
The paper discusses robustness of the detection statistic under text modification and considers security scenarios where an adversary without the secret key attempts to remove or spoof the watermark.
No. The watermark is designed to be invisible to humans while remaining algorithmically detectable from a short span of tokens.
The authors published an open-source implementation of the embedding and detection algorithms at github.com/jwkirchenbauer/lm-watermarking.
Embedding a signal into generated text that is invisible to humans but algorithmically detectable from a short span of tokens.
The subset of the vocabulary favored for sampling at a given generation step under the watermarking scheme.
The complementary subset of the vocabulary that is disfavored (hard variant) or not biased upward (soft variant) at a given generation step.
A keyed hash of the immediately preceding token used to pseudorandomly seed the green/red partition at each position, reproducible by anyone holding the secret key.
The logit bias added to green-list tokens in the soft watermark variant, controlling the strength of the watermark signal.
A watermark variant that biases green-list token logits upward by delta rather than forbidding red-list tokens outright.
A watermark variant that restricts sampling to the green list only, forbidding red-list tokens entirely.
A one-proportion statistical test comparing the observed green-token count in a candidate text against the count expected under the null hypothesis of no watermark.
The interpretable probability value derived from the z-statistic, used to decide whether a text is watermarked.
A measure from the paper's information-theoretic framework capturing how concentrated a token probability distribution is, used to analyze watermark detectability.
A family of multi-billion parameter open-weight language models released by Meta AI, used in the paper's experiments.
A standard text-quality metric used in the paper to measure the impact of watermarking on generated-text fluency.
Interactive graph visualization derived from the companion RDF. Click nodes to resolve, drag to explore. Graph data embedded from companion RDF at generation time.
A ready-to-run entity-type summary query against the named graph, once the companion RDF is uploaded to URIBurner.
text/x-html+tr; DESCRIBE/CONSTRUCT queries render as text/x-html-nice-turtle.
This knowledge graph overview was built by transforming the arXiv paper "A Watermark for Large Language Models" into RDF-Turtle using the kg-generator skill, then rendered as this interactive infographic using the rdf-infographic-skill, powered by Claude Sonnet 5 running on Claude Code. It includes an additional HowTo — A Simple Worked Example of Green-List/Red-List Token Selection — beyond the paper's own algorithm description. The companion RDF file is intended for upload to the URIBurner-hosted Virtuoso quad store as named graph https://linkeddata.uriburner.com/DAV/demos/daas/watermark-for-llms-claude_code-1.ttl; the SPARQL Explorer below queries that graph once uploaded.