Watermarking Playground

How It Works

Three ways to hide a statistical fingerprint in generated text, and how a detector reads it back without ever seeing the model. Back to the playground →

The one idea behind all three

A language model produces text one token at a time. At each step it has a probability for every word in its vocabulary. A watermark quietly tilts those probabilities using a secret key, in a way that is invisible to a reader but measurable by anyone who holds the key.

The trick that makes it work: the tilt is decided by a keyed pseudo-random function of the previous few tokens. Same context plus same key gives the same decision every time, so a detector can replay it later with nothing but the text and the key.

previous h tokens ...to destroy the secret key hash + RNG seed the vocabulary, colored by the seed green = favored · red = discouraged
Every step reseeds from the recent context and the key, then splits (or scores) the vocabulary.

Hard forbid the red list

The bluntest scheme. The seed splits the vocabulary into a green list (a fraction γ) and a red list. During generation, red tokens are simply banned: the model can only emit green.

Detection is trivial because almost every token is green. But quality suffers: the model is forced to skip the perfect word whenever it happens to be red, so the text can read awkwardly.

vocabulary at this step only green can be chosen → resulting token stream nearly 100% green · easy to detect, but stilted
Hard = a wall. Detectable at a glance, at the cost of fluency.

Try it: open the playground, choose Hard, and watch the detector hit a very high z-score.

Soft nudge, do not forbid

Instead of banning red tokens, soft watermarking adds a small bonus δ to the score of every green token before the model samples. Green words become more likely, but a red word can still win when it is clearly the right choice, so the text stays fluent.

No single token proves anything. Across a whole passage, though, green appears far more often than the γ you would expect by chance, and that surplus is the signal.

token scores (logits), green get +δ the striped caps are the +δ boost on green resulting token stream mostly green, red still allowed · fluent detector: green surplus → z-score, p-value
Soft = a thumb on the scale. This is the practical scheme from the Kirchenbauer et al. paper.

Try it: Soft with δ = 4 and a longer output, then raise or lower δ to feel the fluency vs detectability trade-off.

Tournament let candidates compete

DeepMind's SynthID-Text replaces the green/red split with a g-value: a keyed random number in [0, 1] attached to each possible token. Rather than biasing scores directly, it samples several candidate tokens from the model's real distribution and runs a small tournament: at each layer the candidate with the higher g-value advances. Over m layers the winner tends to have a high g-value, yet it was still drawn from the model's own distribution, so quality holds up better than a flat bias.

candidate tokens (g-value shown) 0.81 0.22 0.40 0.67 0.81 0.67 winner 0.81 higher g-value advances each round more layers m → stronger, still fluent detector: mean g-value drifts above 0.5
Tournament = a bracket. The winner is watermarked yet still a natural sample. Note: the browser build approximates the sampler with a g-value bias; the detector is exact.

Try it: Tournament with m = 15, then read the mean g-value in the detection panel.

Reading the mark back

Detection never needs the model or its probabilities, only the text and the key. It replays the seed at each position, recounts how much green (or how high a mean g-value) the text carries, and compares that to what pure chance would give. The gap becomes a z-score and a p-value.

The reported confidence is simply 1 minus the p-value. Two things strengthen a real signal: longer text and a stronger watermark (higher δ, or more tournament layers). Use a wrong detector key in the playground to watch the evidence collapse to chance.

Back to the playground →