statistical watermarking
**Statistical watermarking** embeds detectable patterns into the **token probability distribution** during text generation by language models. The technique modifies how tokens are sampled without noticeably changing output quality, creating a **statistical fingerprint** that authorized verifiers can detect.
**How It Works (Kirchenbauer et al., 2023)**
- **Vocabulary Partitioning**: For each token position, use a **hash of preceding tokens** to partition the vocabulary into "green" (preferred) and "red" (avoided) lists.
- **Biased Sampling**: During generation, add a bias $\delta$ to green token logits, making them more likely to be sampled.
- **Detection**: Given a text, recompute the green/red partitions using the same hash function and count green tokens. A statistically significant excess of green tokens (measured by **z-score**) indicates watermarking.
**Watermark Variants**
- **Hard Watermark**: Only allow green token selection — strongest signal but may reduce text quality, especially when the best token is red.
- **Soft Watermark**: Add a bias $\delta$ to green token logits — softer impact on quality while maintaining detectability.
- **Multi-Key Schemes**: Rotate hash functions or use multiple keys to increase security and prevent reverse-engineering.
- **Distortion-Free**: Use shared randomness (e.g., random sampling reordering) to maintain the **exact original distribution** while enabling detection. No quality degradation at all.
**Detection Mathematics**
- **Null Hypothesis**: Text is not watermarked — green tokens appear at the expected rate (~50%).
- **Test Statistic**: $z = (|s|_G - T/2) / \sqrt{T/4}$ where $|s|_G$ is the count of green tokens and $T$ is total tokens.
- **Decision**: If $z$ exceeds a threshold (e.g., $z > 4$), reject the null hypothesis — text is watermarked.
- **Minimum Length**: Reliable detection requires sufficient text length — typically 200+ tokens for high confidence.
**Key Trade-Offs**
- **Strength vs. Quality**: Larger bias $\delta$ makes watermarks easier to detect but may reduce text naturalness.
- **Robustness vs. Detectability**: Stronger patterns survive more modifications but are easier for adversaries to detect and exploit.
- **Context Window**: Longer hash windows (more preceding tokens) create stronger watermarks but increase sensitivity to text modifications.
**Robustness Challenges**
- **Paraphrasing Attacks**: Rewriting text with different words can disrupt token-level patterns.
- **Token Editing**: Inserting, deleting, or substituting tokens breaks the hash chain.
- **Cross-Model Transfer**: Watermarked text copied and regenerated by another model loses the watermark.
- **Short Texts**: Detection reliability decreases for short passages due to insufficient statistical signal.
Statistical watermarking is the **most studied text watermarking approach** — it provides mathematical guarantees on detection confidence and has been adopted by major AI labs as a potential tool for responsible AI content generation.