A secret key held by the AI lab steers word choice, deliberately choosing less likely words at certain places to allow later detection. The following is a simplified demo.
The highlighted words are where ``` overrode the model's top word choice. Only the key holder can recompute these weights and prove the pattern is there; to everyone else the highlighted words look like ordinary chance, and the watermark is invisible. Click a highlighted word to see the choices it was picked from.
Every steered word changes what comes next, just like real generation. The faintly shaded text after each highlighted word follows from that choice.
For simplicity, in this demo the key only steers six "choice points" in this passage. In reality, AI watermarking uses key-based calculation for every single word.
The g number on each word is its *watermark weight* — how much the key favours it. But the calculation is not simply "highest weight wins", it's in proportion to its probability.
**No key, no watermark.** This is the same passage written with no watermark key involved: the model simply takes its most likely word. There is no watermark for anyone to find later.
A watermark detector gets only the provided text. Each word is scored with the detector's secret watermark key. It re-derives each word's weight from the words in front of it. A real detector does that for every word; this demo does it for the six words at the choice points above. The text scores high only under the key that wrote it. A high score indicates a watermark match.
A single weight proves nothing, because steering only tilts the average. A real detector counts every word in the text, and the average is worth trusting only because the sample is large.
No. The watermark only lives in words the model chose. Deleting a paragraph, reordering sections or trimming a sentence chooses no new words.
Still nothing a watermark detector can use. Those few words may well be the model's, and they may well carry weights under its key. But detection is an average over every scored word in the text, and a handful of words cannot move the average of several hundred.
Yes. The watermark is the word choices the model made, so rewriting the text yourself, or with an AI that does not watermark its output will remove it.
Light editing will not do it. Swap a few words and most of the weights are unchanged, so the average barely moves.
No. Services like Pangram don't have the watermark keys used by AI labs. They've trained on AI output and look for various tells of AI writing to determine if a text is AI generated or not.source & further reading
watermarking.mochi.is — original article