Watermarking LLM text is harder than it looks on paper

The struggle with "Green-listing" tokens #

Most current approaches rely on a dynamic "green-list" of tokens. The model is forced to pick words from a specific subset of the vocabulary to create a statistical anomaly that a detector can spot. While this works in a controlled environment, it creates a massive trade-off between detectability and quality. If you make the watermark strong, the prose starts feeling robotic or repetitive because the model is avoiding the most natural next word just to satisfy the watermark requirement.

If you're looking for a practical tutorial on how these systems are actually deployed, it usually looks like this:

1. The LLM generates a candidate list of next tokens.

2. A pseudo-random function (seeded by the previous token) splits the vocabulary into "green" and "red" zones.

3. The model biases the selection toward the green zone.

4. The detector calculates the ratio of green tokens in a sample; if it exceeds a threshold, it's flagged as AI.

The issue is that a human editor—or even another LLM—can easily "wash" this signal. A simple prompt like "rewrite this to be more professional" shifts the token distribution enough to kill the watermark.

Why prompt engineering beats watermarking #

From a real-world perspective, I suspect we'll move away from hard-coded watermarks and toward more sophisticated AI workflow signatures. Instead of trying to bake a secret code into the tokens, we might see more metadata-driven verification or "canary" phrases that are subtly woven into the logic of the response.

For anyone trying to build a detection system from scratch, you have to account for these failure points:

Paraphrasing: Using tools like Quillbot or manual editing.Translation loops: Translating text to French and back to English usually erases the watermark.Sampling temperature: High temperature settings increase the randomness, making the statistical signal noisier and harder to detect.

We are basically in an arms race. As soon as a robust watermarking standard is released, a prompt engineering trick will likely emerge to bypass it. The only way to truly "mark" AI text is to accept that the signal will be probabilistic, not absolute. It's not about a "yes/no" binary, but rather a confidence score that will always be susceptible to a clever human editor.

Codex weekly limits are disappearing way too fast for me 8h ago

Anthropic is fighting the invisible watermark war 5d ago Why text AI watermarks are essentially useless for detection 7d ago

Stop thinking of temperature as a "creativity slider" for your 10d ago

Databricks just cut their AI coding costs by 70% and it's a 10d ago

DeepSeek Pricing Shift: Is the Low-Cost Era Ending? 11d ago Next AI is making every side project feel like meaningless slop →