When we hear the term “watermark,” we usually imagine a translucent label over a photograph, a logo on a video, or a barely visible pattern on a document. Text is more complicated. Ordinary text has virtually no free space where information can be added invisibly. Special characters can be detected and removed. An identifier stored in HTML or file metadata disappears after a simple Copy – Paste operation. Unusual spaces, formatting, or fonts can be eliminated simply by passing the text through a plain-text editor.
However, there is a much more interesting approach. Nothing needs to be added to the finished text at all. Instead, the hidden structure is created at the moment the language model chooses its words.
To understand how this works, we need to begin with a much older field of information security: steganography.
What Is Steganography?
Steganography is a method of transmitting information in which not only the contents of a message are hidden but, whenever possible, the very existence of the secret message is concealed. NIST defines steganography as communicating information in a way that conceals the existence of the communication itself, or as embedding one set of data inside another for the purpose of hiding it. This is an important distinction from cryptography. With conventional encryption, an observer may see something like:
9f86d081884c7d659a2feaa0c55ad015...They understand that some data is being transmitted, but they do not know what it contains. Steganography attempts to create a different situation:
Today was a beautiful summer day.
After work, I stopped by the store.
In the evening, I am going to watch a movie.The observer should assume that there is no secret message at all.
NIST defines cryptography somewhat differently: as techniques for transforming information in order to provide confidentiality, integrity, authenticity, and other security properties.
In practice, the two approaches are often combined: an encrypted message is placed inside a steganographic container. As a result, a potential adversary must first determine that a hidden message exists and only then attempt to decrypt it.
A Simple Example of Text Steganography
Consider the sentence:
Be sure to call your brother this evening.We could agree that the presence of a particular word represents bit 1, while its absence represents bit 0. For example: “very good” – 0, “really good” – 1.
A sequence of perfectly natural-looking phrases could therefore encode binary data: 0 1 1 0 1 0 ...
The reader sees ordinary text. A recipient who knows the rule recovers the secret sequence.
This principle – the existence of multiple acceptable ways to express approximately the same meaning – later became extremely important for watermarking text generated by language models.
Steganography Existed Long Before Computers. The idea of hiding messages is very old. Classic examples include invisible ink, messages hidden inside other documents, microdots, selected letters or words in ordinary text, acrostics, and changes in character positioning.
With the emergence of computers, convenient steganographic containers came to include images, audio, video, network traffic, files, and text. Images make the task comparatively easy. A normal photograph contains millions of numerical values. A small change from RGB(154, 83, 201) to RGB(154, 83, 200) will almost certainly be invisible to a human observer.
Images therefore contain a considerable amount of redundancy that can be used to hide information. Ordinary text does not provide this luxury.
Why Hiding Information in Text Is Difficult? Consider the sentence: "It is raining today". Almost every character carries meaning. If a word is misspelled, a reader immediately notices it. If part of the sentence is removed, its meaning changes. If random characters are inserted, they are visible as well.
This is why Krista Bennett noted an important problem with linguistic steganography in her 2004 survey: text must withstand not only statistical analysis by a computer but also inspection by a human reader. Nevertheless, researchers have developed several broad classes of text steganography.
Method No. 1: Text Formatting
One of the oldest digital techniques is to encode information in the visual appearance of a document.
The following properties can be modified slightly: spacing between words, line spacing, character position, space width, font size, font style, and kerning.
For example: normal spacing – 0, slightly increased spacing – 1. Visually, the document barely changes. However, this method has an obvious weakness. If the text is copied and pasted without formatting, the hidden information may disappear. Surveys of text steganography therefore describe line/word shifting techniques as poorly resistant to structural transformations of digital text.
Method No. 2: Invisible Unicode Characters
Unicode contains characters that may be present inside a string while remaining virtually invisible.
For example:
U+200C – Zero Width Non-Joiner
U+200D – Zero Width Joiner
There are other special Unicode control characters as well.
We could agree that:
U+200C – 0;
U+200D – 1.
A sequence of invisible characters can then be inserted after ordinary letters. To a human reader:
Hello worldand:
Hello[ZWJ][ZWNJ][ZWJ][ZWJ] worldmay appear identical. A program, however, could recover:
1 0 1 1Such techniques have indeed been researched and used for text steganography. The literature describes schemes involving Zero Width Characters, Zero Width Joiners, and Zero Width Non-Joiners.
Zero-width steganography has also been considered as a practical covert communication mechanism in cyberattacks. However, this technique is not particularly suitable for robust text watermarking because removing unusual Unicode characters destroys the hidden channel.
This is why Anthropic specifically emphasizes that Claude’s text watermark does not use hidden characters.
Method No. 3: Look-Alike Characters
Another approach uses visually similar characters from different writing systems.
For example, the Latin character “a” and visually similar characters from other alphabets may be nearly indistinguishable to a human observer. We could define:
variant A – 0;
variant B – 1.
A human reader may not notice the difference, but a computer sees different Unicode code points. This technique is also relatively easy to detect programmatically and does not survive text normalization particularly well.
Method No. 4: Linguistic Steganography
Much more interesting techniques do not use hidden characters at all. Instead, they modify the language itself. For example:
fast;
quick;
rapid.
In some contexts these words can express very similar meanings. A system could define:
fast – 0;
quick – 1.
The sentence “He made a fast decision” could encode one value, while “He made a quick decision” could encode another. Real algorithms are obviously far more sophisticated because synonyms are rarely completely interchangeable. Research into natural-language watermarking has also explored synonym substitution, word order, syntactic transformations, morphological variants, and sentence structure.
As early as 2005, Topkara, Taskiran, and Delp distinguished natural-language watermarking from techniques that merely changed the appearance of letters and lines. They proposed using sentence structure itself as a carrier of hidden information.
Later work also investigated morphosyntactic transformations – changes to morphology and syntax that preserve the meaning of the text.
Method No. 5: Generative Linguistic Steganography
The emergence of neural language models introduced an entirely new approach. Instead of taking finished text and hiding information by modifying it, a system can generate the text in such a way that the process of selecting words itself encodes secret data. This is already very close to what modern large language models do when watermarking their outputs.
In Neural Linguistic Steganography (2019), Zachary Ziegler, Yuntian Deng, and Alexander Rush proposed combining a neural language model with arithmetic coding. Secret bits influenced the selection of the next token while the authors attempted to keep the generated text distribution close to the language model’s normal distribution.
In 2020, Shen, Ji, and Han developed a similar idea in Near-imperceptible Neural Linguistic Steganography via Self-Adjusting Arithmetic Coding. In their method, the secret message was encoded directly during the generation of the cover text.
How Steganography Differs from Text Watermarking
Steganography and text watermarking use very similar mathematical ideas, but they generally pursue different goals. With steganography, the goal is to transmit some secret message. For example: “Meet at 18:00” could first be represented as binary data: “01010011 01100101 ...” and those bits could then be hidden inside another text. Text watermarking usually serves a different purpose. It does not necessarily need to transmit a complete message. It is sufficient to embed a persistent signal such as: This text was generated by model X. The following illustration provides a visual comparison between steganography and text watermarking.
From a research perspective, the boundary between the two areas is not absolute. The ACL Tutorial 2024 explicitly describes text watermarking as a direction within linguistic steganography in which a hidden watermark message is embedded into a piece of text. For practical purposes, however, it is useful to remember that the primary goal of steganography is covert information transfer, while the primary goal of text watermarking is provenance and identification.
Watermarking LLM-Generated Text Can Be Considered a Modern Form of Steganography. Consider a simple example. Suppose a model wants to write: “It was a cold ____ day outside”. The model considers several acceptable continuations: overcast, gray, gloomy, rainy. Every word is perfectly natural. If a special algorithm controls which acceptable continuation is selected, the selection itself can carry hidden information. For example:
overcast – group 1;
gray – group 0.
Modern systems such as SynthID-Text are considerably more sophisticated. They do not insert a literal message such as “generated by Claude” into the text, nor do they encode a user identifier. Instead, they create a statistical correlation between the sequence of selected tokens and a secret watermark key. Anthropic, for example, emphasizes that Claude’s text watermark adds nothing visible to the text, uses no hidden characters, and contains no identifying information about the user, organization, or individual conversation. The relationship between these techniques can therefore be illustrated as an evolution from classical steganography to linguistic steganography, generative linguistic steganography, and modern LLM watermarking. Now we can examine how watermarking is actually performed during language-model generation.
How a Neural Network Generates Text
A large language model does not write an entire sentence at once. It generates text sequentially, token by token and word by word. For example, the model receives: “The capital of Germany is –”. After processing the text, it calculates scores for all possible next tokens. A simplified distribution might look like this:
Berlin – 99.90%;
Munich – 0.04%;
Hamburg – 0.03%;
Frankfurt – 0.01%.
The raw values inside the model are called logits. After applying the softmax function, these logits become a probability distribution. If the system always chooses the most probable token, this is known as greedy decoding. Modern language models, however, frequently use probabilistic sampling techniques such as temperature, top-k, and top-p. This means that the model is not required to choose the token with the highest probability. Suppose the sentence is: “Today is a cold and ___ day”. The model might assign:
gray – 45%;
overcast – 40%;
gloomy – 10%;
cloudy – 5%.
Both: “Today is a cold and gray day.” and: “Today is a cold and overcast day.” may be perfectly good continuations. This freedom of choice creates room for text watermarking. Sebastian Raschka explains this transition from ordinary token sampling to watermark sampling in How Claude Watermarks AI-Generated Text, which provides much of the conceptual foundation for the discussion below.
The Watermark Is Hidden in Randomness
Imagine that a text contains many positions in which the model can choose between several approximately equivalent alternatives:
overcast / gray;
light / mild;
moves / blows;
quiet / calm;
home / residence;
book / novel.
A single choice means nothing. But the number of possible combinations quickly becomes enormous.
With 20 independent binary choices: 2²⁰ = 1,048,576. With 100 such choices: 2¹⁰⁰ ≈ 1.27 × 10³⁰. There is therefore an astronomical number of slightly different but perfectly natural texts. A watermark can control part of these choices using a secret key. Each individual selection still looks natural. But hundreds of selections together begin to show a statistical correlation with the secret key. That is how the watermark appears.
What Do Pseudorandom Numbers Have to Do with It?
A computer can generate reproducible pseudorandom sequences. For example, a seed value of 42 may define a particular pseudorandom sequence. If the same seed is used again, the same sequence is reproduced.Ordinary sampling can be simplified conceptually as a process in which the model’s token probabilities are combined with a source of randomness to select the next token.
With watermarking, that source of randomness becomes tied to a secret. A fixed seed is only a teaching analogy. A real system uses changing context. For example: key: K, context: “The weather today is very”, seed₁ = HASH(K || context). The model chooses “overcast.” The context now becomes: The weather today is very overcast. The next state is: seed₂ = HASH(K || new context). The algorithm therefore obtains a different pseudorandom state.
In SynthID-Text, the random seed generator can indeed incorporate the previous text together with the watermark key.
Green and Red Tokens
One of the key early papers in this field is A Watermark for Large Language Models, ICML 2023, by John Kirchenbauer et al. The algorithm pseudorandomly divides the vocabulary into two parts: a green list, a red list. It then slightly increases the probabilities of tokens from the green list. For example, before watermarking:
overcast – 40%;
gray – 38%.
After applying a small bias:
overcast – 46%;
gray – 33%.
A red-list token can still be selected. Green-list tokens simply appear slightly more often than they would under ordinary random sampling.
Detecting a Green-List Watermark
Suppose the algorithm places half the vocabulary in the green list. For ordinary text, we would expect approximately: 50% green-list tokens, 50% red-list tokens. In watermarked text, however, we may systematically observe a higher percentage of green-list tokens. A Z-score is used to determine how unusual this deviation is:
Here: T is the number of analyzed tokens, G is the number of green-list tokens, γ is the expected proportion of green-list tokens, z measures how far the observation deviates from the expected value.
Consider: T = 100, γ = 0.5, G = 75. The expected number of green tokens is: 0.5 × 100 = 50. The difference is: 75 − 50 = 25. The denominator is: √(100 × 0.5 × 0.5) = 5. Therefore: z = 25 / 5 = 5.
The number of green-list tokens is five standard deviations above the expected random value. That is an extremely strong statistical anomaly. The watermark is therefore detected through statistical testing rather than by searching for a special character.
The disadvantage of the green-list method is that token probabilities are intentionally changed. Researchers therefore began looking for methods that could embed a watermark without altering the final text distribution, or while minimizing such distortion.
Distortion-Free Watermarking
The next important question is: Can a watermark be hidden inside the sampling process without making the resulting text distribution statistically distinguishable from the original distribution? Several research groups have investigated this problem.
Miranda Christ, Sam Gunn, and Or Zamir formalized a cryptographic version of this requirement in Undetectable Watermarks for Language Models. Without the secret key, the watermarked distribution should be computationally indistinguishable from the ordinary distribution. A key holder, however, must still be able to detect the watermark. The authors constructed such a scheme under the standard cryptographic assumption that one-way functions exist.
Kuditipudi, Thickstun, Hashimoto, and Liang proposed Robust Distortion-Free Watermarks for Language Models. Their approach uses pseudorandom sequences during text generation. A detector that knows the key compares the observed token sequence with the same pseudorandom sequence. The authors used two sampling mechanisms:
Inverse Transform Sampling;
Exponential Minimum Sampling.
Research of this kind led to the modern idea that a watermark should be embedded not so much in “special words” as in controlled randomness during sampling.
Entropy Is the Main Limitation of Watermarking. A watermark can only be embedded where the model genuinely has a choice. Consider: “What is the capital of France?”. The answer “Paris” may have a probability approaching 100%. The model cannot answer “Berlin” merely to satisfy the watermark. This is a low-entropy situation. Now consider: “Describe a calm autumn evening”. Possible continuations include:
quiet;
cool;
rainy;
overcast;
golden;
gloomy;
cozy.
The model has much more freedom. Consequently, greater entropy provides more room for text watermarking. Watermark detectability also depends on text length and the entropy of the token distribution. Google’s experiments reported in the SynthID-Text paper likewise show that detectability varies with the model’s entropy settings.
A watermark is a statistical signal. If a coin is flipped three times and gives the same result each time, that alone does not prove the coin is biased. If the same statistical bias is observed hundreds of times, confidence becomes much greater. The same principle applies to language models. Ten tokens provide very little evidence; one hundred tokens provide considerably more. Long texts are therefore generally much easier to analyze for watermarking.
SynthID-Text and Tournament Sampling
Google DeepMind introduced SynthID-Text in Sumanth Dathathri et al. – Scalable watermarking for identifying large language model outputs, published in Nature in 2024.
Anthropic selected SynthID-Text as the basis for Claude’s text watermarking. The main feature of the method is Tournament Sampling.
How the Token Tournament Works? Suppose the LLM produces the following distribution for: “Today is a cold and ___ day.” is
gray – 50%;
overcast – 30%;
gloomy – 15%;
cloudy – 5%.
SynthID does not simply choose the token with the highest probability. Instead, multiple candidates are first sampled from the model’s original probability distribution. A token such as “gray” appears frequently among the candidates precisely because the original model assigned it a probability of 50%. The knowledge of the LLM is therefore preserved.
The tournament then begins. Several pseudorandom functions are calculated for each candidate: g₁, g₂, g₃ ... gₘ. They depend on the watermark key, the context, and the token. In a simple explanation, each function can produce either 0 or 1. For example, “gray” might receive: g₁ = 1, g₂ = 0, g₃ = 1 giving: 101. Another token such as “overcast” might receive: 010. The SynthID-Text paper describes precisely such a set of pseudorandom watermarking functions used across different Tournament Sampling rounds.
For m tournament layers, the system initially samples: 2ᵐ candidates.
If m = 3, then 2³ = 8. The candidates are paired: A ↔ B, C ↔ D, E ↔ F, G ↔ H. The first round uses g₁. The candidate with the larger value wins each pair.
Second Tournament Round. Four candidates remain: A ↔ C, E ↔ G. The algorithm now uses g₂. Two candidates remain.
Final Round. The last pair is compared using g₃. The winner becomes the next output token. This is Tournament Sampling.
Why the Model Still Produces Normal Text? Tournament participants are not selected randomly from the entire vocabulary. They are first sampled from the LLM’s genuine next-token probability distribution. If the correct token has a probability of 90%, it will appear among the candidates very frequently. If a meaningless token has a probability of approximately 0.000001%, it will almost never appear.
The watermark therefore does not instruct the model to use secret or unusual words. Instead, it influences how uncertainty is resolved among alternatives that the model already considers valid.
How SynthID-Text Is Detected
The detector analyzes the finished text and recalculates the watermark functions. For every token xₜ, the context and secret key are used to reconstruct rₜ. The detector then calculates: g₁(xₜ, rₜ), g₂(xₜ, rₜ) ... gₘ(xₜ, rₜ). The values are then aggregated. The score can be understood as the sum of all g values divided by the total number of measurements.
Here: T is the number of analyzed tokens, m is the number of watermark functions, g is the pseudorandom score assigned to a particular token in a particular round. In other words, it is the average watermark score.
Suppose: T = 100, m = 3. The detector receives: 100 × 3 = 300 individual g values. If ordinary text should average around 0.5, while watermarked sampling systematically favors higher g values, the average score begins to move upward. In mathematical form:
Here: T is the total number of tokens in the analyzed text, m is the number of independent binary watermark functions, gₗ(tᵢ, rᵢ) is the pseudorandom watermark function for layer l.
The calculation can be understood as follows:
Calculate the g values for all tokens.
Sum them.
Divide by the total number of calculated values.
Compare the result with the distribution expected for non-watermarked text.
The original detection scheme is described in the paper and uses a Bayesian detector. It considers more than a simple arithmetic mean, taking the probability distribution into account to reduce false positives for common and highly predictable phrases. Importantly, detection does not require rerunning the large LLM itself. This is one of the major practical advantages of SynthID-Text.
The whole generation and detection process can be visualized as an enormous tree in which every branch represents a possible next token. An ordinary LLM moves through the tree according to probability. A watermarked LLM follows the same tree, but when several acceptable paths exist, a secret pseudorandom function influences the selection. The resulting text looks ordinary. The detector examines the path that was taken and asks how frequently the model selected branches favored by the secret-key-based selection function. That is the essence of statistical LLM watermarking.
Consider a token with a watermark pattern of: 101. It received two ones out of three. But a completely random token can easily receive: 111 or 000. A single token therefore proves nothing. What matters is the statistics of many decisions. If hundreds of decisions consistently correlate with the secret watermark functions, the probability of a random coincidence becomes increasingly small.
Detection Does Not Answer the Question “Was This Text Written by AI?” This distinction is extremely important. The detector answers a much narrower question: Are the statistics of this text compatible with a known watermark key? It does not prove that the entire text was written by AI, that a human did not edit it, that another model was not involved, that the text is plagiarism, or that the use of AI violated any policy.
Anthropic, for example, describes watermarking as a way to estimate the likelihood that Claude participated in producing a text, rather than as universal proof of AI authorship.
The Absence of a Watermark Proves Nothing Either. A text may have been generated by another language model, generated by a model without watermarking, produced by an older model version, heavily rewritten, translated, paraphrased, or simply be too short for reliable detection.
Thus, finding a watermark is not 100% proof of provenance. Likewise, failing to find a watermark is not proof of human authorship.
Watermark Detection Is Not the Same as AI Detection. A conventional AI detector attempts to identify statistical characteristics of machine-generated text, such as style, syntax, and vocabulary. It effectively asks: Does this text look like something AI would normally generate? A watermark detector has access to a secret associated with the generation process. It asks: Does this text match a statistical pattern that the generator deliberately embedded while selecting tokens? These are fundamentally different tasks.
Does Watermarking Affect Text Quality?
Watermarking involves a natural trade-off. The stronger the watermark and the easier it is to detect, the greater the possibility that the sampling process will be distorted and text quality will suffer.
SynthID-Text supports both distortionary and non-distortionary configurations. In the paper, the authors conducted a production experiment involving approximately 20 million Gemini responses. Differences in user feedback between watermarked and non-watermarked responses were extremely small: approximately 0.01 percentage points for thumbs-up and 0.02 percentage points for thumbs-down. The researchers did not observe a practical degradation in quality in that experiment.
What Happens When the Text Is Modified?
Ordinary copying does not change the watermark. The watermark is not stored in metadata or modified characters. It is present in the sequence of selected tokens. Therefore, copying the text preserves the relevant sequence. This is fundamentally different from steganographic techniques based on formatting or special Unicode characters.
Editing, however, gradually damages the signal. Consider: The weather was cold and gray. If a human replaces “gray” with “overcast,” one token has effectively been changed. If subsequent watermark states depend on previous context, this modification may also affect the expected watermark values of later positions. Nevertheless, in a sufficiently long text, a few changes may not destroy the overall statistical signal.
Full rewriting is much more damaging. Original: Today the weather is cold and overcast. A light breeze moves through the trees. Paraphrased: The afternoon turned out cool and cloudy, while a gentle wind moved between the trees. The meaning remains similar, but the tokens are entirely different.Token-level watermarks may therefore weaken substantially.
Sadasivan et al. studied recursive paraphrasing and showed that it can significantly reduce the effectiveness of various AI detectors, including watermark-based techniques.However, robustness depends on the specific watermarking method.
Kuditipudi et al., for example, experimentally demonstrated watermark detection for OPT-1.3B and LLaMA-7B after random modification of roughly 40–50% of tokens under their particular experimental conditions. For Alpaca-7B, detection was considerably more difficult because of lower output entropy.
It is therefore incorrect to claim either that replacing one word is enough to remove a watermark or that a watermark is impossible to remove. Both claims oversimplify the problem.
Semantic Watermarking
To improve resistance to paraphrasing, researchers have attempted to move watermarking above the individual-token level. For example, SemStamp operates on semantic sentence representations. Instead of requiring specific words, the system can attempt to place a sentence into a particular region of semantic space. Because paraphrasing often preserves meaning, this type of signal can potentially survive word substitution more effectively. SemStamp was specifically designed to improve the paraphrastic robustness of token-level watermarks. A related direction is used by SemaMark, where watermarking is tied to the semantics of the preceding text rather than simply hashing previous tokens.
Watermark Stealing
Another problem appears when the API of a watermarked model is publicly accessible. An attacker can repeatedly query the model using many prompts and analyze statistical patterns in the responses. In Watermark Stealing in Large Language Models, Jovanović, Staab, and Vechev demonstrated that some watermarking schemes can be approximately reverse-engineered through repeated API queries. This enables two types of attack:
Scrubbing – modifying a watermarked text so that the detector no longer identifies the watermark.
Spoofing – artificially adding a similar statistical signal to text that was not generated by the watermarked model, causing the detector to classify it as watermarked.
In their experiments, the authors reported an average success rate above 80% against the evaluated watermarking schemes under certain conditions. A Watermark Is Not a Digital Signature. This is an extremely important distinction. A digital signature provides strong cryptographic evidence that specific data was signed using the corresponding key. A statistical text watermark means something weaker: the statistical properties of the text are sufficiently consistent with a known watermarking process. A watermark is therefore a probabilistic indicator, not a strict cryptographic signature over a particular sequence of bytes.
Why Is Watermarking Being Deployed Now?
One reason for the current practical deployment of AI-generated text watermarking – and for the renewed interest in the subject – is the European AI Act. The transparency obligations of Article 50 apply from 2 August 2026. The European Commission explains that providers of relevant generative AI systems must add machine-readable markings that make it possible to identify AI-generated or AI-manipulated content.
Anthropic explicitly links the deployment of Claude’s text watermarking to these requirements. The technology itself, however, predates the legislation. Research into green-list watermarking, distortion-free sampling, and cryptographic watermarking had already been underway during 2022–2024.
Conclusion
LLM watermarking does not rely on a special character that can be found by searching the text.
There is no hidden string and no required metadata.
Instead, watermarking takes advantage of a natural property of language models: in many situations, several continuations are simultaneously acceptable. A secret watermark key influences the choice among these alternatives. One decision proves nothing, but hundreds or thousands of small decisions create a statistical pattern. Historically, this is closely related to linguistic steganography, in which secret information could be hidden in word choices, synonyms, sentence structure, morphology, or word order.
Neural language models enabled the next step: rather than modifying an existing text, the model can generate the text while simultaneously encoding a hidden signal. Modern LLM watermarking systems such as SynthID-Text take this idea even further. They use secret keys, pseudorandom functions, and controlled sampling to leave a statistical trace in the token sequence itself. The trace is invisible to a human reader, survives ordinary copying, and can be detected without rerunning the language model. But it is not absolute proof of provenance. A watermark may be weak in short or low-entropy text, may be damaged by editing, may be degraded by paraphrasing, and may become the target of specialized attacks such as watermark stealing.
The most accurate way to think about LLM watermarking is therefore as a cryptographically controlled statistical steganographic provenance marker embedded in generated text. It is not a universal AI detector and not a digital signature. It is a hidden statistical signal deliberately left by the model during token selection.
Links
John Kirchenbauer et al. — A Watermark for Large Language Models, ICML 2023
Miranda Christ, Sam Gunn, Or Zamir — Undetectable Watermarks for Language Models, COLT 2024
Rohith Kuditipudi et al. — Robust Distortion-Free Watermarks for Language Models, TMLR 2024
Zachary Ziegler, Yuntian Deng, Alexander Rush — Neural Linguistic Steganography, 2019
Vinu Sankar Sadasivan et al. — Can AI-Generated Text be Reliably Detected?
Abe Hou et al. — SemStamp, NAACL 2024
Xuandong Zhao, Yu-Xiang Wang, Lei Li — Watermarking for Large Language Models, ACL 2024
If this guide was useful, share it with colleagues and send any corrections or questions.
Reproducing this material on another website without the author’s permission is prohibited.