Output Watermarking

Bias a model's sampling so its output carries a statistical signature only someone with the key can detect, without changing how the text reads. Then generated text can be identified as generated — which is what platforms, schools and publishers keep asking for and what no detector operating on text alone can reliably provide.

The scheme that made this practical partitions the vocabulary pseudorandomly at each step, seeded by the preceding tokens, and nudges sampling toward one half. Detection counts how often the output landed in the favoured half and computes how unlikely that is by chance, so it needs no model access and no reference text. The strength is a dial: nudge harder and detection needs less text, at the cost of pushing the output further from what the model would have said.

Detection is a hypothesis test whose power grows with the square root of the token count, so short outputs are much harder than long ones and a single sentence is close to undetectable at any usable strength. The other limit is more awkward: paraphrasing removes the signal, and the effort to paraphrase is far below the effort to generate. So the honest claim is a signature that survives copying and not one that survives an adversary.