Token Probability Watermarking

The watermark sits between the model's probability distribution and the token it finally outputs. It changes selection behavior, not the visible formatting of the finished paragraph.

DeepMind Technologies Limited filed a patent on March 20, 2024 describing exactly that for text, working in a succession of stages, each using its own pseudorandom function keyed to the preceding tokens and the candidate token, which preserves the output distribution in expectation while still leaving a statistically detectable trace. The patent never uses the word SynthID anywhere, though its inventor list is near-identical to the text-watermarking team DeepMind's own SynthID blog post credits.

That's part of why it survives copy-paste in a way a hidden character would not. There's no separate layer to strip, so normalizing the text or editing a metadata field does nothing to it.

Scoring the resulting pattern is a separate job, done later by whoever holds the key. This page is about the writing side.

Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's 2023 paper is the reference point, cited by nearly a thousand later papers. It proposes splitting a model's vocabulary into a green sublist and a red sublist before each token is generated.

The split is pseudorandom, seeded by the tokens that came just before it, so it shifts constantly through a document rather than staying fixed in place.

Sampling is then softly biased toward the green list. One token barely shows the effect, but a detector that knows the seeding rule can count how often word choices land in green versus red and run a statistical test on that ratio.

A later paper by some of the same authors found the signal held up after strong human paraphrasing once a detector could see roughly 800 tokens, at a false-positive rate of one in 100,000.

Not every scheme works by tilting the odds toward a green list. Kuditipudi, Thickstun, Hashimoto, and Liang proposed a different construction: generate text by mapping a secret sequence of pseudorandom numbers, derived from a watermark key, through the sampling procedure itself.

The model's overall output distribution comes out mathematically unchanged. No word is biased over another, and a detector that knows the key can still recover the watermark later.

The tradeoff moves rather than disappears. Robustness now depends on how much text survives editing relative to a length-based budget, not on how strongly word choices got tilted.

Zhao, Ananth, Li, and Wang went the other direction with Unigram-Watermark. They fix the green/red split so it stays constant across every token position instead of re-randomizing per token, and prove that makes the watermark robust to bounded editing and paraphrasing with guaranteed detection correctness.

Three properties are in tension in every one of these designs: detectability, text quality, and edit tolerance. Each scheme picks a different corner.

Google's own production example works on the same underlying principle but places the nudge later in the pipeline, after Top-K and Top-P sampling have already narrowed the candidate pool. The Nature paper behind it describes a tournament-sampling design.

Google says the tool is open sourced for developers and that detection is score-based. A detector checks whether a passage's token choices match the configured pattern more often than chance would predict.

Google also says detector confidence can be greatly reduced by thorough rewriting or translation, while describing the scheme as robust to mild paraphrasing, for the Gemini app and web experience specifically. Whether the Gemini API applies the same watermarking is disputed in a Google-affiliated developer-forum reply, not settled by a primary source.

A March 2026 preprint pushes directly on a generation-side parameter. It proves that SynthID-Text's mean-scoring detection method becomes more vulnerable as the number of tournament sampling layers increases, demonstrates a matching attack, and shows the alternative Bayesian scoring method is provably more robust to that layer manipulation.

The green-list idea has a structural weak point. The split has to be reproducible by a detector, which means it follows a rule, and rules can sometimes be inferred from outside.

A 2024 ICML paper from ETH Zurich's SRI Lab showed exactly that. An attacker querying a provider's public API for under $50 total can approximate the secret green/red splitting rule closely enough to use it.

With that stolen approximation, the same researchers ran two attacks:

• Spoofing: forging the watermark onto text the attacker wrote entirely themselves, succeeding more than 80% of the time with their strongest method.
• Scrubbing: removing a real watermark from genuinely watermarked text, jumping from near 0% success to over 85%, in settings the original scheme's authors had assumed were safe.

Follow-up work complicates the picture in both directions. A 2025 ICLR paper showed a deployed scheme's family can be identified from limited black-box queries alone, evidence these schemes are more fingerprintable than assumed.

A separate 2025 paper from the same researchers built a statistical test that reliably tells genuinely watermarked text apart from text spoofed via a stolen rule. Today's spoofing attacks, including their own, leave detectable artifacts a defender can catch.

When Anthropic announced that Claude embeds invisible watermarks in text output along with signed metadata on files, the recurring question in the r/singularity thread was simply how that works for text. Most people already understand image watermarks. Text isn't pixels.

Commenters guessed:

• Hidden Unicode or invisible characters
• Statistical word-choice patterns
• Overrepresented n-grams
• First-letter or sentence-position patterns
• Token-probability nudges like the ones described above
• A SynthID-like scheme, or a hybrid of several signals at once

None of these are confirmed. Anthropic's own announcement does not name a mechanism, so every theory above, including the token-probability one this page is about, is inference by analogy to Google's public work rather than a disclosed method.

The same thread raised a fair worry that stays genuinely unresolved anywhere in this space. Nudging token probabilities in prose changes a turn of phrase; nudging them in code could mean a different variable name, a flipped operator, or a broken build.