Watermarking LLM text is harder than it looks on paper

The fundamental problem with watermarking AI-generated text is that natural language has too much entropy for a simple "hidden signal" to survive basic editing. If you shift a few synonyms or rewrite a paragraph in a different voice, most current watermarking schemes completely collapse. We are essentially trying to hide a digital fingerprint in a medium that is designed to be fluid and malleable.

The struggle with "Green-listing" tokens

Most current approaches rely on a dynamic "green-list" of tokens. The model is forced to pick words from a specific subset of the vocabulary to create a statistical anomaly that a detector can spot. While this works in a controlled environment, it creates a massive trade-off between detectability and quality. If you make the watermark strong, the prose starts feeling robotic or repetitive because the model is avoiding the most natural next word just to satisfy the watermark requirement.

If you're looking for a practical tutorial on how these systems are actually deployed, it usually looks like this:

1. The LLM generates a candidate list of next tokens.
2. A pseudo-random function (seeded by the previous token) splits the vocabulary into "green" and "red" zones.
3. The model biases the selection toward the green zone.
4. The detector calculates the ratio of green tokens in a sample; if it exceeds a threshold, it's flagged as AI.

The issue is that a human editor—or even another LLM—can easily "wash" this signal. A simple prompt like "rewrite this to be more professional" shifts the token distribution enough to kill the watermark.

Why prompt engineering beats watermarking

From a real-world perspective, I suspect we'll move away from hard-coded watermarks and toward more sophisticated AI workflow signatures. Instead of trying to bake a secret code into the tokens, we might see more metadata-driven verification or "canary" phrases that are subtly woven into the logic of the response.

For anyone trying to build a detection system from scratch, you have to account for these failure points:

• Paraphrasing: Using tools like Quillbot or manual editing.
• Translation loops: Translating text to French and back to English usually erases the watermark.
• Sampling temperature: High temperature settings increase the randomness, making the statistical signal noisier and harder to detect.

We are basically in an arms race. As soon as a robust watermarking standard is released, a prompt engineering trick will likely emerge to bypass it. The only way to truly "mark" AI text is to accept that the signal will be probabilistic, not absolute. It's not about a "yes/no" binary, but rather a confidence score that will always be susceptible to a clever human editor.