Watermarking LLM text proves far more difficult than theoretical models suggest.

The core difficulty in watermarking AI-generated text lies in the high entropy of natural language, which prevents simple hidden signals from surviving basic edits. Shifting synonyms or altering a paragraph’s voice causes most current watermarking schemes to collapse. We are attempting to embed a digital fingerprint into a medium defined by its fluidity and malleability.

The struggle with green-listing tokens

How do dynamic green-list token systems work?

Most existing approaches use a dynamic green-list of tokens. Forcing the model to select words from a specific vocabulary subset creates a statistical anomaly that detectors can identify. This works in controlled settings but forces a massive trade-off between quality and detectability. Strong watermarks produce robotic or repetitive prose because the model avoids natural word choices to satisfy the watermark requirements.

Practical deployment usually follows this pattern:

1. The LLM generates a candidate list of next tokens.
2. A pseudo-random function seeded by the previous token splits the vocabulary into green and red zones.
3. The model biases selection toward the green zone.
4. The detector calculates the ratio of green tokens in a sample; if it exceeds a threshold, it is flagged as AI.

Can human editors easily remove watermarks?

A human editor or even another LLM can easily wash this signal. A prompt such as rewrite this to be more professional shifts the token distribution enough to destroy the watermark.

Why prompt engineering beats watermarking

In a real-world context, I suspect we will move away from hard-coded watermarks in favor of sophisticated AI workflow signatures. Rather than baking secret codes into tokens, we may see metadata-driven verification or canary phrases woven into the response logic.

What are the primary failure points in detection?

Building a detection system from scratch requires accounting for these specific failure points:

Paraphrasing: Using manual editing or tools like Quillbot.

Translation loops: Translating text to French and back to English usually erases the watermark.

Sampling temperature: High temperature settings increase randomness, making the statistical signal noisier and harder to detect.

We are in an arms race. Once a robust watermarking standard is released, a prompt engineering trick will likely emerge to bypass it. Truly marking AI text requires accepting that the signal will be probabilistic rather than absolute. It is not a binary yes/no, but a confidence score that remains susceptible to a clever human editor.