Text Watermarking, Playable

EP 01

A secret coin flip for every word in the dictionary

The trick starts before any bias: hash the previous word together with each candidate, and the hash splits the whole vocabulary into a green list and a red list — roughly half and half. Crucially, the split reshuffles for every context. Pick a previous word below and watch this model's real vocabulary re-deal itself.

previous word:

The hash is public math but keyed by a secret — without the key, green and red words are statistically indistinguishable from any other half-split.

Why hash on context: if the green list were fixed, anyone could reverse it from a few samples, and the “green words” would read oddly often. Re-dealing per context makes the mark invisible in any single position — it only exists as a statistic across many words.

EP 02

Write with the thumb on the scale

Now generation: at each step the model computes its normal probabilities, then multiplies every green candidate by e^δ before sampling. Slide the strength δ and generate — green-list words are highlighted. Watch two live meters fight: the green ratio climbs, and the share of picks that were still the model's natural first choice falls.

Strength δ 2.0

Set δ and generate.

The dial nobody escapes: δ ≈ 2 marks the text while barely touching quality — the good case. Crank δ to 6 and the model picks green words because they're green, not because they fit: detectability bought with fluency. Real deployments live on exactly this trade-off curve.

EP 03

The detector — counting a loaded coin

Detection needs no model, no AI — just the key. Re-derive each word's green/red flag from its predecessor and count: unmarked text should be ~50% green, like fair coin flips. The detector turns the excess into a z-score and a p-value (the chance a fair coin looks this loaded). Generate both kinds of text and compare.

Generate something, then read the verdict.

Why this beats “AI-detector” classifiers: those guess from style and get fooled constantly. A watermark detector does a hypothesis test with math you can audit — on long marked text its false-positive rate is a number you choose, not a vibe.

EP 04

Too short to catch — the sample-size wall

A loaded coin flipped 8 times looks like luck; flipped 200 times it confesses. The chart below is computed live: for each length, this page generates 36 watermarked texts and 36 unmarked ones and plots the average detection z-score. Drag the slider along the curve and watch the catch-rate meter — short texts simply do not carry enough statistical signal.

Text length

Detection threshold: z > 2.33, i.e. p < 0.01. Every point is a fresh simulation in your browser — numbers wobble run to run, exactly like real statistics.

The honest limit: a tweet-length answer is nearly unwatermarkable at reasonable strength — the math needs tokens like a survey needs respondents. This is why watermark papers report detection power per length, and why “was this one sentence AI?” may stay unanswerable forever.

EP 05

The paraphrase attack — washing off the ink

The signature lives in exact word choices — so change the words. Below, a watermarked text (δ = 3) starts fully detectable. Drag the attack slider to swap words for synonyms (swaps shown in red). Every swap re-rolls that word's coin and its successor's, since the hash keys on the previous word. Watch the z-score bleed out in real time.

Paraphrase strength 0%

The arms race: a human editor — or another, unwatermarked model asked to “rewrite this” — destroys the signal without understanding it exists. Watermarks prove a text came straight from a model; they cannot prove a text didn't. That asymmetry is the fine print on every “AI detection” promise.