How Watermarks Track AI Generated Content - Computerphile

Overview

Computerphile discusses how AI-text watermarking can help detect content generated by large language models. The focus is on the technical idea of embedding a watermark in model output without noticeably changing the text.

Key points and arguments

• EU regulation and global adoption: The EU has passed laws requiring major AI companies to watermark their model outputs so generated text can be detected later. The video suggests companies (e.g., Google and others) will likely apply this worldwide for consistent management across regions.

• Watermarking isn’t just anti-plagiarism: The goal is not merely to catch copying. Instead, the aim is to create a detection method that works even when outputs look normal.

Core technical concept: “secret” watermark embedded via token choice

• Watermark = a hidden bias in token selection: Large language models generate text by predicting the next token. Watermarking works by slightly steering which token is chosen using a secret mechanism—so to a human, the text remains fluent and essentially unchanged.

• Security depends on secrecy: Detection relies on a secret key used to recompute watermark-related properties. If the exact mechanism were known, removal would be easier. Therefore, detection is designed to require the company’s secret.

From early red/green partitioning to a more robust approach

• Earlier approaches (red/green partitioning): Some methods split candidate tokens into “red” and “green” sets, then check outcomes later. The video explains drawbacks such as potential distortion of outputs and reliability issues.

• A more sophisticated “tournament” method: The video presents a stronger approach involving:

  • Candidate next tokens processed by a deterministic procedure driven by a secret hash/key and recent context.
  • Output token selection designed to preserve the model’s natural token distribution as much as possible, minimizing quality degradation.
  • Later detection that recomputes token “scores” (e.g., 0/1 outcomes) and checks for statistical bias.

Why detection works

• Statistical test on many tokens: For unwatermarked text, computed scores should average near 0.5 (random-looking).

• Watermarked text shows bias: Since watermarking biases selection toward outcomes tied to “1,” detection checks for a measurable shift above 0.5 across many tokens.

• More text = higher confidence: With enough tokens, the signal strengthens, enabling statistical flagging using confidence/P-value style reasoning.

Evading watermarking: editing/remixing and why it’s hard at scale

• Editing can weaken watermarks: If an attacker alters enough tokens, the context used for watermarking changes, and the detection signal collapses toward randomness.

• EU limits on short texts: The approach does not apply the same confidence threshold for very short passages (e.g., under ~200 tokens), because the statistical signal is unreliable.

• Wholesale removal is costly: The speaker argues that evasion typically requires changing tokens frequently enough to be burdensome and to potentially harm coherence or meaning—making large-scale “parroting” harder to hide.

Implications for “black market” AI systems

• Open-source/local models may not default to watermarking: Because regulation targets major providers, open-source/local models might not include watermarking by default.

• But adoption becomes a numbers game: The video suggests detection could still work if those systems are configured to adopt watermarking; otherwise, it depends on whether watermarking is implemented broadly enough.

Demonstration: implementing watermark detection locally

The host demonstrates running a local model (using Ollama with Qwen 3) and implementing watermarking detection logic in Python.

• Non-watermarked output: Mean scores near 0.5, with no significant statistical deviation.

• Watermarked output: Mean scores above 0.5 with small P-values, indicating suspicious similarity to the watermark scheme.

Watermarking code vs prose

• Code is harder to watermark reliably: Syntax/structure constrains many tokens, leaving fewer choices to bias without breaking correctness.

• Still possible, but detection may be weaker: Code watermarking can work, but confidence may be lower unless the watermark persists across many tokens/files.

• Watermarks may concentrate in comments/identifiers: The host notes watermarking might show up more in places like comments or identifiers rather than mandatory syntax tokens.

Possible attack ideas mentioned (and limitations)

• Emoji insertion/deletion tactic: Example: have the model insert an emoji between every word, then delete emojis later. This disrupts local context used to generate the watermark signal.

• Context-window dependency cuts both ways: If the watermark relies on a specific context window (e.g., last few tokens), removing that structure can help attackers. But changes to token spacing/context can also reduce reliability, and heavy rewriting undermines the goal of clean removal.

Presenters / contributors

• Presenter/Host: Computerphile host (Sean, referred to as “Sean” in the subtitles)
• Mentioned companies/models:
  • EU regulators
  • Google
  • Anthropic
  • OpenAI
  • Anthropic/Google/“Gemini” and “Claude”
  • “Tropic” (named as publishing an article)
• Local tooling / model used in the demo:
  • Ollama
  • Qwen 3