How Text Watermarks Work: Green-List Schemes and the Robustness-Quality Trade-off

A text watermark has to solve a delicate problem: change the model's output enough that a hidden signal is reliably detectable, but not so much that the text gets noticeably worse. The elegant answer, from Kirchenbauer and colleagues, is to bias the model's token choices in a way that looks like ordinary sampling variation to a reader but forms a detectable pattern to anyone with the key. At each step, secretly split the vocabulary into a favored 'green' list and a disfavored 'red' list, and nudge the model toward green. Any single choice looks natural; across a whole passage, the excess of green tokens is a statistical fingerprint. The beauty and the limitation are the same fact: the watermark is a bias, and a bias is exactly as strong, as detectable, and as removable as the numbers you tune it to.

The green-list generation scheme

The scheme works at each generation step. Before the model picks a token, a pseudorandom function keyed by a secret and seeded by recent context partitions the vocabulary into a green list (a fraction gamma of tokens) and a red list (the rest). The model's logits for green tokens are boosted by a small additive constant delta before sampling, so green tokens become more likely without being forced. The model still produces fluent text — it is choosing among many plausible tokens, now leaning green — but over many tokens it selects green far more often than the baseline fraction gamma.

The two parameters gamma and delta define the watermark. Gamma sets how much of the vocabulary is green (typically around half); delta sets how hard the model is pushed toward green. A large delta makes the green excess strong and easy to detect but distorts the text more, because the model is often pushed away from the token it would otherwise prefer; a small delta is gentle on quality but produces a weaker, harder-to-detect signal. This is the first appearance of the trade-off that governs everything.

Crucially, the partition depends on recent context (the preceding token or tokens), so the green list changes at every step and cannot be guessed without the key. This context-dependence is what makes the watermark a keyed signal rather than a fixed pattern, and it is what a detector reconstructs to test for the watermark.

Detection as a statistical test

Detection does not need the original text or the model — only the key. A detector re-derives the green list at each position (using the same keyed function and the same context) and counts how many of the actual tokens fell in green. Under the null hypothesis that the text is not watermarked, each token is green with probability gamma independently, so the number of green tokens follows a binomial distribution. Watermarked text has far more green tokens than gamma predicts, so the detector runs a one-sided statistical test — typically a z-test on the green fraction — and flags the text if the green excess is too improbable under the null.

The strength of the evidence grows with length. A short passage has too few tokens to distinguish a genuine green excess from chance, but as the text lengthens the binomial concentrates and even a modest per-token bias produces an overwhelmingly significant green fraction. This is why watermark detection is reliable on long passages and unreliable on short ones: the statistic needs enough tokens to separate the watermarked distribution from the null.

The detector outputs a p-value or z-score, a graded measure of evidence rather than a binary verdict, which is important for the threat model: the detection is a statistical claim with a false-positive rate, and setting the threshold trades false positives against false negatives. A responsible detector reports the strength of evidence, not just 'AI' or 'not AI', so downstream decisions can weigh it appropriately.

The robustness-quality trade-off

Every watermark parameter choice sits on a trade-off surface, and understanding it is the key to understanding the scheme's limits. Increasing delta strengthens the green bias, which improves detectability and robustness (the signal survives more editing) but degrades text quality (the model is pushed off its preferred tokens more often). Decreasing delta preserves quality but weakens the signal, making it easier to evade and requiring longer text to detect. There is no setting that is simultaneously strong, invisible, and robust — the parameters trade these against each other.

The trade-off is not incidental; it is structural. The watermark's detectability comes from the same distortion that reduces quality, because both are measured by how far the watermarked distribution departs from the model's natural one. A signal you cannot perceive in the text is also a signal an attacker can more easily perturb away, and a signal robust to heavy editing is one that pushed the text far enough to be perceptible. Robustness, quality, and detectability form a three-way tension no parameter setting escapes.

This is why watermarking research, including Kuditipudi and colleagues' work on distortion-free watermarks, focuses on improving the trade-off — getting more detectability per unit of quality loss, or more robustness per unit of distortion — rather than eliminating it. For a deployer, the lesson is to choose the operating point deliberately for the use case (strong and slightly distorting where robustness matters, gentle where quality is paramount) and to state the resulting robustness and detectability honestly, because the point you choose is a point on the curve, not an escape from it.

Properties and limits of the scheme

The green-list scheme has attractive properties. It needs no access to the model or the original text to detect, only the key; it produces graded statistical evidence; and its strength is tunable. It also composes cleanly with the threat model: detection is a keyed test, so an attacker without the key cannot easily forge the exact green pattern, giving some resistance to spoofing — though the scheme's spoofing resistance depends on details and is not absolute.

Its limits follow from being a statistical bias. It is inherently probabilistic, so it has false positives and false negatives governed by length and the trade-off. It is removable by editing that disrupts the green pattern — paraphrasing, token substitution, or translation change the tokens enough to wash out the excess, which is the evasion attack the next analysis examines. And it requires the generator to cooperate: only text produced by a watermarking model carries the signal, so it says nothing about text from an unwatermarked model.

The honest characterization is that green-list watermarking is a well-designed, tunable, keyed statistical signal with clear guarantees on cooperative long text and clear limits against editing and non-cooperative generators. It is a genuine tool — better than hoping a post-hoc classifier finds a signal — but it is a bias on a trade-off curve, not a cryptographic proof, and its promises must be stated as such.

Why the mechanics matter for the threat model

Understanding the mechanics precisely is what lets a deployer reason about the attacks. Because the signal is a green excess accumulated over tokens, evasion works by disrupting the token sequence (paraphrase, substitution) to lower the green fraction back toward chance — and the weaker the bias (for quality), the fewer edits this takes. Because detection is a keyed test, spoofing an author's watermark requires the key or a way to reproduce the green pattern. Because the evidence grows with length, short-text detection is unreliable and long-text detection is strong. Every attack and defense in the rest of this series is a consequence of the generation and detection math laid out here.

The synthesis, grounded in Kirchenbauer and Kuditipudi and their colleagues, is that a text watermark is a keyed, tunable statistical bias: bias generation toward a secret green list, detect by testing the green fraction, and accept that strength, quality, and robustness trade against each other. It is a real and useful signal, strongest on long cooperative text, but it is a point on a trade-off curve rather than an unbreakable mark. Knowing exactly what it is — and is not — is the foundation for deploying it honestly and for understanding the evasion, spoofing, and provenance analyses that follow.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# DEFENSIVE DETECTOR — statistical test for the green excess
function detect(text_tokens, key, gamma):
    green = 0
    for t in range(len(text_tokens)):
        green_list = PRF(key, context(text_tokens, t))   # same as gen
        if text_tokens[t] in green_list: green += 1
    T = len(text_tokens)
    z = (green - gamma*T) / sqrt(T*gamma*(1-gamma))
    return z, p_value(z)   # graded evidence, not a binary verdict

watermark_policy:
  parameters:
    gamma: documented
    delta: chosen_for_use_case      # robustness vs quality
  detection:
    output: graded_evidence          # p-value / z-score
    stated_false_positive_rate: required
    min_reliable_length: enforced
  key:
    secrecy: required
  disclosure:
    removability_limits: documented
    cooperative_generator_only: stated

Glossary

Green-list watermarking

A scheme that pseudorandomly favors a subset of the vocabulary at each step so generated text contains a detectable excess of those tokens.

Green list / red list

The favored and disfavored token subsets at a generation step, determined by a keyed pseudorandom function of context.

gamma

The fraction of the vocabulary placed on the green list, the baseline green probability under the null.

delta

The additive logit boost given to green tokens, controlling watermark strength and its quality cost.

Detection test

A one-sided statistical test (e.g., z-test) on the observed green-token fraction against the binomial null.

Robustness-quality trade-off

The structural tension whereby a stronger, more robust watermark distorts text more, lowering quality.

Distortion-free watermark

A watermark designed to minimize quality loss for a given detectability, improving the trade-off.

Cooperative generator

A model that applies the watermark; only its output carries the signal, so unwatermarked models produce undetectable text.

References

1. Kirchenbauer et al., A Watermark for Large Language Models (arXiv 2301.10226)
2. Kuditipudi et al., Robust Distortion-Free Watermarks for Language Models (arXiv 2307.15593)
3. Sadasivan et al., Can AI-Generated Text Be Reliably Detected? (arXiv 2303.11156)
4. NIST AI 100-2 e2023, Adversarial Machine Learning: A Taxonomy and Terminology
5. C2PA (Coalition for Content Provenance and Authenticity) technical specification
6. MITRE ATLAS (Adversarial Threat Landscape for AI Systems)