A secret key held by the AI lab steers word choice, deliberately choosing less likely words at certain places to allow later detection. The following is a simplified demo.
The highlighted words are where overrode the model's top word
choice. Only the key holder can
recompute these weights and prove the pattern is there; to everyone else the highlighted words
look like ordinary chance, and the watermark is invisible. Click a highlighted word to see
the choices it was picked from.
Every steered word changes what comes next, just like real generation. The faintly shaded text after each highlighted word is there because of that choice; a different word would have led somewhere else.
Every word plays the game. To keep this visualization easy to follow, the key only steers six "choice points" in this passage. In reality, the AI works out these probabilities and runs the key-based calculation for every single word it writes.
The g number on each word is its watermark weight under the key — how much the key favours it here. But the calculation is not simply "highest weight wins", it's in proportion to its probability.
No key, no watermark. This is the same passage written with no key involved: at every choice point the model simply takes its most likely word. Nothing is steered, so nothing is highlighted, and there is no pattern for anyone to find later.
Check it below with any of the three keys. Each one scores it near the 0.50 expected from chance, because none of them had a hand in choosing these words. That is the control case, and it is the half that makes detection meaningful: a detector that fired on this text too would be a detector nobody could trust.
To check a text, each word is scored with the key, using the words that actually preceded it in the text as the context, and the mean watermark weight is compared against chance (0.50). The text scores high only under the key that wrote it.
A real detector scores every word in the text; this demo scores the six words at the choice points above.