A secret key held by the AI lab steers word choice, deliberately choosing less likely words at certain places to allow later detection. The following is a simplified demo.
The highlighted words are where overrode the model's top word
choice. Only the key holder can
recompute these weights and prove the pattern is there; to everyone else the highlighted words
look like ordinary chance, and the watermark is invisible. Click a highlighted word to see
the choices it was picked from.
Every steered word changes what comes next, just like real generation. The faintly shaded text after each highlighted word is there because of that choice; a different word would have led somewhere else.
Every word plays the game. To keep this visualization easy to follow, the key only steers six "choice points" in this passage. In reality, the AI works out these probabilities and runs the key-based calculation for every single word it writes.
The g number on each word is its watermark weight under the key — how much the key favours it here. But the calculation is not simply "highest weight wins", it's in proportion to its probability.
No key, no watermark. This is the same passage written with no key involved: at every choice point the model simply takes its most likely word. Nothing is steered, so nothing is highlighted, and there is no pattern for anyone to find later.
Check it below with any of the three keys. Each one gives it a mean watermark weight near the 0.50 expected from chance, because none of them had a hand in choosing these words. That is the control case, and it is the half that makes detection meaningful: a detector that fired on this text too would be a detector nobody could trust.
To check a text, each word is scored with the key, using the words that actually preceded it in the text as the context, and the mean watermark weight is compared against chance (0.50). The text scores high only under the key that wrote it.
A detector gets nothing but the text: not the key's working, not which words were steered, not even that there were choice points. It re-derives each word's weight from the words in front of it, and that is all it needs.
A real detector does that for every word; this demo does it for the six words at the choice points above. Each line below is one of those words with the run-up to it — and the two words nearest it, in brighter type, are the context the key is hashed with.
Some of the six score near chance, or below it: a single weight proves nothing, because steering only tilts the average. It is also why six words is too few to be sure of anything — a real detector counts every word in the text, sixty-odd of them here, and the average is worth trusting only because the sample is large.