Foundations — Watermarking and provenance

This page assumes you know nothing. Before you can read the parent note, you must first meet every symbol it throws at you. We build each one from a picture, explain why the topic needs it, and only then let it appear.

1. A token — the atom of text

The picture: imagine a train. Each carriage is one token, coupled in order. The model builds the train one carriage at a time, always looking at the carriage it just added before choosing the next.

Why the topic needs it. Text watermarking happens at generation time — exactly when the model picks the next carriage $w_t$. If you don't picture text as an ordered chain of choices, none of the later steps make sense. See Information theory for why "a choice" is the unit of hidden information.

2. The vocabulary — the box of all possible tokens

The picture: a giant bag of Scrabble tiles. At every step the model reaches into the same bag and pulls one tile. The bag never changes; only which tile it draws changes.

Why the topic needs it. The watermark works by splitting this bag into two halves (a "green" half and a "red" half) and quietly preferring one half. To split a thing, you must first know what the whole thing is.

3. Logits — the model's raw scores

The picture: a race with 50,000 runners lined up. Each runner has a number pinned on — that's its logit. The bigger the number, the further ahead it starts.

4. Softmax — turning scores into probabilities

We have scores, but to actually pick a token we need probabilities (numbers between 0 and 1 that add up to 1). The tool that converts scores into probabilities is called softmax.

Let's earn every symbol in that line.

Why $e^x$ and not just the raw score? Two reasons, and both matter:

1. Scores can be negative; probabilities cannot. $e^x$ is always positive, so every token gets a sensible non-negative chance.
2. It makes the effect of adding $\delta$ multiplicative. Watch:

The picture: softmax is a "vote-share calculator." Give each runner's number to $e^{(\cdot )}$, then each runner's probability is its slice of the total pie. Bumping green runners by $\delta$ enlarges their slices.

5. δ — the watermark strength (the nudge)

Why the topic needs it. $\delta$ is the single dial that trades detectability against quality. Every debate in the parent (poetry degradation, paraphrase attacks) is really a debate about how big to make $\delta$. Related idea: nudging a model's output is close cousin to Adversarial examples, where a tiny push changes behaviour.

6. Hashing and the secret key — reproducible randomness

The picture: a coffee grinder. Put in the same beans, get the same grounds every time — but you can never rebuild the beans from the grounds.

Why the topic needs it. The green/red split at each position must be:

• different everywhere (so the pattern isn't obvious) — achieved because the input includes $w_{t-1}$;
• reproducible (so a verifier can recompute it later) — achieved because a hash is deterministic;
• secret (so only the owner can check) — achieved by mixing in the $\text{secret\_key}$.

7. Green list and red list — splitting the bag

The picture: at every step, the bag of tiles is repainted — half the tiles turn green, half stay red — and the painting pattern is decided by the previous carriage $w_{t-1}$.

Why the topic needs it. The watermark is nothing more than a preference for green. In natural (un-watermarked) text, about half the tokens land green by pure chance. In watermarked text, noticeably more than half are green. That gap is what the detector hunts for. Distinguishing "made by the model" from a random baseline is exactly the goal of AI-generated content detection.

8. Counting and the z-score — proving it's not chance

We now need to prove a suspicious text really is watermarked, not just lucky. We count green tokens and ask: is this count surprising?

The picture: flip 200 coins, you expect ~100 heads but you'll usually land somewhere in 100 ± 7. A result of 150 heads would scream "these coins are rigged." Watermarked text is the rigged coin.

Why this exact formula? Subtracting $\mu$ centres the count on zero (so "no surprise" = 0). Dividing by $\sigma$ converts the surprise into a universal unit ("number of wobbles"), so the same threshold works for a 50-token text or a 5000-token one. This is the standardising move that makes the two forms of the formula equal (just simplify $\sqrt{N/4}=\frac{\sqrt{N}}{2}$).

The prerequisite map

The figure below shows how each foundation feeds into the next, all flowing toward the parent topic.

Equipment checklist

Self-test before reading the parent. Cover the right side and answer.