Watermarking and provenance: Visual walkthrough

This page builds the text-watermark detection score from absolute zero. We assume you know nothing about tokens, logits, hashes, or z-scores — every symbol is earned before it is used. We follow the parent note Watermarking and Provenance but slow way down and let the pictures carry the argument.

Step 1 — What is a "token", and what is a "logit"?

WHAT. Before any maths, we need the two raw ingredients. A token is a chunk of text the model works with — roughly a word or a piece of a word. When the model is about to write the next token, it does not pick a word directly. It first produces one number for every possible word in its vocabulary. That raw, un-normalised score is called a logit.

WHY these words. We say "logit" (not "probability") because at this stage the numbers are not yet probabilities — they can be any size, positive or negative. Bigger logit = the model likes that word more. We care about logits because they are the exact place we will later sneak our watermark in — before the word is chosen.

PICTURE. Look at the bar chart. Each bar is one candidate word; its height is that word's logit. The tallest bar is the model's favourite. Nothing is decided yet — these are just preferences.

Step 2 — From logits to probabilities: why we need the softmax

WHAT. We turn the pile of logits into real probabilities that add up to $1$ . The tool that does this is the softmax:

P (w) = \frac{e ^{ℓ (w)}}{w ^{'} \in V \sum e ^{ℓ (w^{'})}}

Reading it term by term:

$ℓ (w)$ — the logit of the word we're asking about.
$e^{ℓ (w)}$ — the exponential. Why exponential and not the logit itself? Because $e^{x}$ is always positive (a probability can never be negative) and it turns differences in logits into ratios of probability. A gap of $+ 1$ in logit multiplies a word's weight by $e^{1} \approx 2.72$ , no matter where you started.
$\sum_{w^{'} \in V} e^{ℓ (w^{'})}$ — the sum over every candidate word $w^{'}$ . This is the normaliser, often called $Z$ . Dividing by it forces all the probabilities to add to exactly $1$ .

WHY this tool. We need probabilities to actually sample a word. Softmax is the standard bridge from "scores" to "a valid probability distribution", and — crucially for us — it reacts to adding a constant in a clean, predictable way (next step).

PICTURE. Same bars as Step 1, but now re-shaped: exponentiated, then squished down so the whole area sums to $1$ . The order of preference is unchanged; only the scale changed.

Step 3 — Splitting the vocabulary into a green and red list

WHAT. At each position $t$ , we take the previous token $w_{t - 1}$ , combine it with a secret key, and feed both into a hash function — a machine that turns any input into a scrambled, unpredictable-looking number. That number seeds a coin flip for every word: heads → green list $G_{t}$ , tails → red list $R_{t}$ . Roughly half the vocabulary lands in each.

h_{t} = HASH (w_{t - 1}, secret_key)

$w_{t - 1}$ — the word just before the one we're about to generate. Using it means the split changes at every position.
$secret_key$ — a private number. Without it, an outsider cannot reproduce the split, so they cannot forge or erase the watermark blindly.
$h_{t}$ — the resulting seed that decides the green/red partition at position $t$ .

WHY this design. We need two things that sound opposite: (1) the split must look random so it doesn't distort the text in an obvious way, and (2) it must be reproducible so a verifier can recompute the exact same split later. A hash of (previous token + secret key) gives both: deterministic if you know the inputs, scrambled if you don't.

PICTURE. The vocabulary is a row of coloured squares. At position $t = 5$ one particular split appears; at position $t = 6$ the previous word is different, so the hash is different, so the green/red pattern is completely reshuffled.

Step 4 — Nudging the model: add $δ$ to green logits

WHAT. Right before sampling, we bump up the logit of every green word by a fixed amount $δ$ :

ℓ^{'} (w) = {ℓ (w) + δ ℓ (w) w \in G_{t} w \in R_{t}

$ℓ (w)$ — the model's original logit.
$δ$ — the watermark strength, a small positive number (a common choice is $δ = 2.0$ ).
$ℓ^{'} (w)$ — the biased logit we actually sample from.

WHY this exact move. Recall from Step 2 that softmax turns "add a constant to a logit" into "multiply that word's weight by $e^{δ}$ ." So bumping green words by $δ = 2$ multiplies each green word's raw weight by $e^{2} \approx 7.39$ . Green words become more likely to win — but the model still has freedom, so it usually finds a green word that also fits the sentence. The text stays fluent; it just leans green.

PICTURE. The green bars all rise by the same height $δ$ ; the red bars don't move. After re-softmaxing, probability mass shifts toward green — see the arrow.

Step 5 — Detection: counting green tokens

WHAT. Now flip roles. Given a finished text of $N$ tokens and the secret key, a verifier recomputes every green/red split and simply counts how many of the $N$ tokens are green. Call that count $n_{green}$ .

WHY. If nobody watermarked the text, each token is green purely by the luck of the coin flip — about a $50%$ chance each. So a random text should have about $N /2$ green tokens. Watermarked text was nudged toward green, so it should have noticeably more. The whole detection problem reduces to: "Is $n_{green}$ suspiciously bigger than $N /2$ ?"

PICTURE. A strip of $N$ tokens, each dot coloured green or red. Random text hovers near half green; watermarked text is visibly greener. The dashed line marks the "innocent" expectation $N /2$ .

Step 6 — Why $N /2$ and $N /4$ : the binomial baseline

WHAT. To judge "suspiciously bigger," we need to know the spread of green counts we'd expect by chance. Each token is an independent green/not-green coin flip. Counting successes across $N$ flips is a binomial distribution. Its two summary numbers are:

Mean $μ = N \cdot p = N \cdot \frac{1}{2} = \frac{N}{2}$ — the typical green count.
Variance $σ^{2} = N \cdot p \cdot (1 - p) = N \cdot \frac{1}{2} \cdot \frac{1}{2} = \frac{N}{4}$ , so the standard deviation is $σ = N /4$ .

Here $p = \frac{1}{2}$ is the coin's green-probability, $N$ the number of tokens.

WHY these formulas. Mean and variance of a binomial are standard results (see Information theory for the entropy view of such coin processes). The standard deviation $N /4$ is our natural ruler: it tells us how far the green count typically wanders from $N /2$ just by chance. One " $σ$ " of wander is normal; five " $σ$ " is not.

PICTURE. The bell-shaped curve of green counts under "no watermark", centred at $N /2$ , with width $σ = N /4$ marked. Watermarked texts land far out in the right tail.

Step 7 — The z-score: measuring "suspicious" in ruler-units

WHAT. We express how far $n_{green}$ sits above the innocent mean, measured in standard deviations:

z = \frac{n _{green} - N /2}{N /4}

$n_{green} - N /2$ — the raw excess of green over the innocent expectation.
$N /4$ — the ruler (standard deviation) that converts that excess into "how many $σ$ ."
$z$ — the final z-score: a pure number saying "this many standard deviations above chance."

We can tidy it algebraically. Since $N /4 = \frac{N}{2}$ :

z = \frac{n _{green} - N /2}{N /2} = \frac{2 n _{green} - N}{N}

WHY a z-score. By the Central Limit Theorem, a big pile of coin flips looks like a bell curve, and a z-score reads off directly how rare a result is on that curve: $z > 4$ means a false-alarm chance below about $0.003%$ . It also makes texts of different lengths comparable — a raw count of "extra green words" means nothing without dividing by the ruler.

PICTURE. The same bell curve, now with a horizontal axis relabelled in $z$ units. A vertical line at $z_{threshold} = 4$ splits "innocent" from "flagged"; the shaded sliver to its right is the tiny false-positive rate.

Step 8 — Edge and degenerate cases (never leave a gap)

WHAT / WHY / PICTURE together, because each case is a "what if the inputs break" question.

Case A — Very short text ( $N$ tiny). The ruler $N /4$ shrinks, but so does your evidence budget. With $N = 4$ , even all green gives $z = (2 \cdot 4 - 4) / 4 = 4/2 = 2$ — below threshold. Lesson: watermarks are undetectable in a tweet-length snippet; you need length.

Case B — Low-entropy text. If the next word is essentially forced (e.g. New York ___ → "City"), the model has no freedom to prefer green. The bias $δ$ can't move a near-certain choice. Such passages contribute weakly, so $n_{green}$ barely rises above $N /2$ . Lesson: boilerplate, code, and quotations water down the signal.

Case C — Paraphrase attack. Rewriting tokens changes each $w_{t - 1}$ , which reshuffles the green lists — so surviving words may no longer sit in their green set. From the parent's numbers, a $40%$ paraphrase drops us to $\approx 95$ green of $160$ : $z = \frac{2 ( 95 ) - 160}{160} = \frac{30}{12.65} \approx 2.37.$ Still positive, but weaker. Lesson: the signal degrades gracefully, not catastrophically.

Case D — $δ = 0$ . No bias at all → the generator behaves normally → $n_{green} \approx N /2 \Rightarrow z \approx 0$ . This is the sanity check: turn the watermark off and detection correctly finds nothing.

The picture shows $z$ as a function of these stresses: length on one axis, and three curves for strong / weak / no watermark.

The one-picture summary

Everything above is a single pipeline: logits → bias green → sample → count green → z-score → decide. The final figure threads all of it together, so you can point to any stage and name what happens there.

Recall Feynman retelling — say it like you'd explain to a friend

The AI writes words one at a time. Just before each word, we use a secret key and the previous word to secretly paint half the dictionary green and half red — and we repaint it fresh for every single word. We whisper to the AI, "prefer green," by adding a small number $δ$ to green words' scores; the softmax turns that little nudge into roughly a $7 \times$ preference, but the AI still writes fluently. A reader notices nothing.

Later, if we suspect a text, we recompute all those green/red paintings with the same secret key and just count green words. An innocent, un-watermarked text should be about half green — like flipping a fair coin $N$ times and getting heads about half the time. The typical wobble around "half" is $N /4$ coins. So we compute how many extra greens we saw and divide by that wobble: that ratio is the z-score. If it's above about $4$ , the text is far too green to be an accident — watermark found. Short texts, forced phrasings, and paraphrasing all shrink the z-score, and turning $δ$ to zero makes it vanish — exactly as it should.

Recall Quick self-test

Why divide by $N /4$ instead of just reporting extra green words? ::: Because raw counts aren't comparable across lengths; dividing by the standard deviation turns the excess into "how many typical wobbles above chance," which directly reads off rarity on the bell curve. Why hash the previous token, not a fixed value? ::: So the green/red split changes at every position, spreading the signal across the whole text and keeping it hard to spot or strip. Why does softmax make a small $δ$ powerful? ::: Because softmax exponentiates logits, so adding $δ$ multiplies a word's weight by $e^{δ}$ (about $7.4 \times$ for $δ = 2$ ).

Related: Cryptographic signatures underpin the provenance side; AI-generated content detection and Model fingerprinting are cousin techniques; the paraphrase attack connects to Adversarial examples.