Watermarking and provenance: Visual walkthrough — Hinglish deep dive

6.4.12 · D2 · AI-ML › AI Safety & Alignment › Watermarking and provenance

Yeh page text-watermark detection score ko bilkul shuru se build karta hai. Hum assume karte hain ki tum tokens, logits, hashes, ya z-scores ke baare mein kuch nahi jaante — har symbol ko use karne se pehle samjhaya jaayega. Hum parent note Watermarking and Provenance ko follow karte hain lekin bahut slow chalta hai aur pictures se argument ko samjhaate hain.

Step 1 — "Token" kya hota hai, aur "logit" kya hota hai?

WHAT. Kisi bhi maths se pehle, humein do raw ingredients chahiye. Ek token text ka woh chunk hota hai jiske saath model kaam karta hai — roughly ek word ya word ka ek piece. Jab model agla token likhne wala hota hai, woh seedha word nahi chuntta. Pehle woh apni vocabulary ke har possible word ke liye ek number produce karta hai. Woh raw, un-normalised score logit kehlaata hai.

WHY yeh words. Hum "logit" kehte hain ("probability" nahi) kyunki is stage par numbers abhi probabilities nahi hain — woh kisi bhi size ke ho sakte hain, positive ya negative. Bada logit = model us word ko zyada pasand karta hai. Hum logits ki parwah karte hain kyunki yahi woh exact jagah hai jahan hum baad mein apna watermark chipkaaenge — word choose kiye jaane se pehle.

PICTURE. Bar chart dekho. Har bar ek candidate word hai; uski height us word ka logit hai. Sabse lamba bar model ka favourite hai. Abhi kuch decide nahi hua — yeh sirf preferences hain.

Step 2 — Logits se probabilities tak: softmax kyun chahiye

WHAT. Hum logits ki pile ko real probabilities mein badaltey hain jo $1$ mein add up hoti hain. Yeh kaam karne wala tool softmax hai:

P (w) = \frac{e ^{ℓ (w)}}{w ^{'} \in V \sum e ^{ℓ (w^{'})}}

Term by term padhte hain:

$ℓ (w)$ — us word ka logit jiske baare mein hum pooch rahe hain.
$e^{ℓ (w)}$ — exponential. Kyun exponential aur logit khud nahi? Kyunki $e^{x}$ hamesha positive hota hai (ek probability kabhi negative nahi ho sakti) aur yeh logits ke differences ko probability ke ratios mein badal deta hai. Logit mein $+ 1$ ka gap kisi word ka weight $e^{1} \approx 2.72$ se multiply kar deta hai, chahe tum kahan se shuru karo.
$\sum_{w^{'} \in V} e^{ℓ (w^{'})}$ — har candidate word $w^{'}$ ka sum. Yahi normaliser hai, aksar $Z$ kehlaata hai. Isse divide karne par saari probabilities exactly $1$ mein add ho jaati hain.

WHY yeh tool. Hum ek word sample karne ke liye probabilities chahiye. Softmax "scores" se "ek valid probability distribution" tak ka standard bridge hai, aur — jo humaarey liye important hai — yeh ek constant add karne par ek clean, predictable tarike se react karta hai (agla step).

PICTURE. Step 1 wale same bars, lekin ab reshape ho gaye: exponentiated, phir squeeze ho gaye taaki poora area $1$ mein sum ho. Preference ka order wahi hai; sirf scale badla hai.

Step 3 — Vocabulary ko green aur red list mein split karna

WHAT. Har position $t$ par, hum pichla token $w_{t - 1}$ lete hain, use ek secret key ke saath combine karte hain, aur dono ko ek hash function mein daaltey hain — ek aisi machine jo koi bhi input leke ek scrambled, unpredictable-lagta number deti hai. Woh number har word ke liye ek coin flip seed karta hai: heads → green list $G_{t}$ , tails → red list $R_{t}$ . Roughly half vocabulary each mein jaati hai.

h_{t} = HASH (w_{t - 1}, secret_key)

$w_{t - 1}$ — woh word jo us word se pehle aaya jise hum generate karne wale hain. Iska use karne ka matlab hai ki split har position par badlega.
$secret_key$ — ek private number. Iske bina, koi outsider split reproduce nahi kar sakta, isliye woh watermark ko blindly forge ya erase nahi kar sakta.
$h_{t}$ — resulting seed jo position $t$ par green/red partition decide karta hai.

WHY yeh design. Humein do cheezein chahiye jo opposite lagti hain: (1) split random dikhna chahiye taaki text obvious tarike se distort na ho, aur (2) yeh reproducible hona chahiye taaki ek verifier baad mein same split recompute kar sake. (Previous token + secret key) ka hash dono deta hai: deterministic agar tum inputs jaante ho, scrambled agar nahi jaante.

PICTURE. Vocabulary coloured squares ki ek row hai. Position $t = 5$ par ek particular split dikhta hai; position $t = 6$ par previous word alag hai, isliye hash alag hai, isliye green/red pattern completely reshuffle ho jaata hai.

Step 4 — Model ko nudge karna: green logits mein $δ$ add karo

WHAT. Sampling se theek pehle, hum har green word ka logit ek fixed amount $δ$ se bump up karte hain:

ℓ^{'} (w) = {ℓ (w) + δ ℓ (w) w \in G_{t} w \in R_{t}

$ℓ (w)$ — model ka original logit.
$δ$ — watermark strength, ek chhota positive number (ek common choice $δ = 2.0$ hai).
$ℓ^{'} (w)$ — biased logit jisse hum actually sample karte hain.

WHY yeh exact move. Step 2 se yaad karo ki softmax "kisi logit mein constant add karna" ko "us word ki weight $e^{δ}$ se multiply karna" mein badal deta hai. Toh green words ko $δ = 2$ se bump karne par har green word ki raw weight $e^{2} \approx 7.39$ se multiply ho jaati hai. Green words jeetne ke liye zyada likely ho jaate hain — lekin model ke paas abhi bhi freedom hai, isliye woh usually aisa green word dhundh leta hai jo sentence mein bhi fit ho. Text fluent rehta hai; bas thoda green jhukta hai.

PICTURE. Green bars sab ek hi height $δ$ se uthte hain; red bars nahi hilte. Re-softmax karne ke baad, probability mass green ki taraf shift hoti hai — arrow dekho.

Step 5 — Detection: green tokens count karna

WHAT. Ab roles flip karo. $N$ tokens ke ek finished text aur secret key ke saath, ek verifier har green/red split recompute karta hai aur simply count karta hai ki $N$ tokens mein se kitne green hain. Us count ko $n_{green}$ kaho.

WHY. Agar kisi ne text ko watermark nahi kiya, toh har token coin flip ki luck se green hai — roughly $50%$ chance each. Toh ek random text mein about $N /2$ green tokens hone chahiye. Watermarked text green ki taraf nudge kiya gaya tha, isliye usme visibly zyada green hone chahiye. Poora detection problem yeh reduce ho jaata hai: "Kya $n_{green}$ $N /2$ se suspiciously bada hai?"

PICTURE. $N$ tokens ki ek strip, har dot green ya red colored. Random text half green ke paas hover karta hai; watermarked text visibly greener hai. Dashed line "innocent" expectation $N /2$ mark karta hai.

Step 6 — $N /2$ aur $N /4$ kyun: binomial baseline

WHAT. "Suspiciously bada" judge karne ke liye, humein jaanna hoga ki chance se hum green counts ka kitna spread expect karein. Har token ek independent green/not-green coin flip hai. $N$ flips mein successes count karna ek binomial distribution hai. Iske do summary numbers hain:

Mean $μ = N \cdot p = N \cdot \frac{1}{2} = \frac{N}{2}$ — typical green count.
Variance $σ^{2} = N \cdot p \cdot (1 - p) = N \cdot \frac{1}{2} \cdot \frac{1}{2} = \frac{N}{4}$ , toh standard deviation hai $σ = N /4$ .

Yahan $p = \frac{1}{2}$ coin ki green-probability hai, $N$ tokens ki sankhya.

WHY yeh formulas. Binomial ke mean aur variance standard results hain (aise coin processes ka entropy view dekhne ke liye Information theory dekho). Standard deviation $N /4$ hamaara natural ruler hai: yeh bataata hai ki green count $N /2$ se chance se kitna typically bhatakta hai. " $σ$ " ka ek bhatakna normal hai; paanch " $σ$ " nahi hai.

PICTURE. "No watermark" ke under green counts ka bell-shaped curve, $N /2$ par centered, $σ = N /4$ marked ke saath. Watermarked texts right tail mein kaafi door land karte hain.

Step 7 — Z-score: "suspicious" ko ruler-units mein measure karna

WHAT. Hum yeh express karte hain ki $n_{green}$ innocent mean se kitna oopar hai, standard deviations mein measure karte hue:

z = \frac{n _{green} - N /2}{N /4}

$n_{green} - N /2$ — innocent expectation se green ka raw excess.
$N /4$ — ruler (standard deviation) jo us excess ko "kitne $σ$ " mein convert karta hai.
$z$ — final z-score: ek pure number jo kehta hai "chance se itne standard deviations oopar."

Hum ise algebraically tidy kar sakte hain. Kyunki $N /4 = \frac{N}{2}$ :

z = \frac{n _{green} - N /2}{N /2} = \frac{2 n _{green} - N}{N}

WHY z-score. Central Limit Theorem ke mutaabik, coin flips ka ek bada pile bell curve jaisa dikhta hai, aur ek z-score directly yeh padhta hai ki woh result us curve par kitna rare hai: $z > 4$ matlab false-alarm chance almost $0.003%$ se neeche. Yeh alag-alag length ke texts ko bhi comparable banata hai — "extra green words" ka raw count bina ruler se divide kiye kuch nahi batata.

PICTURE. Wahi bell curve, ab horizontal axis $z$ units mein relabelled. $z_{threshold} = 4$ par ek vertical line "innocent" ko "flagged" se alag karti hai; iske right ka shaded sliver chhota false-positive rate hai.

Step 8 — Edge aur degenerate cases (koi gap mat chhoddo)

WHAT / WHY / PICTURE saath, kyunki har case ek "kya hoga agar inputs break ho jaayein" wala sawaal hai.

Case A — Bahut chhota text ( $N$ tiny). Ruler $N /4$ shrink hota hai, lekin aapka evidence budget bhi. $N = 4$ ke saath, sab green bhi $z = (2 \cdot 4 - 4) / 4 = 4/2 = 2$ deta hai — threshold se neeche. Lesson: watermarks tweet-length snippet mein undetectable hain; tumhe length chahiye.

Case B — Low-entropy text. Agar agla word essentially forced hai (jaise New York ___ → "City"), toh model ke paas green prefer karne ki koi freedom nahi. Bias $δ$ near-certain choice ko move nahi kar sakta. Aise passages weakly contribute karte hain, isliye $n_{green}$ $N /2$ se thoda hi oopar aata hai. Lesson: boilerplate, code, aur quotations signal ko water down karte hain.

Case C — Paraphrase attack. Tokens rewrite karna har $w_{t - 1}$ badal deta hai, jo green lists reshufle karta hai — isliye surviving words ab apne green set mein nahi baithe ho sakte. Parent ke numbers se, $40%$ paraphrase humein $\approx 160$ mein se $95$ green tak le jaata hai: $z = \frac{2 ( 95 ) - 160}{160} = \frac{30}{12.65} \approx 2.37.$ Abhi bhi positive, lekin kamzor. Lesson: signal gracefully degrade hota hai, catastrophically nahi.

Case D — $δ = 0$ . Bilkul koi bias nahi → generator normally behave karta hai → $n_{green} \approx N /2 \Rightarrow z \approx 0$ . Yeh sanity check hai: watermark off karo aur detection sahi se kuch nahi dhundh paata.

Picture $z$ ko in stresses ka function dikhata hai: ek axis par length, aur strong / weak / no watermark ke liye teen curves.

Ek-picture summary

Oopar sab kuch ek single pipeline hai: logits → green bias karo → sample karo → green count karo → z-score → decide karo. Final figure sab kuch ek saath thread karta hai, taaki tum kisi bhi stage par point karke naam bata sako ki wahan kya hota hai.

Recall Feynman retelling — kisi dost ko samjhao jaise

AI ek waqt mein ek word likhta hai. Har word se pehle, hum secret key aur pichle word ka use karke secretly dictionary ka aadha green aur aadha red paint karte hain — aur har single word ke liye fresh repaint karte hain. Hum AI ko whisper karte hain, "green prefer karo," green words ke scores mein chhota number $δ$ add karke; softmax us chhoti nudge ko roughly $7 \times$ preference mein badal deta hai, lekin AI phir bhi fluently likhta hai. Reader ko kuch pata nahi chalta.

Baad mein, agar humein kisi text par shak ho, hum same secret key se saare green/red paintings recompute karte hain aur bas green words count karte hain. Ek innocent, un-watermarked text roughly half green hona chahiye — jaise ek fair coin $N$ baar flip karo aur roughly aadhi baar heads aao. "Half" ke around typical wobble $N /4$ coins hai. Toh hum count karte hain kitne extra greens dekhe aur us wobble se divide karte hain: woh ratio z-score hai. Agar yeh about $4$ se oopar hai, toh text accident ke liye bahut zyada green hai — watermark mil gaya. Chhote texts, forced phrasings, aur paraphrasing sab z-score shrink karte hain, aur $δ$ ko zero karne par yeh gayab ho jaata hai — exactly jaisa hona chahiye.

Recall Quick self-test

Extra green words report karne ki jagah $N /4$ se divide kyun karte hain? ::: Kyunki raw counts alag-alag lengths mein comparable nahi hain; standard deviation se divide karne par excess "chance se kitne typical wobbles oopar" ban jaata hai, jo directly bell curve par rarity padhta hai. Fixed value nahi, previous token hash kyun karte hain? ::: Taaki green/red split har position par badle, signal poore text mein spread ho aur use spot ya strip karna mushkil ho. Chhota $δ$ softmax mein itna powerful kyun ho jaata hai? ::: Kyunki softmax logits exponentiate karta hai, isliye $δ$ add karne par word ka weight $e^{δ}$ se multiply hota hai ( $δ = 2$ ke liye almost $7.4 \times$ ).

Related: Cryptographic signatures provenance side ko underpin karte hain; AI-generated content detection aur Model fingerprinting cousin techniques hain; paraphrase attack Adversarial examples se connect hota hai.