Watermarking and provenance: Worked examples — Hinglish deep dive

6.4.12 · D3 · AI-ML › AI Safety & Alignment › Watermarking and provenance

Yeh page ek drill hai. Hum parent watermarking note lete hain aur uski detection formula ko har tarah ke input se guzarte hain jo use mil sakta hai: strong signals, weak signals, "watermark bilkul nahi" wala case, degenerate tiny-text case, ek attack jo signal ko ghis deta hai, aur ek real courtroom-style word problem.

Pehli line se pehle, aao un symbols ko dobara samjhein jinpar hum poore raaste rely karte hain.

Definition Symbols aur

$z$ -score, simple shabdon mein Hum $N$ tokens generate karte hain. Ek hidden rule secretly har token position ko green ya red colour karta hai, 50/50, ek secret key use karke. Ek watermarked model ko green words prefer karne ke liye nudge kiya gaya tha.

$N$ ::: text mein total tokens (words/word-pieces) ki sankhya jo hum check kar rahe hain.
$n_{green}$ ::: un tokens mein se kitne apni green list par aaye.
$δ$ ::: watermark strength — nudge ka size (ek green token ke logit mein add kiya gaya) jo model ko green ki taraf bias karta hai. Bada $δ$ = zyada greens produce = detect karna aasaan. Yeh input $n_{green}$ ko shape karta hai lekin $z$ formula mein appear nahi karta.
$p$ ::: ek probability (yahan hamesha ek false-positive rate): woh chance ki pure luck — bina watermark ke ek fair coin — itna bada $z$ -score produce kare. Chota $p$ = "luck akele yeh almost kabhi nahi karta" = strong evidence.
"Random baseline" ::: bina watermark ke, ek fair coin green/red decide karta hai, isliye hum $N /2$ greens expect karte hain.

$z$ -score ek sawaal ka jawab deta hai: "Random baseline se upar kitne standard steps par hamara green count hai?" $z = \frac{n _{green} - N /2}{N /4} = \frac{2 n _{green} - N}{N}$ Bada $z$ (maan lo $> 4$ ) matlab "bahut zyada greens luck se nahi ho sakte → watermark present hai". $z \approx 0$ matlab "fair coin jaisa lagta hai → koi watermark nahi".

Figure s01 — $N = 400$ ke liye green-count bell curve. Teen cheezein observe karo: dashed navy line baseline $N /2 = 200$ par (jo ek fair coin expect karta hai), magenta double-arrow ek "wobble" $N /4 = 10$ wide dikhata hai, aur orange dot Ex 1 ka count 260 greens ke liye jo chhe wobbles daayein taraf hai — itna door patli tail mein ki koi honest coin wahan nahi pahunchta.

Scenario matrix

Detection formula jo bhi cases la sakti hai woh in cells mein se kisi ek mein aate hain. Neeche ke worked examples mein har ek ko us cell ke saath tag kiya gaya hai jise woh cover karta hai.

Cell	Case class	Kya special hai	Example
A	Strong watermark, large $N$	$z ≫ 4$ , clean detect	Ex 1
B	No watermark (null case)	$n_{green} \approx N /2$ , $z \approx 0$	Ex 2
C	Weak / borderline	$z$ threshold ke paas, decision matters	Ex 3
D	Degenerate tiny $N$	trust karne ke liye bahut kam tokens	Ex 4
E	Extreme / limiting	$n_{green} = N$ (sab green) ya $= 0$	Ex 5
F	Attack signal erode karta hai (paraphrase)	$z$ girta hai lekin survive kar sakta hai	Ex 6
G	Real-world word problem	courtroom decision + false-positive rate	Ex 7
H	Exam twist (unknown ke liye solve karo)	$z$ aur $N$ diya, $n_{green}$ nikalo	Ex 8
I	Baseline se neeche (anti-signal)	$n_{green} < N /2$ , negative $z$	Ex 9

Worked example Ex 1 — Cell A: strong watermark, large text

Ek model $N = 400$ tokens generate karta hai watermark strength $δ = 2.0$ ke saath. Kyunki $δ > 0$ model ko green words ki taraf nudge karta hai, hum fair-coin baseline se upar green count expect karte hain. Ek detector $n_{green} = 260$ count karta hai. Kya yeh watermarked hai?

Forecast: compute karne se pehle andaza lagao — kya $z$ chota hoga (0 ke paas), medium (2–4), ya bada ( $> 4$ )?

Excess greens compute karo. $n_{green} - N /2 = 260 - 200 = 60$ . Yeh step kyun? Formula measure karta hai ki hum fair-coin expectation ( $N /2 = 200$ ) se kitna upar hain; sab kuch is gap par depend karta hai. ( $δ$ nudge wahi hai jisne yeh extra greens produce kiye, lekin detection sirf count $n_{green}$ dekhta hai, $δ$ nahi.)
Wobble compute karo. $N /4 = 100 = 10$ . Yeh step kyun? Yeh 400-flip fair coin ka ek "standard step" hai — hamara yardstick.
Divide karo. $z = 60/10 = 6.0$ . Yeh step kyun? Raw gap ko standard steps mein convert karna hume universal threshold $z > 4$ se compare karne deta hai.

Answer: $z = 6.0$ → strongly watermarked.

Verify: Normal curve ke mean se $6$ standard deviations upar hone ki probability $p \approx 1 0^{- 9}$ hai chance se hone ki. Koi fair coin yeh nahi karta. Sanity ✓.

Worked example Ex 3 — Cell C: borderline decision

$N = 100$ , $n_{green} = 62$ . Detection threshold $z_{thr} = 4$ . Watermarked hai ya nahi?

Forecast: 100 mein se 62 lagta hai bahut zyada greens hain — kya tumhara khayal hai yeh $z = 4$ clear karega?

Excess: $62 - 50 = 12$ .
Wobble: $100/4 = 25 = 5$ .
Divide: $z = 12/5 = 2.4$ .
Threshold se compare karo: $2.4 < 4$ → watermarked declare mat karo. Yeh step kyun? Baseline se upar hona kaafi nahi; chote texts zyada wobble karte hain, isliye hum false positives kam rakhne ke liye ek fixed bar cross karne ki maang karte hain.

Answer: $z = 2.4$ → suggestive lekin bar se neeche; verdict: inconclusive/flagged nahi.

Verify: Dekho 62/100 ne ek chota $z$ (2.4) diya 260/400 se (jo ek choti fraction thi, 65%, lekin 6.0 di). Kam tokens → luck ke liye zyada forgiving → zyada green fraction chahiye. Yahi reason hai ki $N$ denominator mein hai. Sanity ✓.

Worked example Ex 6 — Cell F: paraphrase attack signal erode karta hai

Original watermarked text: $N = 200$ , $n_{green} = 130$ . Ek attacker paraphrase karta hai, $40%$ tokens badal deta hai. Surviving tokens apna green status rakhte hain; naye tokens fair coins hain (50% green). Maano total length $200$ rehti hai.

Forecast: kya watermark survive karta hai? Kya $z$ 4 se upar rehega?

Surviving tokens count karo: $60% \times 200 = 120$ kept.
Surviving greens: original green fraction thi $130/200 = 0.65$ , isliye kept greens $\approx 0.65 \times 120 = 78$ . Yeh step kyun? Kept tokens apna colour rakhte hain, isliye woh same green proportion carry karte hain.
Naye tokens: $40% \times 200 = 80$ naye, har ek fair → $0.5 \times 80 = 40$ green. Yeh step kyun? Naaye likhe tokens mein koi watermark bias nahi, sirf baseline coin hai.
Total greens: $78 + 40 = 118$ ; $N$ abhi bhi $200$ .
$z$ : excess $= 118 - 100 = 18$ ; wobble $= 200/4 = 50 \approx 7.07$ ; $z = 18/7.07 \approx 2.546$ .

Answer: $z \approx 2.55$ — watermark kamzor ho gaya (pehle tha $z = \frac{130 - 100}{7.07} \approx 4.24$ ) aur ab $z > 4$ bar se neeche hai.

Verify: Pre-attack $z = 30/7.07 \approx 4.24$ (detectable). Post-attack $2.55 < 4$ (strict detector se bach jaata hai). Yeh parent ki warning confirm karta hai: paraphrasing dilute karta hai lekin poora erase nahi karta — mitigation hai longer hash context ya bada $δ$ . Sanity ✓.

Worked example Ex 7 — Cell G: real-world courtroom word problem

Ek publisher par AI text ko human jaisa pass karne ka aarop hai. Disputed article mein $N = 900$ tokens hain; platform ka detector $n_{green} = 510$ paata hai. Policy: sirf tab flag karo jab $z > 4$ . Kya court ko ise strong evidence maanani chahiye?

Forecast: 900 mein 510 sirf 56.7% green hai — kya yeh 900 tokens par kaafi hai?

Excess: $510 - 450 = 60$ . Kyun? 900 tokens ke liye baseline $N /2 = 450$ hai.
Wobble: $900/4 = 225 = 15$ .
$z$ : $60/15 = 4.0$ .
$z$ ko false-positive rate $p$ mein convert karo. $z \geq 4$ ki exact one-sided normal-tail probability hai $p \approx 3.2 \times 1 0^{- 5}$ — lagbhag $100, 000$ mein $3$ . Yeh step kyun? Court ko "flagged/not flagged" ki nahi balki galat aarop ki chance ki parwah hai — woh chance hi $p$ -value hai. Note: parent note ka phrase " $z = 4$ gives $p < 0.003$ " deliberately loose, safe upper bound hai (koi bhi bound $< 0.003$ maana jaata hai, aur actual tail kaafi choti hai). Dono statements sahamat hain: $3.2 \times 1 0^{- 5} < 0.003$ . Koi contradiction nahi — ek conservative bar hai, doosra exact number hai.

Answer: $z = 4.0$ , exact $p \approx 3.2 \times 1 0^{- 5}$ ; evidence strong hai aur stated policy clear karta hai, lekin flag threshold par bilkul baitha hai, isliye ise signed provenance ke saath corroborating evidence ke roop mein treat karo na ki akele proof ke roop mein. (Dekho AI regulation aur Cryptographic signatures kyun watermarks signatures ke saath pair karte hain, akele nahi.)

Verify: $p (z \geq 4) \approx 3.17 \times 1 0^{- 5}$ standard normal tail se, aur $3.17 \times 1 0^{- 5} < 0.003$ , isliye exact value aur parent ka bound dono ek hi direction point karte hain. Sanity ✓.

Worked example Ex 9 — Cell I: baseline se neeche (negative

$z$ ) Ek text mein $N = 100$ , $n_{green} = 38$ hai (coin se kam greens). $z$ kya kehta hai?

Forecast: kya $z$ negative ho sakta hai, aur uska matlab kya hoga?

Excess: $38 - 50 = - 12$ (baseline se neeche).
Wobble: $100/4 = 5$ .
Divide: $z = - 12/5 = - 2.4$ . Yeh step kyun? Sign information hai: bada negative $z$ matlab text green tokens avoid karta hai — ya toh bad luck, ya ek deliberate anti-watermark attack jo red ki taraf flip karta hai.

Answer: $z = - 2.4$ → is key ka koi watermark nahi; aur kaafi negative $z$ kai texts mein hint karta hai ki koi signal scrub kar raha hai (relates to Adversarial examples).

Verify: $- 2.4$ mean se $2.4$ standard steps neeche hai — low side par utna hi ordinary-to-mildly-unusual jitna Ex 3 high side par tha. Detectors sirf positive tail flag karte hain ( $z > z_{thr}$ ), isliye yeh text sahi taur par watermarked nahi flag hota. Sanity ✓.

Ek picture jo cells ko ek saath bandhti hai

Figure s02 — har worked example standardized $z$ -axis par rakha gaya. $z = 4$ par magenta vertical line decision boundary hai; uske daayein shaded magenta sliver "watermarked flag karo" zone hai. Dekho honest cases (Ex 2 at $0.5$ , Ex 9 at $- 2.4$ ) bell ke mote middle ke neeche baithte hain, borderline cases (Ex 4 at $2.0$ , Ex 3 at $2.4$ ) line ke baayein hover karte hain aur unflagged rehte hain, jabki Ex 7 ( $4.0$ ) bilkul boundary par land karta hai aur Ex 1 ( $6.0$ ) flag zone mein deep baitha hai. Ex 5 ki ceiling ( $z = 20$ ) right edge se kaafi door hai — sabse strong jo fair coin kabhi beat ho sakta hai.

Sunset bell curve dekho: $z = 4$ (magenta) par threshold line decision boundary hai. Ex 2 ( $z = 0.5$ ) aur Ex 9 ( $z = - 2.4$ ) mote middle ke neeche baithte hain — ordinary. Ex 3 ( $2.4$ ) aur Ex 4 ( $2.0$ ) "suspicious but not proven" band mein hain. Ex 1 ( $6$ ), Ex 7 ( $4.0$ ), aur ceiling Ex 5 ( $20$ ) dur-daayein sliver mein rehte hain jahan fair coin essentially kabhi nahi pahunchta.

Recall Quick self-test

$N = 400$ , $n_{green} = 260$ ke liye, $z$ kya hai? ::: $z = (260 - 200) /10 = 6.0$ . 4-token all-green text ko kyun flag nahi kiya ja sakta? ::: Uska $z$ sirf $2.0$ hai ( $p = 1/16$ ), $z > 4$ bar se kaafi door; tiny samples bahut zyada wobble karte hain. $N = 400$ ke liye maximum $z$ kya hai? ::: $400 = 20$ , tab reach hota hai jab har token green ho. Ek text $z = - 2.4$ deta hai. Watermarked? ::: Nahi — negative $z$ matlab coin se kam greens hain; detectors sirf positive tail flag karte hain. Kya $δ$ $z$ formula mein appear karta hai? ::: Nahi — $δ$ shape karta hai kitne greens model produce karta hai, lekin detection sirf $n_{green}$ aur $N$ padhta hai.

Related deep material: AI-generated content detection, Model fingerprinting, Content moderation, aur parent Watermarking and provenance (Hinglish).