为 LLM 生成的文本添加水印

A text watermark is a hidden pattern placed in machine-generated writing at the moment it is produced, so that software can later recognize the text as coming from a particular model. Unlike a visible label, it is invisible to readers and survives copy and paste because it lives in the choice of words themselves. It differs from AI text detectors that guess authorship from style, which have a poor record: OpenAI shut down its own AI text classifier in 2023 because of its low accuracy, according to TechCrunch. A watermark instead gives a statistical test with a known false positive rate, but only for text from a model that used that watermark with that key.

The idea works because language models generate text one token, a word or word piece, at a time by sampling from a probability distribution over their vocabulary. Often several next tokens are almost equally good, and the model has freedom in which it picks. A watermark uses that freedom. A secret key and the preceding tokens feed a pseudorandom function, which nudges the choice toward a hidden subset of tokens or a hidden ranking. To a reader the text reads normally. To a detector with the key, the text shows far more of the favored choices than chance would predict.

The best-known public scheme came from John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein at the University of Maryland in January 2023. At each step, the previous token seeds a random number generator that splits the vocabulary into a green list and a red list. In the soft version, the model adds a constant bias, delta, to the scores of green tokens before sampling, so green words become more likely without being forced. Detection counts green tokens and computes a z-score, a measure of how many standard deviations the count is above what unwatermarked text would show. With half the vocabulary green, a bias of 2 and a threshold of z = 4, about 98.4% of 200-token samples from the OPT-1.3B model were detected, and the paper reported no false positives in its runs. A z threshold of 4 corresponds to a false positive rate of about 3 in 100,000.

Google DeepMind's SynthID-Text, published in Nature on October 23, 2024 by Dathathri and colleagues, uses a different mechanism called tournament sampling. The model proposes several candidate tokens, which compete in a knockout tournament over 30 layers by default, with winners decided by pseudorandom g-values derived from the secret key and the previous four tokens. A non-distortionary setting preserves text quality, while a distortionary one trades some quality for stronger detection. The paper reports that the non-distortionary version beat Gumbel sampling, another published scheme, on detectability, especially at low entropy, and added only 0.57% latency per token on Gemma 7B. SynthID-Text had been rolled out to the Gemini app and web experience, as Google DeepMind announced in May 2024, and its code was open-sourced.

Adoption accelerated with regulation. Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic text, images, audio or video to mark outputs in a machine-readable format so they are detectable as artificially generated, with solutions that are effective, interoperable, robust and reliable as far as technically feasible; it applies from August 2, 2026. OpenAI had built a text watermark by 2024 but held back; in August 2024 it told TechCrunch it was taking a deliberate approach because of circumvention risks and possible unfair effects on non-English speakers. In October 2026 TechCrunch reported that OpenAI would watermark ChatGPT and Codex text in the EU, using a method its technical report calls textGrain, and that Anthropic had announced in August 2026 that it would watermark Claude's text worldwide.

Compared with alternatives, watermarking has clear strengths and limits. Post-hoc detectors need no cooperation from the model provider but are unreliable. Watermarks travel with the words but only cover providers who adopt them; the SynthID paper notes that watermarking requires coordination among providers and is hard to enforce on open-source models that anyone can run without it.

The failure modes are well documented. Low-entropy text, where only one answer is reasonable, such as the capital of France or a math result, leaves little room to embed a signal; Google's blog names factual prompts as a weak case, and TechCrunch's account of OpenAI's report names math answers. Short passages give too few tokens for a confident test. Paraphrasing and translation scramble the pattern: OpenAI's own test, reported by TechCrunch, found that replacing 10% of words with synonyms dropped detection from about 92% to 66%. The Maryland group's 2023 reliability study found watermarks remained detectable after strong human paraphrasing, but only at around 800 tokens. Attackers can also try to steal the pattern and spoof it onto human text, or scrub it out, threats the SynthID paper lists. And absence of a watermark proves nothing, as OpenAI states.

In practice, a provider adds watermarking at the sampling step, with no retraining, and must protect its keys; Google's reference code warns that its random number generator is not a vetted cryptographic primitive and offers no cryptographic security guarantees. Detection needs the key, so access is usually restricted, as with OpenAI's initial limit to approved researchers and expert organizations. Anyone using a detector result for decisions about people, such as students, should treat it as one piece of evidence with a stated false positive rate, never as proof.