A Watermark for Large Language Models

>fails to understand the gumbel softmax technique I think in this case it doesn't help that there are multiple watermarking schemes, and the easiest for people to understand is the red/green scheme by Kirchenbauer et al. (https://arxiv.org/pdf/2301.10226), which does technically…

krackersAug 17, 2026View on HNParent context

A reasonable guess about the algorithm is 'A Watermark for Large Language Models' (https://arxiv.org/abs/2301.10226). The idea is that each generated token (or bigram) seeds a strong PRNG that splits the vocabulary into a 'green' and 'red' set. The sampler then tries to select a…

MajromaxAug 17, 2026View on HNParent context

> A proper watermarking system should be able to have an arbitrarily high accuracy - as many nines as you want. Probability of a false positive is 3 x 10^-5 in one example. * https://imgur.com/h5auUhG.jpg * https://arxiv.org/abs/2301.10226

EisensteinAug 14, 2026View on HNParent context

https://arxiv.org/abs/2301.10226

AvicebronAug 12, 2026View on HNParent context

Most likely this method https://arxiv.org/pdf/2301.10226 (EDIT: and Google's SynthID paper which builds on it https://www.nature.com/articles/s41586-024-08025-4)

akozakAug 10, 2026View on HNParent context

Models can't reliably follow instructions involving their own logprobs unless they can take agentic control and use quite sophisticated dynamic grammars/structures/constraints to force this behavior in one shot (which can be slow and the dynamic grammar modification feature…

Der_EinzigeAug 10, 2026View on HNParent context

There's a computerphile video (https://www.youtube.com/watch?v=XZJc1p6RE78) with Dr. Mark Pound explaining a paper by John Kirchenbauer, Jonas Geiping et al. (https://arxiv.org/abs/2301.10226) that described a method for watermarking LLM output like this. It's not directly…

m-chrzanAug 10, 2026View on HNParent context

I'd recommend that you gather your thoughts and publish a response to this paper : https://arxiv.org/abs/2301.10226

muchaAug 11, 2026View on HNParent context

A token is hashed and used to seed a random number generator, which produces the red list for the token after it. Paper: * https://arxiv.org/abs/2301.10226

EisensteinAug 12, 2026View on HNParent context

text watermarking works pretty well! https://arxiv.org/abs/2301.10226 When you generate a text with an LLM, you always have some choice. So you can sample in a way that is very likely under your watermark scheme, and unlikely otherwise

tomsander1998Nov 14, 2024View on HNParent context

Again, how do you reliably prove that I used your model if I do a bunch of tricks to "hide" this? i.e. high temperature, exotic samplers (i.e. typicality sampling), using lora/soft prompts/representation engineering, using it as part of a chain on top of other AI, etc I don't…

Der_EinzigeAug 29, 2024View on HNParent context

I wonder if they have a watermark built in that allows them to detect text generated by Llama easily. https://www.youtube.com/watch?v=XZJc1p6RE78 https://arxiv.org/pdf/2301.10226

ZambyteJul 30, 2024View on HNParent context

https://arxiv.org/pdf/2301.10226.pdf Here's a decent paper on it. It covers private watermarking (you can't detect it exists without a key), resistance to modifications, etc. Essentially you wouldn't know it was there and you can't make simple modifications to fool it. OpenAI…

thewataccountJul 25, 2023View on HNParent context

Yeah, if they put watermarks on generated images then everyone will just immediately stop using their product and switch to a competitor. There's some interesting work using steganography to mark generated text (https://arxiv.org/abs/2301.10226), but I'm not sure if that's what…

EthcadJul 21, 2023View on HNParent context

https://arxiv.org/abs/2301.10226 > We propose a watermarking framework for proprietary language models. The watermark can be embedded with negligible impact on text quality, and can be detected using an efficient open-source algorithm without access to the language model API or…

kibibuMay 10, 2023View on HNParent context

Watermarking [0] is a better solution. It still works after changes made to the generated output, and anyone can independently check for a watermark. Computerphile did a video on it [1]. But of course, watermarking or checksums stop working once the general public runs LLMs on…

stcgMar 22, 2023View on HNParent context

From the Alpaca report (https://crfm.stanford.edu/2023/03/13/alpaca.html): > we watermark all the model outputs using the method described in Kirchenbauer et al. 2023, so that others can detect (with some probability) whether an output comes from Alpaca 7B…

7373737373Mar 19, 2023View on HNParent context

https://arxiv.org/pdf/2301.10226.pdf https://www.youtube.com/watch?v=XZJc1p6RE78

qingdao99Mar 8, 2023View on HNParent context

Watermarking. From an outsiders perspective, the issue appears to reaching consensus on how this can be implemented (but not in the technical sense). There's a game theoretic challenge in that if models define and publish detection mechanisms, this creates a motivation for…

kimburgessFeb 27, 2023View on HNParent context

The LLM watermark seems like a better approach. https://arxiv.org/abs/2301.10226

dqpbJan 31, 2023View on HNParent context