A Watermark for Large Language Models · HackerPapers discussions

A Watermark for Large Language Models — mentioned by Majromax

Mon, 17 Aug 2026 13:11:59 GMT

A reasonable guess about the algorithm is 'A Watermark for Large Language Models' (https://arxiv.org/abs/2301.10226). The idea is that each generated token (or bigram) seeds a strong PRNG that splits the vocabulary into a 'green' and 'red' set. The sampler then tries to select a 'green' next-token for generation. After-the-fact checking only needs the vocabulary splitter, which is independent of the LLM. Over a sufficiently large text non-watermarked text would expect to use green and red tokens with the baseline probability, and that difference can easily become statistically significant…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by krackers

Mon, 17 Aug 2026 07:03:34 GMT

>fails to understand the gumbel softmax technique I think in this case it doesn't help that there are multiple watermarking schemes, and the easiest for people to understand is the red/green scheme by Kirchenbauer et al. (https://arxiv.org/pdf/2301.10226), which does technically distort the logits (but I'd argue only in cases where you wouldn't notice it anyway). I wasn't aware of this gumbel softmax scheme, it seems you're referring to https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-o... ? That's really clever as it doesn't even distort the logits, basically cryptographically…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Eisenstein

Fri, 14 Aug 2026 08:55:17 GMT

> A proper watermarking system should be able to have an arbitrarily high accuracy - as many nines as you want. Probability of a false positive is 3 x 10^-5 in one example. * https://imgur.com/h5auUhG.jpg * https://arxiv.org/abs/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Eisenstein

Wed, 12 Aug 2026 16:40:03 GMT

A token is hashed and used to seed a random number generator, which produces the red list for the token after it. Paper: * https://arxiv.org/abs/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Avicebron

Wed, 12 Aug 2026 00:35:13 GMT

https://arxiv.org/abs/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — HN submission

Wed, 12 Aug 2026 00:24:39 GMT

A Watermark for Large Language Models

4 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — mentioned by mucha

Tue, 11 Aug 2026 18:53:29 GMT

I'd recommend that you gather your thoughts and publish a response to this paper : https://arxiv.org/abs/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — HN submission

Mon, 10 Aug 2026 22:48:28 GMT

A Watermark for Large Language Models

3 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — mentioned by m-chrzan

Mon, 10 Aug 2026 22:46:06 GMT

There's a computerphile video (https://www.youtube.com/watch?v=XZJc1p6RE78) with Dr. Mark Pound explaining a paper by John Kirchenbauer, Jonas Geiping et al. (https://arxiv.org/abs/2301.10226) that described a method for watermarking LLM output like this. It's not directly stated anywhere in the Claude support article that this is what they're using, but the properties of the watermark described seem to point to this method.

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Der_Einzige

Mon, 10 Aug 2026 22:32:07 GMT

Models can't reliably follow instructions involving their own logprobs unless they can take agentic control and use quite sophisticated dynamic grammars/structures/constraints to force this behavior in one shot (which can be slow and the dynamic grammar modification feature isn't supported in closed model APIs for safety reasons) or repeated attempts at rewriting which is expensive/slow. Yes they can do this, but it's more likely closer to the original "red token, green token" paper: https://arxiv.org/abs/2301.10226 i.e. take half of your LLMs vocabulary, and upweight its probabilities by…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by akozak

Mon, 10 Aug 2026 22:24:59 GMT

Most likely this method https://arxiv.org/pdf/2301.10226 (EDIT: and Google's SynthID paper which builds on it https://www.nature.com/articles/s41586-024-08025-4)

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by tomsander1998

Thu, 14 Nov 2024 12:26:08 GMT

text watermarking works pretty well! https://arxiv.org/abs/2301.10226 When you generate a text with an LLM, you always have some choice. So you can sample in a way that is very likely under your watermark scheme, and unlikely otherwise

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Der_Einzige

Thu, 29 Aug 2024 16:21:06 GMT

Again, how do you reliably prove that I used your model if I do a bunch of tricks to "hide" this? i.e. high temperature, exotic samplers (i.e. typicality sampling), using lora/soft prompts/representation engineering, using it as part of a chain on top of other AI, etc I don't care if every lawyer on earth is hired by Meta. Show me evidence that any particular LLM can be trivially fingerprinted based on its outputs. No, that "red token green token" paper on watermarking (https://arxiv.org/pdf/2301.10226) is not an example of this because of how trivial it is to defeat. Edit: I can't reply to…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Zambyte

Tue, 30 Jul 2024 16:14:34 GMT

I wonder if they have a watermark built in that allows them to detect text generated by Llama easily. https://www.youtube.com/watch?v=XZJc1p6RE78 https://arxiv.org/pdf/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — HN submission

Wed, 15 Nov 2023 14:53:55 GMT

A Watermark for Large Language Models

3 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — HN submission

Tue, 01 Aug 2023 19:36:54 GMT

Show HN: IdentityLM, cryptographic proof of identity via language model output

Hi HN, IdentityLM allows you to create text from a language model that is statistically signed by you, in a way that is computationally very hard to replicate, and computationally very easy to verify. It builds on current research around logit biasing, statistically advantaging certain tokens in a deterministic way. That research focuses on watermarking language model output to identify the model it came from. A really good paper about this idea was just awarded outstanding paper at ICML - https://arxiv.org/pdf/2301.10226.pdf. I’ve basically taken that research and interpreted it in the…

4 points; 3 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — mentioned by thewataccount

Tue, 25 Jul 2023 15:06:58 GMT

https://arxiv.org/pdf/2301.10226.pdf Here's a decent paper on it. It covers private watermarking (you can't detect it exists without a key), resistance to modifications, etc. Essentially you wouldn't know it was there and you can't make simple modifications to fool it. OpenAI could already be doing this, and they could be watermarking with your account ID if they wanted to. The current best countermeasure is likely paraphrasing attacks https://arxiv.org/pdf/2303.11156.pdf

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by Ethcad

Fri, 21 Jul 2023 13:45:22 GMT

Yeah, if they put watermarks on generated images then everyone will just immediately stop using their product and switch to a competitor. There's some interesting work using steganography to mark generated text (https://arxiv.org/abs/2301.10226), but I'm not sure if that's what they're talking about here.

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by kibibu

Wed, 10 May 2023 23:04:19 GMT

https://arxiv.org/abs/2301.10226 > We propose a watermarking framework for proprietary language models. The watermark can be embedded with negligible impact on text quality, and can be detected using an efficient open-source algorithm without access to the language model API or parameters. Alpaca uses this already.

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by stcg

Wed, 22 Mar 2023 12:15:24 GMT

Watermarking [0] is a better solution. It still works after changes made to the generated output, and anyone can independently check for a watermark. Computerphile did a video on it [1]. But of course, watermarking or checksums stop working once the general public runs LLMs on personal computers. And it's only a matter of time before that happens. So in the long run, we have three options: 1. take away control from the users over their personal computers with 'AI DRM' (I strongly oppose this option), or 2. legislate: legally require a disclosure for each text on how it was created, or 3. stop…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by 7373737373

Sun, 19 Mar 2023 19:14:11 GMT

From the Alpaca report (https://crfm.stanford.edu/2023/03/13/alpaca.html): > we watermark all the model outputs using the method described in Kirchenbauer et al. 2023, so that others can detect (with some probability) whether an output comes from Alpaca 7B https://arxiv.org/abs/2301.10226 > We propose a watermarking framework for proprietary language models. The watermark can be embedded with negligible impact on text quality, and can be detected using an efficient open-source algorithm without access to the language model API or parameters. The watermark works by selecting a randomized set…

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by qingdao99

Wed, 08 Mar 2023 09:54:48 GMT

https://arxiv.org/pdf/2301.10226.pdf https://www.youtube.com/watch?v=XZJc1p6RE78

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — mentioned by kimburgess

Mon, 27 Feb 2023 12:45:40 GMT

Watermarking. From an outsiders perspective, the issue appears to reaching consensus on how this can be implemented (but not in the technical sense). There's a game theoretic challenge in that if models define and publish detection mechanisms, this creates a motivation for people to use other systems that don't include this. On the technical front there's a good paper here: https://arxiv.org/pdf/2301.10226.pdf, and a nice very approachable video explaining it here: https://www.youtube.com/watch?v=XZJc1p6RE78.

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — HN submission

Fri, 17 Feb 2023 00:38:35 GMT

A Watermark for Large Language Models [pdf]

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — HN submission

Wed, 01 Feb 2023 16:51:53 GMT

A Watermark for Large Language Models

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — mentioned by dqpb

Tue, 31 Jan 2023 19:09:45 GMT

The LLM watermark seems like a better approach. https://arxiv.org/abs/2301.10226

Paper and discussion history. A mention is not an endorsement.

A Watermark for Large Language Models — HN submission

Thu, 26 Jan 2023 13:39:16 GMT

A Watermark for Large Language Models

4 points; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — HN submission

Wed, 25 Jan 2023 17:43:46 GMT

A Watermark for Large Language Models

3 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

A Watermark for Large Language Models — HN submission

Wed, 25 Jan 2023 04:16:29 GMT

A Watermark for Large Language Models

4 points; 3 discussion replies on HN. Paper and source history. A submission is not an endorsement.