Modern AI Engineering

Lesson 15.3 · 25 min · video lesson

LLM Watermarking: Embedding Invisible Signatures in AI Text

Can we hide an invisible signature in AI-written text using nothing but the choice of words, so that only someone with a secret key can find it?

In short: LLM watermarking hides a statistical signal in generated text. At each step, a secret key and the previous token pick a random “preferred” (green) subset of the vocabulary, and the model's scores for those tokens are nudged up slightly. Any single word looks normal, but over hundreds of words the text contains far more green tokens than chance would give, which a detector with the key can measure with a simple z-score. It works well on long, unedited text and weakens with short texts and heavy paraphrasing.

What you will learn

  • What is a watermark?
  • Why do we need a watermark in LLM-generated text?
  • How does an LLM write text?
  • How does an LLM choose the next word?
  • The hidden freedom that makes watermarking possible
  • Here comes the secret key into the picture
  • Preferred tokens and other tokens
  • Slightly changing the probabilities
  • Why the preferred set keeps changing
  • One token vs thousands of tokens
  • How does the detection work?
  • How is this different from an AI text detector?
  • Why the quality of the text does not break
  • What happens when someone edits the text?
  • Where is LLM watermarking used in the real world?
  • Advantages and disadvantages of LLM watermarking

In this lesson

  1. What is a watermark, and why put one in LLM text?
  2. How does an LLM write text and choose the next word?
  3. The hidden freedom that makes watermarking possible
  4. The secret key, preferred tokens, and nudging the probabilities
  5. One token vs thousands of tokens: how detection works
  6. How is this different from an AI text detector?
  7. Why the quality of the text does not break
  8. What happens when someone edits the text?
  9. Where LLM watermarking is used, and its advantages and disadvantages
  10. Going one level deeper
  11. Practice: try it yourself

Key terms in this lesson

Watermark
A hidden mark embedded in content to indicate its origin.
Logit
The raw score a model assigns to each vocabulary token before softmax.
Green list
The keyed, per-position subset of preferred tokens whose logits are boosted.
γ (gamma)
The fraction of the vocabulary placed on the green list at each step.
δ (delta)
The amount added to green tokens' logits; the watermark strength.
z-score
How many standard deviations the observed green count is above what chance predicts.
SynthID Text
Google DeepMind's text watermarking scheme, used in Gemini and released as open source.

This lesson is part of the Generative AI Engineering and Complete AI Engineer tracks. See plans and pricing to open the full lesson, its video, labs and quiz, or try the free lesson first (free account needed).

← 15.2 Prompt Injection: Attacks Against LLM-Powered Systems · 16.1 Multimodal AI: Perceiving Text, Images, and Audio Together →