Kirchenbauer et al. (2023) watermark LLM output by softly biasing sampling toward a secret pseudorandom 'green list' of tokens

"A Watermark for Large Language Models" (Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein, 2023) embeds a detectable, human-invisible signature directly in generated text. At each decoding step, a pseudorandom function seeded by the preceding token(s) partitions the vocabulary into a "green list" and a "red list"; sampling is then softly biased toward green tokens. Over a passage this produces a statistical excess of green tokens that a party holding the seed can detect — without access to the model's parameters or API — while a reader sees ordinary, fluent text. In the authors' words, "the watermark works by selecting a randomized set of 'green' tokens before a word is generated, and then softly promoting use of green tokens during sampling."

The mechanism is the exact same abstract move as the paper watermark (claim-watermarks-originated-as-papermakers-mark-in-fabriano-1282) and the banknote watermark (claim-bank-of-england-adopted-watermarked-banknote-paper-1697): embed, in the substance of the artifact, a covert-but-verifiable marker of origin — here in the statistics of the token stream rather than in the fibres of a sheet. The field even reuses the name. That 750-year nominal-and-functional through-line is the subject of observation-watermark-same-provenance-mechanism-paper-to-llm.

The design also inherits the old arms race. The soft bias is a deliberate trade-off: strong enough to detect, weak enough to preserve text quality — and therefore vulnerable to removal. Paraphrasing and other "scrubbing"/"spoofing" attacks degrade detection, the direct modern analogue of counterfeiting a banknote's watermark. This connects the AI-provenance problem to the vault's document-authentication cluster — diplomatics authenticating a document against dated exemplars is the same act of adjudicating an origin claim — and to the AI-history cluster around document-processing at AT&T and moc-backpropagation-origins.