---
title: "Kirchenbauer et al. (2023) watermark LLM output by softly biasing sampling toward a secret pseudorandom 'green list' of tokens"
type: "claim"
status: "seedling"
audit_status: "capture-verified — the mechanism and quote were taken from the arXiv abstract (primary, Tier 1) at capture time; the quoted phrase matches the paper's published abstract. No independent re-fetch this promotion (WebFetch unavailable headless). Clears the Tier 1–2 mechanism floor; recorded as seedling pending the vault's standard first-note maturation, not because of a sourcing gap."
source_url: "https://arxiv.org/abs/2301.10226"
source_title: "A Watermark for Large Language Models"
source_author: "Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein (2023)"
source_date: 2023
source_quote: "The watermark works by selecting a randomized set of 'green' tokens before a word is generated, and then softly promoting use of green tokens during sampling."
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-watermark-paper-to-llm.md, 2026-07-11"
origin: "hop-batch"
writer_model: "claude-opus-4-8"
derived_from: ["10-inbox/raw/2026-07-09-hop-watermark-paper-to-llm.md"]
date_created: "2026-07-11T00:00:00.000Z"
tags: ["ai-watermarking","llm","provenance","security","history-of-ml","mechanism"]
drafted_in: ["2026-07-13-a-fake-needs-a-body","a-fake-needs-a-body"]
---


"A Watermark for Large Language Models" (Kirchenbauer, Geiping, Wen, Katz, Miers,
Goldstein, 2023) embeds a detectable, human-invisible signature directly in
generated text. At each decoding step, a pseudorandom function seeded by the
preceding token(s) partitions the vocabulary into a "green list" and a "red list";
sampling is then *softly* biased toward green tokens. Over a passage this produces
a statistical excess of green tokens that a party holding the seed can detect —
without access to the model's parameters or API — while a reader sees ordinary,
fluent text. In the authors' words, "the watermark works by selecting a randomized
set of 'green' tokens before a word is generated, and then softly promoting use of
green tokens during sampling."

The mechanism is the exact same *abstract move* as the paper watermark
([[claim-watermarks-originated-as-papermakers-mark-in-fabriano-1282]]) and the
banknote watermark ([[claim-bank-of-england-adopted-watermarked-banknote-paper-1697]]):
embed, in the substance of the artifact, a covert-but-verifiable marker of origin —
here in the statistics of the token stream rather than in the fibres of a sheet.
The field even reuses the *name*. That 750-year nominal-and-functional through-line
is the subject of [[observation-watermark-same-provenance-mechanism-paper-to-llm]].

The design also inherits the old arms race. The soft bias is a deliberate trade-off:
strong enough to detect, weak enough to preserve text quality — and therefore
vulnerable to removal. Paraphrasing and other "scrubbing"/"spoofing" attacks
degrade detection, the direct modern analogue of counterfeiting a banknote's
watermark. This connects the AI-provenance problem to the vault's document-authentication
cluster — [[claim-mabillon-1681-founded-diplomatics-to-refute-forgery-charge|diplomatics]]
authenticating a document against dated exemplars is the same act of adjudicating an
origin claim — and to the AI-history cluster around
[[claim-djvu-1998-paper-coauthored-by-lecun-and-bengio|document-processing at AT&T]]
and [[moc-backpropagation-origins]].

> [!note] Seek's commentary:
> The green/red-list scheme is a decoding-time watermark; there are also
> logit-level and post-hoc variants, and the robustness literature (scrubbing vs.
> spoofing) is a genuine sub-field. I kept this note to the founding mechanism and
> left the robustness quantitatives (e.g. paraphrasing collapsing detection rates)
> unpromoted — they rest on survey sources and want their own primary-sourced note.
> — Seek