Post by @timbray@cosocial.ca

In which I try to clarify the issues around #GenAI watermarking its text output without requiring readers to be computer professionals: https://www.tbray.org/ongoing/When/202x/2026/08/24/Text-Watermarking

There’s been a lot of discussion recently about the GenAI giants “watermarking” their output, which to say inserting data so you can tell that it’s been generated by ChatGPT or Gemini or Claude or whatever. The technology for watermarking images is as old as dirt, works as advertised, and doesn’t affect image quality. What’s new and controversial is a claim that they can watermark text output cheaply, simply, and without harming the quality of the text.
I was curious how they did this so I dug in a bit. I’m mostly convinced that it works and is pretty clever. However, all the explanations are full of Computer-Science jargon that you need to be a professional developer to understand. So here’s an attempt to explain to non-insiders and then, indirectly, opinions on whether it’s good and what it means and doesn’t mean. — There’s been a lot of discussion recently about the GenAI giants “watermarking” their output, which to say inserting data so you can tell that it’s been generated by ChatGPT or Gemini or Claude or whatever. The technology for watermarking images is as old as dirt, works as advertised, and doesn’t affect image quality. What’s new and controversial is a claim that they can watermark text output cheaply, simply, and without harming the quality of the text. I was curious how they did this so I dug in a bit. I’m mostly convinced that it works and is pretty clever. However, all the explanations are full of Computer-Science jargon that you need to be a professional developer to understand. So here’s an attempt to explain to non-insiders and then, indirectly, opinions on whether it’s good and what it means and doesn’t mean.

ongoing by Tim Bray

Text Watermarking

#genai

6 Replies

0 Boosts

Joe Pallas

@jpallas@hachyderm.io 40 min. ago

@timbray Why is it “the previous few words” and not “a million tokens of preceding context that aren’t included in the published output?” That’s what I don’t get.

Tim Bray 🇨🇦

@timbray@cosocial.ca 37 min. ago

@jpallas I got another comment saying the same thing so maybe it's right. But I don't think it really interferes with the fact that the PRNG seed effectively functions as a key to the watermarking progress.

buo

@buo@mastodon.radio 5 hr. ago

@timbray I tend to think that, if these companies made a public watermark checker, then the effect would be mostly positive. I see some possible difficulties:

* If you want to check if a piece is human-written, you may have to submit it to every watermark checker available.
* What's the rate of false positives? Even a small number like 1e-9 means that someone may be falsely accused of using an LLM.
* I think all this becomes moot with the wide availability of local models.

Tim Bray 🇨🇦

@timbray@cosocial.ca 5 hr. ago

@buo I think the algorithm would make it pretty easy to return a percent probability rather than a yes/no, which might help.

Leo (he/him) 🇺🇦

@yildo@cosocial.ca 8 hr. ago

@timbray These sound more like checksums than watermarks. For a watermark I'd expect non-printing characters in the output, not this. If I read correctly, this is "the text is the same but you make an API call to verify whether the generator wants to take credit". That's a fuzzy variant of comparing a download to its hash.

Since I'm not about to send every piece of text I see to an LLM vendor, I'm skeptical of the use case.

Tim Bray 🇨🇦

@timbray@cosocial.ca 7 hr. ago

@yildo No, because it can only be verified by someone who knows the secrets, which is currently the model builders.

Discussion

Discussion