EU AI Watermarking: Tournament Scoring to Detect Machine Text

The European Union has recently passed legislation requiring AI companies to watermark their output, making it easier to detect AI-generated content. Major AI developers like Anthropic and Google are already implementing or planning to implement such watermarking globally, not just within the EU, due to logistical simplicity and additional benefits beyond plagiarism detection. This watermarking is designed to be imperceptible to the user, yet detectable with high confidence.

How AI Watermarking Works

The core idea behind AI watermarking, particularly for large language models (LLMs), involves subtly altering the word choices made by the model during generation. LLMs predict the next word in a sequence based on probabilities. For example, in the sentence "The cat sat on the...", an LLM might predict "mat" with 70% probability, "chair" with 20%, and "sofa" with 10%.

Instead of always picking the most probable word, watermarking introduces a mechanism to slightly bias the choice towards words that carry a hidden signal, without significantly altering the meaning or quality of the output. This signal is embedded in a way that allows for later detection.

The Tournament Analogy

A clever method for achieving this is through a "tournament" system:

1. Context-Based Randomness: The watermarking process is localized, meaning it's based only on the most recent few tokens (e.g., the previous four words). This ensures that minor edits to the text don't completely destroy the watermark.
2. Token Scoring: For each potential next word (token), a score (either 0 or 1) is generated using a hash function. This hash function takes the secret key, the context (previous words), the token itself, and the "round" of the tournament as input. This makes the scoring deterministic but statistically random.
3. Tournament Rounds: Imagine a series of "matches" between potential words. Words with a score of 1 are considered to have a "sword," while words with 0 have a "broken sword."
   • In each round, words are paired up. If one has a sword (1) and the other doesn't (0), the word with the sword wins.
   • If both have swords (1 vs. 1) or both have broken swords (0 vs. 0), the winner is chosen randomly (50/50 chance).
4. Winner Selection: This process continues through multiple rounds until a single winning word is selected as the output token.

This tournament structure ensures that:

• The overall probability distribution of words remains largely unchanged. If "mat" had a 70% chance, it will still win the tournament roughly 70% of the time, even with the watermarking.
• If a word has a 100% likelihood (e.g., "Beth" after "Mac"), it will always win, regardless of its scores, preserving deterministic outputs where necessary.

Detection Mechanism

To detect a watermark:

1. Recompute Scores: Given a piece of text, the detector (which has the secret key) recomputes the tournament scores (0s and 1s) for each word based on its context.
2. Average G-Score: For each word, the average of its scores across all tournament rounds is calculated. This is called the "G-score."
3. Statistical Analysis: If the text was not watermarked, the G-scores for individual words would average out to approximately 0.5 over many tokens (since 0s and 1s are generated randomly). However, if the text was watermarked, the process biases the selection towards words that received higher scores (more 1s). Therefore, a watermarked text will exhibit an average G-score slightly higher than 0.5 (e.g., 0.51 or 0.55).
4. P-Value: A statistical p-value is then calculated to determine the likelihood that such a deviation from 0.5 occurred by chance. A low p-value indicates a high confidence that the text is watermarked.

Practical Implications and Limitations

• Reliability: Watermarking becomes statistically significant and reliable for texts longer than approximately 200-400 tokens. Shorter texts are harder to watermark reliably.
• Editing and Evasion:
  • Changing even a single word in the context (the previous four tokens) will alter the hash function and thus the scores for subsequent words, effectively disrupting the watermark from that point onward.
  • To completely remove a watermark, a user would need to change a significant proportion of words (e.g., one in every three or four tokens), which is a substantial effort and risks degrading the text's quality or meaning.
  • Automated systems that directly publish AI output without human review will be easily detectable.
• Black Market AI: The EU mandate applies to major providers. Open-source models or locally run AI systems might not implement watermarking, potentially leading to "black market" AI content that is harder to detect. However, for general use cases, the major providers will be watermarking.
• Secret Key: The detection mechanism relies on a secret key known only to the AI company. Users cannot independently verify if their output is watermarked; they must use an API provided by the company.
• Code Generation: Watermarking code is more challenging because code is highly structured and often has deterministic elements (e.g., syntax). While comments, variable names, and the order of imports can be influenced, the overall entropy (choice) is much lower, making the watermark weaker and easier to remove.
• Open-Ended Text: Watermarking works best for open-ended, creative text like essays or stories, where the LLM has more choices for word selection. The more constrained or deterministic the output (e.g., counting from 0 to 1000, or structured JSON), the less effective the watermarking.
• Evasion Techniques: Some clever evasion techniques exist, such as asking the LLM to insert an emoji between every word and then deleting them. This changes the context for every word, effectively scrambling the watermark. However, such methods require extra effort and might not work against more sophisticated watermarking strategies.

In essence, AI watermarking aims to make it significantly harder, though not impossible, to pass off AI-generated content as human-written, especially for large volumes of text produced without human oversight.