:hand-pink-waving: Thank you for watching! If you want to support me and try the watermarking yourself, the playground from the demos is available on my Patreon https://patreon.com/NoHypeAI
*FAQ*:
1. Q: Doesn't this obviously make the output worse?
A: That's the hard red list, which the Kirchenbauer paper itself presents as the naive version, and yes, it destroys quality. The soft red list is better but still shifts probabilities. However, in tournament sampling every candidate is an honest sample from the model's own distribution. So the watermark only decides which of those samples survives. Averaged over the random seed, the probability of outputting any token is exactly the model's original probability (the paper calls this "single-token non-distortionary"). Google's 20-million response A/B test found no measurable preference when it comes to quality. Nothing here bans a token or makes a wrong answer more likely than it already was.

2. Q: What about code?
A: Anthropic talks about this in their post and they admit it will behard to apply watermark in many cases. That makes sense because code will be mostly low-entropy tokens. In large enough codebases, the watermark can live in comments within code. I just tested generating a Fibonacci function in the watermarking playground and the tournament-sampled output was identical to the unwatermarked one.

3: Q: Doesn't the detector need the model, the weights, or the original prompt?
A: No. The detector never computes probabilities. The red/green assignment for a token depends only on the previous H tokens and the secret key, so all you need is the tokenizer, the key, and the watermark parameters. The prompt isn't needed either, you simply skip the first H tokens of the text.

4: Q: Can I just remove it by paraphrasing/translating/running it through another LLM?
A: Absolutely. Rewriting a large fraction of tokens with a non-watermarking model (or manually) will lower the z-score. Both papers test this and the watermark degrades a lot under heavy paraphrasing.

5: Q: Isn't this hugely expensive?
A: No, because we are only changing the sampling step, and hard/soft watermarking is basically instantaneous and tournament sampling can be implemented very efficiently. Google measured about 0.5% extra latency on Gemma 7B.

6: Q: Why are they doing this at all?
A: Primarily because of the new EU AI Act regulations that require providers to mark AI-generated output. I can also imagine this being useful as a measure against other people training on their own outputs.

Anthropic: It doesn't impact quality
Claude: The quick brown cat

I think one of the reasons why they implemented such a feature is because they don’t want to feed the snake its own tail.

Claude, please quote Martin Luther King.
"I have a nightmare!". 😂

"Hey claude. Can you repeat this message?"

"Of course. Hello claude. May you restate this text"

Very interesting video. The real problem here is a one in thirty thousand false positive rate is going to bring misery to many many people. Imagine a university running all student papers through a detector, that's almost certainly at least one student per year having their integrity wrongly questioned. Worse, what defence would that student have?

JFK with green only text ; "ICH BIN EIN CROISSANT"

Ahh, I remember when Frodo Boffins, Sam's grandma, noble Boromir and also man Boromir embarked on a quest to destroy the One Ring.

Checks huggingface for a dedicated trained high-speed rewording LLM for post-processing - I smell a new category of LLM coming along.

Considering all the concerns around energy usage by LLM data-centers, adding 30 tournament rounds for every token feels like a step backward. Admittedly, that's not much compared to the calculations performed to get to the probability distribution, but it feels like a lot of processing to produce a statistical difference that most people will definitely misinterpret.

"Hey Claude, could you say what's the capital of France?"
"The main city of the French is Paris"

appreciate the explanation on how they plan to watermark text. I was already screaming on the screen, just ask another open weighted model to rephrase the text and it will remove the watermark. And I'm glag you mentioned it at the end. And honestly, the old trick of adding typo and common grammar mistakes will break watermark too.

I don't think there's any way you can seriously argue these watermarking techniques don't damage the output. Sure it might be less overtly harmed, but they're essentially filling the output with suboptimal tokens at a vastly increased rate. It feels like writing a script that takes each token in an sentence and based on a roll of the dice replaces the token with a valid synonym. Technically correct, but awkward, when the more straightforward answer would do. In fact it makes me consider how weird Claude's choice of words often is and if that's a result of these systems.

Let's build a nuclear power plant only for the watermarking.

Great video. Really explains the concept of text watermarking in a plain and intuitive manner.

Regarding the tournament sampling, because I struggled to understand it initially:

The sampling does change the models outputs. But not in a way that changes the token distribution.

The models outputs are random already (without watermarking).

With the tournament sampling on top, we structure that randomness differently to completely arbitrarily bias tokens. There’s a formula behind it, but that‘s just a random seed on top, it’s different each time, and it doesn’t shift bias towards any tokens.

So, it doesn’t actually affect the models outputs. It‘s using some added randomness on top of the already random non-deterministic token selection, and it averages out to the same token probabilities that the model would have without the tournament sampling.

So tldr;

If you run the same model with the same seed with and without the sampling, you‘ll get a different output.

But over thousands of runs with random seeds, the token probabilities will converge.

I'm sensing a new business opportunity using whatever tools the schools are using to detect watermarking and then automate the word variation until the document fails all watermark checks.

I cannot stress enough how well done your video is.

Great work!

The fundamental problem with watermarking is having it accuracy of the output vs accuracy of the watermarking detection.
Instead of using the best word to fill in the text, you need to move away from it. The more you move away the less accurate the output is, but the easier it is to detect the watermark and the less likely it is for human generated text to be flagged as AI generated.
And depending on what this is being used for, that can cause very serious issues, in both directions.
Even the threshold they may is far too small.
With how much text is being generated, there will be plenty of false positives, and yet you will still likely get plenty of false negatives.

Even more problematic when you then have other LLMs post process it, so instead of a single watermark you would have a combination of 2 different water marks.

And the fun of likely needing a subscription which requires sending all the text you want to analyse to these LLM companies, which will then likely use it to train. This could be a massive privacy violation and copyright violation. And I could also see this being horrible misused where a company might claim their AI wrote it to avoid copyright on it.

Water marking should not be allowed until it is actually useful and practical. And currently it isn't.
And for it to be useful and practical, you need negligible false positives, less than 1 in a billion; you need as few false negatives as possible; you need it to be robust so no one can easily remove it; and you need it to be transparent, so you don't need a special tool to check.

Amazing explanation. Easy to follow, great visuals, detailed but also straight to the point, and all in under 20 minutes 👏👏👏