Watermark LabLocal research demo

An interactive technical essay

A text watermark is a pattern in word choices

A language model creates this pattern by giving some tokens a small advantage. A token is a word or part of a word. This lab shows how the pattern grows and how edits can weaken it.

01 / One choice

The watermark changes one token choice at a time

A tokenizer splits text into tokens. Before the model picks each new token, a function uses the demo key and recent tokens to mark some candidates as preferred.

The model gives these candidates a small boost, then picks the next token in the usual way. “Preferred” only means that a token is in this group. It does not mean better, safer, or more accurate.Run your own passage next

Figure 1 · Token decision 47 / 96

What comes after “a longer”?

“passage” selected
Keyed preferred set Regular candidate
  1. passage selected11.8%25.4%
  2. time14.6%10.9%
  3. sample6.9%15.1%
  4. response8.2%6.1%

A logit is the model’s score for a possible next token. This first view is an example. A live run replaces it token by token.

02 / Generate

Start with ordinary prose

The watermark does not add a phrase, metadata field, or visible symbol. Instead, it makes preferred tokens slightly more likely across many choices.

The first run downloads a smaller, compressed version of the model. You need desktop Chromium with WebGPU. The browser then generates and checks the text locally. See how to read the score

Figure 2 · Local generation experiment

Input

Generation controls

Example state
104 / 600

The detector needs at least 32 scorable positions, called eligible positions. Longer text usually gives stronger evidence.

ModelSmolLM2 360M Instruct · compressed q4f16_1 build
MVP model
Never uploaded

The detector uses the same key to rebuild the preferred groups. This key stays in your browser, so you can inspect it. It cannot provide secure proof of origin.

Advanced parameters Balanced preset
Example readyNot yet run
0%

Your first run downloads the model. Your prompt, demo key, and output stay in this browser.

Output specimen

Watermarked generation

Example result
96 tokens22.4 tok/sδ 2 bias

A useful watermark does not hide a set phrase. It makes many small choices while a model generates text. A demo key marks some possible next tokens as preferred, and the model makes these tokens slightly more likely. Each word can still look ordinary. No single choice gives strong evidence. In a longer passage, preferred tokens appear more often than chance predicts. A detector with the same key and tokenizer can rebuild the groups and measure the pattern. Edits usually weaken the evidence instead of removing it at once.

There is no visible marker in this paragraph. The pattern comes from many choices that depend on the text before them.

03 / Accumulate

One choice is not evidence

The detector uses the same tokenizer and key to check each eligible position. It then counts how often the model chose a preferred token.

The z-score shows how far the result is above chance, measured in standard deviations. The p-value estimates how often text without this watermark would reach this score or higher. It is not the probability that AI wrote the text. Change the passage and score it again

Figure 3 · Running evidence

Signal across the passage

Strong evidence

Consistent with this exact demo key, tokenizer, and method. This is not proof of authorship.

Eligible positions
96
Preferred tokens
41 of 96
Expected by chance
24 at γ 25%
z-score
4.01 z
Approximate p-value
p ≈ 3.0e−5

Illustrative example values. Generate text to replace them with an exact local result.

04 / Disturb

Now change the pattern

When you edit text, its tokens can change. The text that comes before later tokens can also change. Shortening the text removes some evidence. Rewriting can replace preferred tokens with other tokens.

This tests how well this demo watermark survives edits. It does not describe Claude’s method or provide a general tool for evading detection. Read the limits

Figure 4 · Edit and recalculate

Editable copy

Change the generated text

35 words

05 / Boundaries

What this result can—and cannot—say

The result is a measurement, not a final verdict. To interpret it, you need the model, demo key, tokenizer, minimum length, and decision threshold. You also need the no-watermark assumption used to calculate the p-value.

  1. 1
    Group

    The demo key and recent tokens define a preferred group of candidates.

  2. 2
    Boost

    The model adds a small amount, delta (δ), to each preferred token’s logit before it picks a token.

  3. 3
    Measure

    The detector rebuilds the groups and compares the chosen tokens with the result expected by chance.

The result can say

Consistent with this setup

A strong score means the text is statistically consistent with this method, key, and tokenizer. Longer text usually gives more evidence.

The result cannot say

Who wrote the text

It cannot detect all AI text, identify every model, prove authorship, or guarantee detection after major edits. The threshold needs tests on real, unwatermarked text to measure false positives.

The trust boundary

You can inspect the browser key

The user can find any key that runs in a browser. A system that proves where text came from would need separate signing and a trusted way to generate the text.

Implementation record Expand
Model
SmolLM2 360M Instruct, compressed q4f16_1 browser build
Watermark family
Research-inspired keyed green-list logit bias
Default parameters
γ = 0.25, δ = 2; minimum 32 eligible positions; threshold z = 4
Detector output
Eligible positions, preferred tokens, expected tokens, z-score, and one-sided approximate p-value
Data handling
Static site; prompt, demo key, output, token splitting, and scoring stay in your browser