A text watermark can introduce a statistical signal while a model chooses its next tokens. A later detector looks for evidence of a configured pattern. Understanding that connection requires more than counting words that seem unusual: the choice probabilities, marking rule and detector configuration all matter.

The 2023 watermark paper's abstract describes softly promoting randomized green-token choices. [1] Google's SynthID guide describes another configured system with probabilistic detection. [3] We will not reproduce either implementation. Instead, an original three-symbol sampler makes one kind of soft preference completely visible: multiply selected probabilities, then divide by the new total.

That small calculation reveals why doubling a weight does not necessarily double a probability, why equally sized marked groups can have different probability mass, and why a detector must identify its configuration. A separate twelve-position example then shows where a count-based inference needs a stated null. No real passage, language model or detector was run. The examples explain a measurement; they do not decide who wrote a document or whether its facts are correct.

Connect the generation intervention to the later measurement before interpreting a watermark result. A count depends on the token representation and marking configuration, while a probability statement additionally depends on a reference distribution. Neither is fully specified by a statement that some fraction of vocabulary entries is marked.

The PMLR 2023 abstract motivates soft promotion of randomized green-token choices. [1] The retrieved SynthID guide describes a distinct configured probabilistic system. [3] Our original finite sampler uses fixed symbolic categories and an explicit multiplicative weight. It is not the PMLR algorithm, a SynthID implementation or an empirical model evaluation.

We derive its normalization, conditional green mass, support boundaries and configuration-dependent counts, then compare separate fully declared null models for twelve indicators. This focuses on the relationship between a token choice and what a detector counts. All distributions and symbols are invented for transparent arithmetic. No model execution, secret watermark configuration, observed human writing or real-world detector performance is supplied.

Generation-time watermarking changes how a system produces text so a later procedure can look for a pattern. DeepMind's May 2024 explanation describes adjusting token probabilities and comparing resulting score patterns. [5] The useful distinction is between adding a signal and measuring evidence for it afterward. Neither operation is performed merely by looking at whether a paragraph sounds formal or uses familiar expressions.

The green-token idea in the earlier paper is one example, not a dictionary of words that always reveal AI use. [1] For this article, green will simply be a name for an indicator scored one. We do not give English words permanent colors, choose a real secret configuration, or turn our count into a functioning watermark detector.

Imagine receiving a number without the scheme name or scoring rule. Even if the arithmetic behind the number is correct, its meaning is unfinished. You need to know what was measured and what comparison made that measurement unusual. A signal can be useful evidence while still requiring this description of its scope.

Separate the embedding mechanism from the detection statistic. The historical DeepMind account places its intervention in token-generation probabilities and describes a later comparison of score patterns. [5] Our use of binary membership indicators is an analytical simplification, not a specification of SynthID's scoring function or an assertion that all watermark schemes use the same green-list calculation.

The PMLR abstract motivates randomized promotion of selected tokens. [1] It does not justify deriving a universal fixed list of suspicious words. A detector's token processing and configuration determine the actual measurement; a textual resemblance judgment supplies different information. We first declare a categorical choice and reweighting rule, then separately define count experiments. None of those steps claims to reproduce the actual source systems.

This boundary matters for reproducibility. Two procedures can assign different scores to the same visible passage because their representations or rules differ. Agreement on a final percentage therefore cannot be assumed to mean agreement on the underlying event. Preserve the measurement definition before comparing results, and distinguish evidence about a configured generation signal from an unsupported attribution of a writer's identity or intentions.

Give our invented generator three possible next symbols: A, B and C. Their starting probabilities are one-half, one-quarter and one-quarter. Mark B as green and multiply its weight by two, leaving the other weights alone. The new weights are one-half, one-half and one-quarter. They add to five-quarters, so they are not yet probabilities.

Divide every weight by five-quarters. The resulting probabilities are two-fifths for A, two-fifths for B and one-fifth for C: 0.4, 0.4 and 0.2. They now add to one. B became more likely, but its probability rose from 0.25 to 0.4, not to 0.5. Renormalizing the entire distribution changed the other choices as well.

This is an original example of a soft preference, motivated by the abstract's promotion idea. [1] It does not force B on every draw. A and C remain possible, and one sampled B would not by itself establish that the preference was active. The source of a single outcome and the distribution that made it possible are different questions.

Let the original categorical distribution be p=(1/2,1/4,1/4) over ordered symbols (A,B,C), with fixed green set G={B}. Define weights wᵢ=2pᵢ for i∈G and wᵢ=pᵢ otherwise. This is our stipulated transformation; the paper's abstract motivates soft promotion but supplies none of these invented values. [1]

The normalizer is Z=1/2+1/2+1/4=5/4. Dividing by Z yields p′=(2/5,2/5,1/5). Thus a factor-two weight changes B's probability from 1/4 to 2/5. The factor acts before normalization, so neither the green probability nor the full output vector can be read directly from the unnormalized weights.

All weights are finite and nonnegative, and the positive normalizer makes the result a valid categorical distribution. The transformation preserves possible outcomes in this construction: every positive original probability remains positive. The new distribution overlaps completely with the old one. Consequently, observing a particular symbol does not determine which distribution produced it; detection would need a specified statistic and an appropriate evidential comparison.

In the same three-symbol vocabulary, both {A} and {B} contain one entry. Yet their starting probabilities differ: A carries one-half of the total probability and B carries one-quarter. The fraction of vocabulary entries marked green is one-third in both cases, but that fraction is not the probability of drawing a green symbol under these fixed lists.

With the factor-two rule, marking A gives green probability two-thirds, while marking B gives two-fifths. The difference comes from the starting probability mass, not a change in the number of marked entries. To generalize this particular calculation, call the starting green probability q. The unmarked group has probability one minus q; after doubling the green weight, the new green probability is 2q divided by 1+q.

This calculation conditions on the declared fixed list. A procedure that randomly chooses a list introduces another source of randomness. Its average behavior needs that selection rule too. Our example does not invalidate a real scheme's analysis; it shows why a report must say which probability question and which conditions it is describing.

Write q=Σᵢ∈G pᵢ for green probability mass under a fixed categorical distribution and fixed set G. With multiplier 2, the normalizer becomes Z=2q+(1−q)=1+q, and the transformed mass is q′=2q/(1+q). For 0<q<1, green-versus-nongreen odds are doubled: q′/(1−q′)=2q/(1−q). The probability itself is not generally doubled.

For G={A}, q=1/2 and p′=(2/3,1/6,1/6), giving q′=2/3. For G={B}, q=1/4 and the earlier vector gives q′=2/5. Both sets have cardinality 1 in a vocabulary of size 3. Cardinality fraction and probability mass are different quantities when the categorical distribution is nonuniform.

These are conditional fixed-list calculations. If G is randomized, an unconditional probability must additionally average over its specified selection law and any relevant dependencies. The PMLR abstract explicitly describes randomized token-group selection. [1] We do not replace its analysis with the fixed-list construction or assert a null for that method. We use the distinction to identify the assumptions a count-based detector description must preserve.

Try another original starting distribution: A has probability 0.9, and B and C each have probability 0.05. Keep only B green and use the same factor of two. The new weights add to 1.05. Dividing by that total gives B a probability of 2/21, about 0.0952. B becomes more likely, but it still occupies a smaller share than it did in our first example.

Now take a limiting case in which A has probability one and B and C have probability zero. Multiplying B's zero weight by two still gives zero. The normalized result remains A with certainty. There is no available B probability for this particular rule to increase. Similarly, if the starting choice is already entirely green, its green probability stays one.

These cases show a support boundary of our finite multiplier, not a measured limit of any product. They make no claim that a factual prompt has exactly one possible token or that our symbols represent correct answers. A change in probability mass also does not measure the quality, factual accuracy or style of the resulting text.

For the second original distribution p=(9/10,1/20,1/20), G={B} gives q=1/20 and Z=21/20. The transformed vector is (6/7,2/21,1/21), so q′=2/21≈0.095238. The multiplier remains 2, while the green mass and resulting probability change with the starting distribution.

At q=0, q′=0; at q=1, q′=1. More directly, multiplying a zero category weight by any finite positive factor leaves it zero. Our transformation therefore preserves the support of p. For p=(1,0,0) and G={B}, the output remains (1,0,0). This is an algebraic property of the specified multiplier, not a guarantee for methods that perform additional operations or use different interventions.

The examples deliberately avoid equating distributional changes with semantic outcomes. A token's factual appropriateness, stylistic effect or contribution to meaning is absent from the three-symbol model. Historical statements about response-type coverage require their own scope. The calculation establishes only how available probability mass constrains this particular reweighting and why a fixed multiplier cannot be interpreted as a fixed detection strength across all starting distributions.

Write down the six-symbol sequence A B A C B A. Under the fixed rule that only B is green, positions two and five count, giving two green results. Under the different fixed rule that only A is green, positions one, three and six count, giving three. The sequence has not changed. The measurement rule has.

Neither number is an error if it is reported with the rule that produced it. The mistake would be to compare one number with a threshold calibrated for the other configuration as though the two were the same measurement. This little example has no real tokenizer, key or detector; the symbols and fixed lists are fully declared so the accounting can be checked by hand.

A useful report therefore identifies its configuration and the input span. It also distinguishes a detector producing a result under its intended configuration from someone applying an unrelated rule to the same visible text. A watermark result needs that connection between generation and measurement before broader claims about the source of the material can be assessed.

Use the original fixed sequence S=(A,B,A,C,B,A). Define K_G(S)=Σ1{Sᵢ∈G}. Then K_{B}(S)=2 from positions 2 and 5, while K_{A}(S)=3 from positions 1, 3 and 6. These are exact deterministic counts conditional on two declared fixed sets. No probability distribution over S is needed to verify them, and no probability of authorship follows from them.

The example changes only G while keeping S and its six-position span unchanged. Consequently, a score discrepancy can reflect a configuration discrepancy rather than different source content. A threshold or calibration belongs to the measurement procedure that defines its statistic. Carrying it across incompatible scoring rules would require a separate justification.

The real configuration requirements remain scheme-specific. Our fixed-list example is not a claim that a production scheme uses one permanent list across all contexts or that its complete identity can be expressed by a single set. It isolates the simpler dependency: naming the input does not fully identify the measurement. Preserve the intended detector configuration and its coverage as well, without exposing private watermark material.

Our example has twelve positions. Each receives either zero or one; call a one green. The count K is the number of ones. Under our invented comparison model, each position has a one-half chance of being one, and the twelve choices are independent. Independence means that learning one position's result does not change the probabilities we assigned to the others.

Those assumptions produce 4,096 possible ordered zero-and-one strings, all equally likely. The number comes from multiplying two choices twelve times. A string with ten ones is not more likely than any particular string with six ones. However, there are many more different strings with six ones, so the probability of a count depends on how many strings produce it.

This comparison model is called our null. It is not a claim that ordinary human writing behaves like twelve independent coin flips, or that actual watermark scores always obey this model. We choose it because every outcome can be inspected and counted. Any later probability must retain these assumptions rather than quietly becoming a measurement about real documents.

Let I₁,…,I₁₂ be independent Bernoulli variables with P(Iᵢ=1)=1/2, and define K=ΣIᵢ. This explicitly declared null H₀ assigns probability 2⁻¹² to each vector in {0,1}¹². The sample space therefore contains 4,096 equiprobable vectors. K has the binomial count distribution generated by that construction, with P(K=k)=C(12,k)/4096.

This formula follows by choosing which k of the twelve positions contain ones. It is not imported as an empirical distribution of language. Our original script enumerated every vector and independently compared the count histogram with the combination formula. That verifies the finite calculation, not the suitability of H₀ for any particular watermark implementation or population of unmarked text.

The distinction between vector probability and count probability is essential. A specific ten-one vector and a specific six-one vector have equal probability under H₀, but the sets associated with those counts have different sizes. The statistic discards positional ordering while retaining K. A tail probability must sum the probabilities of all included vectors, according to a rejection direction declared before the observation is interpreted.

Suppose the rule flags a result when K is at least ten. Exactly ten ones can occur in 66 different strings: choose the two positions that hold zeros. Exactly eleven ones has twelve possibilities, and twelve ones has one. The flagged set therefore contains 66 + 12 + 1 = 79 strings out of 4,096.

The chance of a flag under this null is 79/4096, about 1.9287 percent. Notice the words at least. A rule requiring more than ten includes only eleven and twelve, giving 13/4096, about 0.3174 percent. The boundary is part of the rule, not a minor formatting choice. Two reports using different boundaries are calculating different events.

If we observe ten and use larger counts as the more extreme direction, the upper-tail p-value in this construction is 79/4096. It includes counts eleven and twelve even though ten was the observed count. Reporting only the chance of exactly ten would answer a different question. All of these values remain conditional on the independent fair-position model we declared.

The assumed green probability also matters. If twelve independent positions instead each have green probability one-quarter, the same at-least-ten event has probability 631/16,777,216, about 0.003761 percent. That separate model could describe independent repeats of our unmodified first sampler with B green. It does not describe the fair-position model, and it is not a measured rate for language. The observed count alone cannot choose between those reference assumptions.

Define the rejection event R₁₀={K≥10}. Its cardinality is C(12,10)+C(12,11)+C(12,12)=66+12+1=79. Thus α₁₀=P₀(R₁₀)=79/4096=0.019287109375. The denominator is the complete equiprobable sample space, not the number of observed documents or the length of a real detector evaluation set.

For an observed k=10 and an upper-tail ordering, p(k)=P₀(K≥k) equals α₁₀. By contrast P₀(K=10)=66/4096 omits more extreme counts. Also, K>10 is a different rejection event, with probability 13/4096. A reproducible result must preserve the statistic, tail direction and inclusive or exclusive threshold.

The finite construction connects a p-value at a specified observation with the null probability of its corresponding threshold event. It does not equate all p-values with measured false-positive rates. In particular, no real unmarked corpus was sampled here. Applying this numerical α to a real detector would first require evidence that its scoring and null assumptions match this model, an empirical and methodological question that our enumeration does not settle.

For the distinct independent null with q=1/4, P(K≥10)=(66×3²+12×3+1)/4¹²=631/16,777,216≈0.00003761053. The factors 3 count nongreen probability weight in this expansion; its binary vectors are not equiprobable. This can model independent fixed-distribution repeats with the original p=(1/2,1/4,1/4) and G={B}. It is neither the q=1/2 null nor a general model of autoregressive text. A count and a list-cardinality fraction alone do not select the correct null.

Now change just one assumption. Choose a single fair zero-or-one result, then copy it into all twelve positions. Every individual position still has a one-half chance of being one. Yet the count is now either zero or twelve; no middle count can occur. The at-least-ten rule flags half of these outcomes, giving 50 percent instead of about 1.9287 percent.

The average count remains six in both constructions. Knowing each position's individual probability, or even knowing the average total, therefore does not determine the tail. The relationship between positions matters. Counting twelve copies of one result as twelve independent pieces of evidence would use the wrong model for this second construction.

This is an exact counterexample, not a claim that any real watermark behaves in this extreme way. It shows why independence needs justification. A detector's treatment of context and repeated material belongs in its definition; it should not be replaced by an assumption that every visible word supplies a fresh and independent trial.

Let B be Bernoulli(1/2), and define Iᵢ=B for all twelve positions. Each marginal remains Bernoulli(1/2), but K=12B. Hence P(K=0)=P(K=12)=1/2 and P(K≥10)=1/2. This differs from 79/4096 despite identical individual success probabilities and E(K)=6.

The variance also exposes the dependence. Under the independent null, Var(K)=12×1/4=3. Under the copied-result model, Var(K)=144×1/4=36. Marginal distributions do not fix the joint distribution, and the joint distribution determines the tail of their sum. The enumeration and this two-outcome construction are analytically separate probability models.

We do not assert that real watermark scores are perfectly correlated or that their null is necessarily binomial. The counterexample rejects only the unsupported inference from equal marginals to independent evidence. A practical detector must define how eligible positions and dependencies enter its statistic or calibration. Our simplified count cannot substitute for that implementation-specific analysis merely because it is easy to compute.

A passage's visible length is not automatically the number of observations used by a detector. The SynthID guide describes treatment of repeated contexts and names configuration values used by its scoring process. [3] That is a reason to preserve the actual scoring setup, not a reason to assume our twelve-bit arithmetic applies directly to that system.

For an invented bookkeeping example, suppose a procedure examines twelve recorded positions but declares only eight eligible. A report saying twelve independent trials would already describe the wrong input, even before anyone calculates a probability. This example provides no probability for the eight positions; their dependence and scoring rules have not been specified. A count of eligible positions is necessary information, not a complete statistical model.

The guide also places conditions on sharing a detector across models, including a common tokenizer and appropriate detector-training examples. [3] Record that coverage rather than treating one familiar product name as evidence that every model or text transformation is covered. Matching the detector to its intended measurement is part of interpreting its result.

Distinguish raw length, token count, eligible positions and effective statistical information. The retrieved SynthID guide describes repeated-context handling and configured scoring; it also conditions shared detector use on tokenizer and detector-training coverage. [3] These are scheme-specific facts, not a derivation of an independent Bernoulli null for arbitrary text.

Consider an original bookkeeping case with twelve recorded positions and an eligibility mask selecting eight. This identifies the statistic's possible inputs but supplies no joint law for the selected scores. Neither eight nor twelve may be inserted into a binomial tail without the additional assumptions that make that distribution applicable. Selection may also depend on context; a detector record should retain the rule rather than infer it from the rendered paragraph.

Configuration matching is an evidential boundary. Preserve the relevant tokenizer, scoring revision, configured detector identity and coverage information without exposing private watermark material. Two runs with incompatible configurations are not interchangeable observations. We provide no parameter-tuning prescription, model execution or procedure for removing a watermark; the question here is whether a reported result identifies the procedure that actually produced it.

The SynthID developer guide describes watermarked, not watermarked and uncertain outputs controlled by two thresholds. [3] Our teaching example uses a single flagging boundary instead, so it does not reproduce those three states. A result should retain the system's actual label and meaning rather than being forced into a stronger conclusion for the sake of a neat report.

A negative result from a test for a particular signal does not establish that no AI contributed. That broader statement includes sources and workflows the test may not cover. Likewise, an uncertain result is not a quiet positive or a quiet negative. It records that the procedure did not supply one of its other determinations under its stated rules.

DeepMind's historical explanation also distinguishes response types with different opportunities to carry its signal. [5] We do not turn that observation into a numerical performance claim. The practical lesson is to name coverage and limits alongside the result, so absence of a detected mark is not presented as proof of a complete human-only writing history.

The retrieved SynthID guide exposes three probabilistic detection states using two thresholds. [3] Preserve that interface distinction: our binary R₁₀ construction has a different decision space and cannot assign meanings to the deployed system's intermediate state. No numerical confidence or threshold from that system is inferred from our twelve-position table.

Negative evidence is relative to the tested hypothesis and procedure. Failure to detect a configured signal does not logically exclude every alternative AI generation process, mixed-source document or editing history. An uncertain state likewise does not identify either class without an additional decision policy. That policy should be explicit rather than silently relabeling unresolved cases.

Historical coverage statements also require their original scope. The May 2024 DeepMind account notes variation across response types. [5] It does not supply this article with a current deployment-wide error rate. Our report therefore distinguishes configured-signal detection, supported input scope and unknown provenance. This keeps the absence or ambiguity of one measurement from being inflated into a universal authorship conclusion.

A useful result record identifies the exact tested text or a suitable reference to it, the selected span, the detector and its configuration identity, and the score and decision rule. It also says which null or calibration supports the number and how many opportunities to test were considered. Keep sensitive configuration material private; a record can identify a setup without publishing its secret values.

For our sampler, retain the starting three-symbol probabilities, fixed green set, multiplier and normalizer. For each separate count experiment, retain the eligible positions, joint probability assumptions and threshold. The same sequence can have different scores under different configurations; the same score can have different tail probabilities under different reference models. Mixing those records would hide the conditions that give each number its meaning.

A small null tail is not a probability that a named person did or did not write the text. Nor does checking a generation signal verify the statements in a passage. Report the configured result and any uncertainty, then use source checking and appropriate provenance to address those other questions. The arithmetic can make a measurement understandable without pretending to settle a document’s complete history.

Retain input identity and span selection, representation and eligibility rules, detector/configuration revision, statistic, tail or calibration definition, thresholds, and the family of tests considered. Private configuration values need not become public metadata. Record sufficient controlled information to reproduce the authorized procedure while preserving the scope of its measurement.

The original artifacts calculate exact categorical reweighting, green mass, support endpoints and the two configuration-dependent counts. They separately enumerate all 4,096 binary vectors for the fair null, check the count histogram, calculate the quarter-green weighted tail and derive the copied-Bernoulli counterexample. These are mathematical constructions, not retained model outputs or empirical detector trials.

A defensible conclusion stays attached to those assumptions. A conditional null tail is not a reverse-conditional authorship probability; a generation-associated statistic is not a semantic truth predicate. The score does not encode creator identity, quotations or a composite editing history. A deployed result needs its own calibration and coverage information, while factual verification and attribution need their own evidence. Preserve those separate questions rather than turning a configured detection result into a universal verdict.