I Know You Did Not Write That! A Sampling Based Watermarking Method for Identifying Machine Generated Text (2025)

Abstract: Potential harms of Large Language Models such as mass misinformation and plagiarism can be partially mitigated if there exists a reliable way to detect machine generated text. In this paper, we propose a new watermarking method to detect machine-generated texts. Our method embeds a unique pattern within the generated text, ensuring that while the content remains coherent and natural to human readers, it carries distinct markers that can be identified algorithmically. Specifically, we intervene with the token sampling process in a way which enables us to trace back our token choices during the detection phase. We show how watermarking affects textual quality and compare our proposed method with a state-of-the-art watermarking method in terms of robustness and detectability. Through extensive experiments, we demonstrate the effectiveness of our watermarking scheme in distinguishing between watermarked and non-watermarked text, achieving high detection rates while maintaining textual quality.

## introduction transformer based large language models (llms) @xcite such as chatgpt, llama2 @xcite are able to generate texts that closely resemble human authored texts. for instance, @xcite report that untrained humans are not able to distinguish between texts generated by gpt-3 and texts authored by humans. as we train larger models with more parameters on an ever-expanding corpora, their capabilities in generating human-like text are likely to increase @xcite . with their incredible performance in text generation, they become effective tools for automating text based tasks such as summarization and translation @xcite . however, these llms pose various threats to society because they can be also used for bad causes such as generating credible-sounding misinformation @xcite , creating fake product reviews @xcite and academic plagiarism @xcite . recent studies have discovered that even though llm-generated responses may sound convincing, they can be frequently incorrect @xcite . the potential negative consequences associated with llms can be reduced significantly if a reliable detection system is in place to differentiate between machine-generated and human-written texts. a number of researchers focused on this important problem and proposed various approaches such astraining a classifier @xcite , detecting based on linguistic features @xcite and log probabilities and perturbations @xcite . data driven methods such as training classifiers requires a wide range of data with different styles, sources, and languages. currently existing perplexity based detectors are biased against non-native english writers @xcite , raising ethical concerns about their usage in real-world applications. in this paper we propose a novel model-agnostic watermarking method to detect machine generated text. in watermarking, a hidden pattern is inserted to a passage that is imperceptible to humans but can be easily detected an algorithm. in our proposal, we interfere with the randomness of sampling a new token to be generated in the decoding phase of llms. for each token to be generated, we sample multiple candidate tokens based on their probability provided by the llm and calculate a secret number for each of the candidate tokens. subsequently, we pick the token with the highest secret number value. the way we calculate the secret number enables us to retrieve the same values from generated text. and our maximization effort lets us discriminate against non-watermarked text. in our experiments, we evaluate the quality of the watermarked texts and how accurately we can detect the watermarks using various datasets and llms. we also compare our model against watermarking method of @xcite . in our experiments, we show that we are able to detect watermarked texts almost in all cases. in addition, we observe that our method based on sampling with replacement does not reduce the text quality in almost all cases while our method based on sampling without replacement yields slight decrease in text quality. in addition, we show that our proposed method is robust to token level paraphrasing attacks. the main contributions of our work are as follows. i) we introduce a novel watermarking scheme to detect machine-generated text. in our comprehensive evaluation we show that our watermarks are highly detectable while causing a slight decrease in text quality. ii) we share both our code and dataset to ensure reproducibility of our results and help other researchers build upon our findings. 1 . ## related work the remarkable achievements of large language models (llms) compelled researchers to shift their attention towards understanding their potential drawbacks and risks. we direct readers to the survey studies conducted by @xcite and @xcite for an in-depth analysis of the risks associated with llms. now, we focus on studies on detecting texts generated by llms. @xcite propose a tool gltr which works in a white-box setting and highlights texts based on probability distribution of tokens provided by the llms. they show that their visual tool improves the human detection rate of machine generated text from 54% to 72% without any prior training and without tampering with the text generation phase. @xcite also work in a white-box setting and create perturbations of the candidate text and analyze the negative curvature regions of the model's log probability function. their main hypothesis for detection is as follows. when machine generated text is modified it tends to have lower log probability. however, modifications on 1 the code will be made available soon. ## problem definition our goal is to develop a model-agnostic watermarking method to identify generated texts. let llm be a large language model and llm w is its version with watermarking feature. in addition, let t llm (p )/t w llm (p ) be a text generated by llm /llm w for the given prompt p . an ideal watermarking method should have the following properties: ## proposed methodology in this section, we explain our proposed method to generate watermarked text (section 4.1) and how to detect the watermark within a given text (section 4.2). ## conclusion and future work in this work, we propose a watermarking scheme which embeds a unique pattern into the generated text while preserving its coherence and natural readability for human readers. specifically, we modify the token sampling process of llms. in particular, we first sample multiple tokens based on probability distribution over vocabulary and then calculate a unique secret number for each sampled one. we always pick the token with the highest secret number, allowing us to trace the hints of generation process. in our experiments with multiple datasets and llms, we show that our method we show that our watermarking is detectable and reduce slight decrease in text quality. furthermore, our method outperforms @xcite 's method in terms of detectability and robustness. regarding text quality, we achieve slightly superior results compared to @xcite when applied to larger models, albeit with less favorable outcomes when dealing with smaller models. there are multiple research directions we plan to extend in the future. firstly, we plan to conduct our experiments on a larger scale in terms of data and model size and types. secondly, a more sophisticated watermark could be implemented by adaptively choosing the sampling count y based on the entropy of the output distribution. specifically, when the output distribution exhibits low entropy, we can select a smaller value for y and conversely, when the entropy is high, we can opt for a larger value. this method would ensure less perplexity on low entropy text while allowing for a stronger watermark to be embedded on higher entropy text. we leave this extension as a future work. lastly, there are no inherent obstacles to abstaining from the concurrent application of both our and @xcite 's watermarks during text generation. this would enable texts that are detectable by both watermarking methods. employing two relatively less intrusive watermarks might potentially better maintain the textual quality while preserving high detectability.