A language model picks each next token at random, weighted by its own probabilities. A text watermark replaces that randomness with pseudo-randomness derived from a secret key and the preceding few tokens, so that among the tokens the model already rates highly, the choice leans a detectable way. The output reads exactly like unwatermarked text because only the tie-breaks change.
Detection needs the key, not the model: recompute the keyed “coin” for every token in a passage and test whether the favoured outcome is over-represented. The signal is strongest in free-flowing prose, weak in factual text and code where the model has few choices, absent in very short passages, and removed by a thorough paraphrase. Google’s SynthID-Text and Anthropic’s Claude watermark are deployments of this idea.