Green-List Watermarking: A Step-by-Step Look at How the Kirchenbauer Method Hides a Signal

Imagine you could tag a piece of AI-written text without changing a single visible word, then prove later that a specific model wrote it. That’s the promise behind green-list watermarking, and the cleanest version of the idea comes from a 2023 paper by Kirchenbauer and colleagues at the University of Maryland. The mechanism is surprisingly simple once you see it move, so let’s walk through it one step at a time.

Key takeaways

• Green-list watermarking happens *during* generation: before each word, the model secretly splits its vocabulary into a favored “green” set and an avoided “red” set, then nudges its choice toward green.
• The split changes every position. A hash of the previous token plus a secret key reseeds the green list each time, so the pattern looks random to anyone without the key.
• Verification is just counting. The key-holder recomputes which words should have been green and checks whether the text has too many of them, summarized as a z-score.
• It’s a probability test, not proof. A high z-score is strong evidence; a “no watermark” result tells you almost nothing.
• Editing breaks it. Paraphrasing, synonym swaps, translation, and short passages all weaken the signal.

The one idea behind it all

Every time a language model writes a word, it isn’t choosing from thin air. It produces a score for every possible next token in its vocabulary, then samples from that distribution. Green-list watermarking sneaks in between those two steps.

Right before the model picks a word, the method secretly partitions the entire vocabulary into two piles: a green list (allowed, slightly preferred) and a red list (discouraged). Then it gives every green-list word a small boost so the model is a bit more likely to land on green. Do this thousands of times across a document, and the finished text ends up with noticeably more green words than chance would ever produce. That surplus *is* the watermark.

The clever part is that nobody reading the text can see the piles. To the eye, the model just wrote fluent prose.

Step by step: how the signal gets hidden

Step 1: Hash the previous token

Before generating word number *n*, the algorithm looks at word number *n-1* and runs it through a hash function, combined with a secret key. This produces a seed.

Why bother? Because if the green list were the same every time, the pattern would be trivial to spot and trivial to strip out. By reseeding from the previous token, the green list reshuffles at every single position. The word “ocean” might make “blue” green at one spot; somewhere else, a different preceding word makes “blue” red. Without the key, you can’t predict any of it.

Step 2: Split the vocabulary into green and red

Using that seed, the method randomly colors a fraction of the vocabulary green. The original paper tests a few split sizes, like a quarter or a half of the vocabulary. To keep the math easy, picture a half-and-half split: if the model’s vocabulary has 50,000 tokens, about 25,000 become green for this one position and the rest are red.

Step 3: Nudge the scores toward green

Now comes the actual watermarking. The model already has a raw score (a logit) for every candidate word. The method adds a small constant, often written as delta, to the score of every green-list word. Nothing gets banned. Red words are still reachable; they’re just at a disadvantage.

This is what researchers call the soft watermark. A *hard* version would forbid red words entirely, but that wrecks quality, because sometimes the only sensible next word happens to be red. The soft approach keeps the writing natural while still tilting the dice.

Step 4: Sample as usual

With the boosted scores in hand, the model samples its next word the normal way. Most of the time green’s nudge wins, and a green word comes out. Sometimes the underlying meaning is strong enough that a red word still wins, and that’s fine. The watermark doesn’t need every word to be green; it only needs *more green than random*, accumulated over the whole passage.

Then the loop repeats. The new word becomes the “previous token,” it gets hashed, a fresh green list appears, and the process continues.

A mini-scenario you can picture

Say a model is writing the sentence “The lake was perfectly…” and it’s about to choose the next word.

1. It hashes “perfectly” with the secret key and gets a seed.
2. The seed colors the vocabulary: “calm” and “still” land on green; “smooth” and “flat” land on red.
3. The raw scores were close, but green’s small boost tips “calm” ahead.
4. The model writes “calm.”

Now “calm” gets hashed, a brand-new green list forms, and the model picks the word after that. With a half-and-half split, you’d expect green words to show up about half the time by pure chance. If a verifier later finds them showing up far more often than that, the gap is the fingerprint. This counting-against-chance logic has a lot in common with how detectors reason about the statistics behind AI detectors, even though watermarking and detection are different systems.

How verification works (the counting part)

Here’s the asymmetry that makes the whole scheme practical: writing the watermark needs the model, but *checking* it only needs the text and the key.

A verifier walks through the document token by token. For each word, it hashes the previous token with the same secret key, rebuilds the exact green list that the model would have used, and asks one question: was this word green or red? It tallies the greens.

Then it runs a simple statistical test. If green words appear at roughly their natural rate, the text is probably not watermarked. If they show up far more often than chance allows, that’s the watermark.

The result is usually reported as a z-score, a measure of how many standard deviations the green count sits above what randomness predicts. Think of flipping a coin 100 times. Heads 52 times? Boring. Heads 90 times? Something’s rigged. A large z-score means the green surplus is so extreme that plain luck basically can’t explain it. And here’s the part that makes it cheap: this needs zero access to the original model, no fancy classifier, and barely any computation, just a hash and some arithmetic.

Why it’s a probability, not a verdict

It’s tempting to treat a watermark check as a smoking gun, but the math doesn’t support that.

A *high* z-score is genuinely strong evidence, often far stronger than what a typical AI detector can offer, because the test is grounded in a known, deliberate mechanism rather than guesswork about style. But a *low* z-score means almost nothing. Every human-written document on earth is unwatermarked, so “no watermark found” is the default outcome for nearly any text you feed it. Absence of a signal is not evidence of human authorship.

There’s also the verification barrier. You can only run this check if you hold the secret key and know the exact hashing setup. Schools, employers, and random websites don’t have those, which is why they reach for AI detectors instead. Those tools estimate AI-likeness from writing patterns and spit out a probability, a fundamentally different and noisier process. If you want a fuller picture of how the field thinks about all of this, you can browse the rest of our writing on how detection works.

What weakens or breaks the watermark

Because the signal lives in the specific tokens the model chose, anything that changes those tokens chips away at it.

• Paraphrasing. Reword a sentence and you replace green words the verifier expected with new ones it didn’t, dropping the green ratio back toward chance.
• Synonym swaps. Trading “calm” for “tranquil” can flip a green token to red, and a few dozen of those add up fast.
• Translation. Running text through another language and back scrambles the token sequence almost entirely.
• Short passages. With only a handful of tokens, even a real watermark can’t build a z-score high enough to stand out from noise. Fewer data points, weaker statistics.
• Mixing in your own writing. Interleaving human-written sentences dilutes the green concentration across the whole document.

None of this is a magic eraser, and researchers keep working on more robust variants. But the general principle holds: the more a text is edited away from the model’s exact output, the fainter the signal becomes.

The bottom line

Green-list watermarking is one of the most elegant ideas in this space: split the vocabulary in secret, nudge toward green, then prove the bias later by counting. Understanding it strips away a lot of the mystery and fear around “AI tags,” because you can see exactly what it can and can’t establish. It’s a probability test tied to a specific key, not an omniscient lie detector.

If you want to see how your own draft reads to the detection tools schools and editors actually use, run your draft through PaperBleach and check the signal before anyone else does.