Guess which of these LLM outputs is watermarked

Join the discussion

• Hacker News
• Could do with some context on how watermarking works. Objectively speaking it should be impossible to tell.
  by NotPractical
• My sense of the concern here is that watermarking may somehow deprive someone or something of value regardless of whether or not they can tell, so I briefly pondered trying to rank these from best to worst and see if any set of those votes meaningfully deviated from ~average.

  That said, I read the first triple and found all three tortured enough that I can't be bothered with the rest.

  Call me persuaded, I guess.

  by abathur
• I disliked the fact that the experiment only covered prose, which my eyes glossed over and made me actually do random entries to pass on and see the results. I'd love to see it on a more accurate output distribution like commented code
  by elikoga
• Interestingly, it seems almost every set of three seems to follow a pattern: one passage of the three will have a key word or phrase swapped in the first sentence. That is, for every set of 3 passages, two will start with ~identical sentences, and one will have a key word or token changed.

  I caught onto this early and used it every time, and ended up getting 2/10, which is worse than random chance. I smell trickery!

  by Jowsey
• This is like giving you three outputs from md5sum and asking you to guess for which one the input ended in a "q". There's no way to tell unless you break the RNG.
  by lacker
• Please report success/failure after each test. Asking me to read and compare 30 writing samples to get any feedback at all means I won't finish. Telling me immediately when I got one wrong lets me recognize patterns and improve my guesses.
  by Noumenon72
• I've read that watermarking should in theory be impossible to detect except by the entity that watermarked it. Which is sensible, and I mostly understand at a high level.

  But what I don't know and don't understand is what happens if you watermark watermarked text. Does it test positive for both watermarks? Only the second? Indeterminate?

  Or maybe I'm misunderstanding. Can you tell that it's watermarked, but only the entity who put the watermark in place can test if it's theirs? My confusion about watermarking multiple times still stands, though.

  Regardless of what happens when you watermark multiple times, no matter the outcome, it weakens the watermark. Which, depending on the threat model, kind of makes it moot. I can't imagine a serious situation where a watermark can be weakened in any way and still be useful. Even "this came from an LLM" isn't a valid signal if you can just watermark ANY text through purely mechanical means.

  It's also not clear to me how this will affect mainstream LLMs. If all output text is watermarked, there MUST be an escape hatch. Otherwise, JSON schemas will break (or provide holes where unwatermarked text can be exfiltrated through MCP), "return this text exactly with no changes" will be impossible, and writing diffs will break.

  I feel like I must be missing something.

  by bastawhiz
• Utterly imperceptible, even when studied under the microscope in a way that LLM text very rarely is in practice.

  It will be interesting to see whose concerns are assuaged (perhaps they genuinely though mistakenly believed it would degrade quality), and whose concerns are heightened (perhaps their real objection is that their AI-generated text will become detectable).

  by fwlr