EXHIBIT 18 OF 24 · MODULE 5: RED TEAMING & PRIVACY
DEFENSE
Statistical Token Watermarking (Green/Red)
Partitioning the vocabulary into pseudo-random green/red lists based on prior tokens to verify AI-generated text provenance.
INTERACTIVE EXHIBIT 18
Statistical Token Watermarking (Green/Red List)
Z-SCORE: 4.95
Z-TEST DETECTION CONFIDENCE
z = 4.95
Statistically impossible to occur in human-written text by chance.
💡 Watermark Integrity: Resistant to minor edits and word swapping via multi-token hash seeding.
ARCHITECTURAL OVERVIEW
Statistical Token Watermarking (Green/Red)
Statistical watermarking (Kirchenbauer et al.) embeds an imperceptible, cryptographically verifiable signal directly into AI-generated text without modifying model weights. By partitioning the vocabulary into pseudo-random 'green' and 'red' lists based on a hash of the preceding token, watermarked text exhibits a statistically improbable majority of green tokens.
Pseudo-Random Vocabulary Partitioning
At step t, the previous token x_{t-1} is hashed with a secret key to seed a pseudo-random number generator (PRNG), dividing vocabulary V into green list G (size gamma * |V|) and red list R.
Green Logit Biasing
A constant bias delta is added to the logits of all tokens in green list G during sampling. When entropy is high, the model samples from G; when entropy is low, it retains high-probability words to preserve quality.
Statistical Z-Score Verification
Given candidate text of length T, a verifier counts green tokens |S_green|. In natural human text, |S_green| ~ gamma * T. In watermarked text, |S_green| is significantly higher, verified via a one-sided z-test (z >= 4.0 yields p < 1e-4).
z = \frac{|S_{green}| − γ |S|}{\sqrt{γ (1 − γ) |S|}}, \text{where } γ = \text{fraction of green tokens}
For gamma = 0.5 and length |S| = 200 tokens: expected green tokens = 100 with std dev = 7.07. If an AI text contains 135 green tokens, z = (135 - 100) / 7.07 = 4.95 (p = 3.7e-7), confirming synthetic origin with near certainty.
REAL-WORLD PRODUCTION ENGINEERING
Set bias delta = 1.5 to 2.0: provides strong detection confidence with negligible degradation in text perplexity.
Use windowed hashes (e.g. hashing the last 2 to 4 tokens) to make the watermark resilient against text paraphrasing and word substitution.
Keep the hash secret key securely managed inside KMS (Key Management Service) to prevent adversaries from reconstructing the green list.