KGW Watermark: Token-Level Attribution

• KGW Watermark is a token-level watermarking method that partitions the vocabulary into green and red sets to bias token selection during generation.
• It employs statistical detection using z-tests on green-token counts, calibrated under a binomial model, to determine watermark presence in both full and mixed-source texts.
• The scheme faces challenges in low-entropy, paraphrased, and cross-lingual contexts, leading to adaptations like SSG, WaterPool, and VOW for improved robustness and verification.

The KGW watermark, introduced by Kirchenbauer et al., is a token-level statistical watermarking scheme for LLM generation in which a secret, context-dependent partition of the vocabulary into green and red sets is used to bias sampling toward green tokens, and detection later tests whether a suspect sequence contains an abnormally high green-token fraction relative to chance. Within the recent literature, KGW serves both as a baseline watermarking mechanism and as the canonical example of a keyed green-list or red-green watermark: it is computationally lightweight, compatible with standard decoding pipelines, and attractive for provenance analysis, but its effectiveness depends on token-distribution regularities that later work has shown to be vulnerable to paraphrasing, low-entropy decoding regimes, mixed-source documents, and cross-lingual rewriting workflows (Zhao et al., 2024, Gu et al., 24 Apr 2026, Ganesan, 27 Oct 2025).

1. Core statistical construction

KGW is a logit-based watermarking method. At decoding step $n$, the model produces logits $L_n$ over a vocabulary $\mathcal V$, with probabilities

$P_n=\mathrm{softmax}(L_n).$

A secret key and recent context are used to partition the vocabulary into a green set $\mathcal V^g$ and a red set $\mathcal V^r$. Green-token logits are then increased by a fixed bias $\delta>0$, while red-token logits are left unchanged: $$\tilde L_i = L_i+\delta \quad \text{if } v_i\in\mathcal V^g,$$

$$\tilde L_i = L_i \quad \text{if } v_i\in\mathcal V^r.$$

The next token is sampled from the modified distribution. In other formulations, the same idea is expressed as adding $\delta$ to the logits of tokens in a green subset $L_n$0 of size about $L_n$1, with $L_n$2 the green ratio (Gu et al., 24 Apr 2026, Huang et al., 2024).

Detection is a one-sided statistical test on green-token excess. For a candidate text $L_n$3, one common score is

$L_n$4

with sequence-level statistic

$L_n$5

Equivalent expositions write the same logic as a $L_n$6-test on green-token excess,

$L_n$7

where $L_n$8 is the number of eligible tokens, $L_n$9 the number of green tokens observed, and $\mathcal V$0 the expected green fraction under the null. Large positive $\mathcal V$1 indicates watermark presence (Zhao et al., 2024, Ganesan, 27 Oct 2025).

A central property of KGW is that it is a token-distribution watermark. Its detectability depends on the identity of generated tokens, the local sequence of token choices, tokenization and length statistics, and the detector seeing enough of the original token stream to recover the green-token bias. This dependence on exact token realizations explains both the appeal of the method and many of its later failure modes (Ganesan, 27 Oct 2025).

2. Detection, calibration, and localization in mixed-source texts

The baseline KGW detector is calibrated under a binomial null model. Under the null hypothesis $\mathcal V$2 that text is not watermarked, the green-token count follows

$\mathcal V$3

The corresponding p-value is

$\mathcal V$4

where $\mathcal V$5 is the regularized incomplete Beta function. This calibration is used not only for whole-document testing, but also as the statistical core for interval-based detectors in long documents (Zhao et al., 2024).

A major extension is partial detection and localization for mixed-source documents, where only a short span may be AI-generated. “Efficiently Identifying Watermarked Segments in Mixed-Source Texts” reframes detection as a subsequence problem and introduces two methods: the Geometric Cover Detector (GCD) for deciding whether any watermark segment exists, and the Adaptive Online Locator (AOL) for locating the segment boundaries (Zhao et al., 2024). GCD partitions a document into a geometric cover of $\mathcal V$6 intervals, tests each interval, and uses a union bound to control family-wise error; AOL treats tokenwise scores as noisy evidence and smooths them with the Aligator algorithm before thresholding the estimated latent mean sequence. For KGW-style red-green watermarking, the token score used by AOL is

$\mathcal V$7

This line of work matters because whole-document KGW detection can be overwhelmed by long stretches of human text. In the mixed-source evaluation, the watermarked span was a 300-token continuation inserted into a 3000-token context, so the watermark occupied about 10% of the document. Under this setup, GCD substantially outperformed the vanilla whole-document detector for KGW. On Arxiv with Mistral-7B, Vanilla TPR was $\mathcal V$8, whereas GCD TPR was $\mathcal V$9. For localization, AOL improved IoU over a RoBERTa baseline; on Arxiv with LLaMA-7B, RoBERTa achieved $P_n=\mathrm{softmax}(L_n).$0 and AOL $P_n=\mathrm{softmax}(L_n).$1 (Zhao et al., 2024).

These results clarify a common misconception: poor whole-document detection does not necessarily mean the KGW signal is absent. In long mixed-source texts, the more precise statement is that the signal may be diluted and require segment-aware scanning and localization.

3. Failure modes: low-entropy decoding, paraphrasing, and cross-lingual semantic bottlenecks

A recurring limitation is that KGW’s random vocabulary partitioning is not aligned with the model’s next-token probabilities. In low-entropy settings such as code generation, mathematical reasoning, and structured outputs like JSON/SQL/HTML, the next-token distribution is highly peaked. If the dominant tokens happen to land on one side of the green/red split, biasing the green set changes little about the actual sampling distribution. “SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarking” formalizes this through a token-level watermark strength

$P_n=\mathrm{softmax}(L_n).$2

with

$P_n=\mathrm{softmax}(L_n).$3

Under random partitioning, $P_n=\mathrm{softmax}(L_n).$4 can approach $P_n=\mathrm{softmax}(L_n).$5 or $P_n=\mathrm{softmax}(L_n).$6, driving $P_n=\mathrm{softmax}(L_n).$7 toward $P_n=\mathrm{softmax}(L_n).$8. The paper gives an unfavorable-event probability of approximately

$P_n=\mathrm{softmax}(L_n).$9

when the top $\mathcal V^g$0 tokens carry nearly all probability mass, which captures why KGW weakens sharply in low-entropy regimes (Gu et al., 24 Apr 2026).

Another failure mode is semantic rewriting. Paraphrasing can weaken KGW while preserving sentence length and some local lexical structure. More severe damage appears when token identity, tokenization, and length all change simultaneously. “Cross-Lingual Summarization as a Black-Box Watermark Removal Attack” argues that KGW is especially vulnerable because it is fundamentally a token-distribution watermark and therefore depends on token identity, local sequence, tokenization stability, and access to enough of the original token stream (Ganesan, 27 Oct 2025). Its Cross-Lingual Summarization as a Black-Box Watermark Removal Attack (CLSA) pipeline translates watermarked text to a pivot language, summarizes it, and optionally back-translates it, thereby imposing a cross-lingual semantic bottleneck that deletes positions, collapses synonymous realizations, shifts tokenization boundaries, and shortens the text.

The representative KGW result reported for Spanish is a collapse from baseline AUROC 0.976 to 0.584 under CLSA and 0.511 under CLSA plus back-translation. More broadly, KGW and Unigram often drop from 0.97+ AUROC to the 0.42–0.67 range depending on language and variant, with TPR at 1% FPR typically near zero under CLSA (Ganesan, 27 Oct 2025). The same paper contrasts CLSA with paraphrasing and translation-only CWRA, arguing that summarization adds a qualitatively stronger destructive effect because it also removes most token positions.

A related reassessment appears in “VOW: Verifiable and Oblivious Watermark Detection for LLMs,” which concludes that the robustness of KGW-style methods against modern paraphrasing attacks has been overestimated. Under simple synonym substitution, KGW variants still appear fairly strong, but against stronger LLM paraphrasers, especially GPT-5.1 in that paper’s experiments, AUC and TPR drop sharply (Luan et al., 30 Apr 2026). Taken together, these results indicate that KGW is most reliable for intact or lightly modified text, and increasingly fragile once semantic rewriting pipelines become strong enough to erase token-level regularities.

4. Optimization and robustness-oriented modifications

Several papers retain the KGW statistical core while modifying either vocabulary partitioning, key recovery, detection structure, or detection-time preprocessing.

Method	Core change relative to KGW	Reported KGW-specific effect
WaterPool	Replaces fragile hash-based key recovery with semantics-based retrieval in a key-centered framework	Translation attack on OPT-1.3B open text: TPR@FPR=1% improves from 29.53 to 42.26
BiMarker	Uses positive and negative poles and differential detection instead of a single green-count test	At $\mathcal V^g$1, 1% FPR: TPR improves from 0.436 to 0.498
SSG	Sorts by logit and splits adjacent high-logit tokens into different colors	On GSM8K with DSMath-7B: KGW T@1 41.7 to KGW+SSG 90.9
Signature filtering	Removes a learned set of statistically disruptive tokens before running the original test	In weak-signal and low-entropy regimes, Kgw detection rises from 8–31% to 78–99% with 2- and 3-gram filters

WaterPool decomposes a watermark into a key module and a mark module, arguing that much of the imperceptibility–efficacy–robustness trade-off is driven by the key module rather than only by the green-list mark rule. For KGW-Pool, the original KGW mark module is kept, but key restoration during detection is done by semantic nearest-neighbor retrieval over stored embeddings and keys instead of context hashing. On OPT-1.3B open text generation, translation-attack ROC-AUC improves from 85.88 to 92.15, and the often-cited robustness number is the +12.73 percentage-point gain in TPR@FPR=1% under translation attack (Huang et al., 2024).

BiMarker diagnoses a different weakness: KGW compares a single observed green count against a fixed expected baseline $\mathcal V^g$2, which can be a coarse estimate of non-watermarked behavior. Its bipolar construction alternates a positive pole that boosts green tokens and a negative pole that boosts red tokens, then detects via a difference statistic: $\mathcal V^g$3 Under the polarity ratio

$\mathcal V^g$4

the detector simplifies to a direct contrast between observed counts in the two poles, reducing sensitivity to baseline-estimation error. The paper also states that the differential detector does not worsen false positives under its Gaussian assumptions (Li et al., 21 Jan 2025).

SSG modifies the injection step rather than only the detector. Instead of random vocabulary partitioning, it sorts tokens by logit, groups the sorted list into pairs, and places one token from each pair into green and the other into red. This logit-balanced split raises the lower bound of watermark strength. For sorted probabilities with largest mass $\mathcal V^g$5, the paper gives

$\mathcal V^g$6

and derives a strictly positive lower bound on $\mathcal V^g$7 over that interval (Gu et al., 24 Apr 2026). The effect is especially large on code and math benchmarks.

Signature filtering is a detection-time add-on that leaves watermark embedding unchanged. A learned signature $\mathcal V^g$8 specifies token types or $\mathcal V^g$9-grams to remove before rerunning the original KGW $\mathcal V^r$0-test. The signature is learned via a mixed-integer linear program maximizing the number of training texts that become detectable after filtering. For Kgw-style watermarks, the paper finds that 2-gram signatures are usually the best compromise and that they often match or outperform the advanced WinMax detector under scrambling, dilution, deletions, and substitutions (Hong et al., 16 Jun 2026).

A further theoretical refinement concerns ensembles. “More Haste, Less Speed” argues that in distortion-free watermark ensembles, stronger watermarking at each layer can hurt the final ensemble because watermarking reduces entropy, and entropy is what later layers need to maintain a detectable green-ratio skew. The proposed weaker single-layer transform

$\mathcal V^r$1

preserves more entropy and can improve final ensemble detectability (Chen et al., 12 Feb 2026). Although this paper focuses on distortion-free ensembles rather than standard KGW, it extends the same red-green-list intuition and reinforces the broader point that immediate signal strength and long-horizon detectability are not always aligned.

5. Privacy-preserving and verifiable detection

Classical KGW detection assumes a centralized trust model: a user submits plaintext text to the provider, and the provider returns a watermark verdict. “VOW: Verifiable and Oblivious Watermark Detection for LLMs” treats this as inadequate for model-as-a-service auditing because the text may be sensitive and the provider may have incentives to misreport whether a text is watermarked (Luan et al., 30 Apr 2026).

VOW preserves the green-red statistical logic of KGW but replaces the detection setting with secure two-party computation based on a Verifiable Oblivious Pseudorandom Function (VOPRF). Instead of forming a green list by a pseudorandom permutation over the vocabulary, VOW defines green membership for each context-token pair directly: $\mathcal V^r$2 Generation still adds a positive bias $\mathcal V^r$3 to green-token logits,

$\mathcal V^r$4

but detection is now interactive: the client blinds each $\mathcal V^r$5, the server evaluates the VOPRF and returns a proof, and the client finalizes and verifies each result before counting greens and running a one-sided exact binomial test.

The paper formalizes three guarantees. Privacy means the server’s view is indistinguishable for any two texts of the same length. Verifiability means the server cannot make the client accept a false evaluation except with negligible probability. Computational unforgeability means a malicious user with access to the detection oracle still cannot feasibly forge a text that passes the test except with probability close to what random text would achieve (Luan et al., 30 Apr 2026). The implementation uses the RFC 9497 2HashDH construction, with non-interactive DLEQ proofs derived from Chaum–Pedersen-style techniques.

The main practical result is that verifiable and oblivious detection can still be efficient. At a stringent $\mathcal V^r$6 false positive rate, VOW reaches about 0.946 true positive rate at 75 tokens and 0.992 at 150 tokens. Detection on 500-token texts takes about 62 ms, and communication during detection has an expansion ratio around 13.5 (Luan et al., 30 Apr 2026). At the same time, the paper explicitly states that VOW is not meant to solve paraphrasing robustness; like KGW, it is brittle to paraphrasing because its signal depends on exact $\mathcal V^r$7-gram context.

6. Generalizations, applications beyond text, and current interpretation

KGW’s structure is not limited to natural-language next-token prediction. “Watermarking Game-Playing Agents in Perfect-Information Extensive-Form Games” adapts the same green-list logic to game-playing strategies by replacing tokens with actions and prompt/context with history or information set (Kim et al., 14 May 2026). At a history $\mathcal V^r$8, expected utilities over actions are perturbed by adding $\mathcal V^r$9 to green actions and a compensating negative term to red actions: $\delta>0$0 after which the chosen action is

$\delta>0$1

Detection reuses the standard green-action $\delta>0$2-score,

$\delta>0$3

In chess-engine experiments over six UCI engines, the watermark had negligible effect on strength within error margins, and detectability often required only a handful of games: Dragon after 1 round, asmFish 9 and Stockfish 17.1 after 2 rounds, and the remaining engines after 4, 8, and 9 rounds (Kim et al., 14 May 2026).

This broader transfer reinforces how KGW should be interpreted. It is not merely a specific detector, but a general statistical design pattern: create a keyed binary partition over local action choices, bias sampling toward one side, and detect a persistent excess later. That abstraction explains why later work can adapt KGW to mixed-source localization, cryptographically verifiable detection, low-entropy injection redesigns, and even perfect-information games.

The same abstraction also explains the current skepticism about using KGW alone as a high-stakes provenance mechanism. In multilingual text workflows, CLSA uses ordinary translation and summarization tools to drive detector behavior toward chance. In low-entropy regimes, random partitioning can leave watermark strength near zero. In strong paraphrasing settings, token-level context dependence becomes a liability. For that reason, the recent literature increasingly treats KGW as a useful but incomplete primitive: a strong baseline for statistical attribution, a fertile testbed for detector design, and a component that may need supplementation by semantic retrieval, better partitioning, bipolar detection, signature filtering, or cryptographic verification rather than a standalone solution for adversarial or heavily transformed outputs (Ganesan, 27 Oct 2025, Gu et al., 24 Apr 2026, Luan et al., 30 Apr 2026).