LLM Watermark Science: Entropy & Token Partitioning Lab

Parameters & Presets

Logit Bias (δ) 2.00

Additive logit bump applied exclusively to green-list candidates ($l_g \leftarrow l_g + \delta$).

Entropy Threshold ($H_{th}$) 1.20 bits

When candidate distribution Shannon entropy < $H_{th}$, watermarking is suppressed to prevent syntax errors.

Hash Window ($N$-gram) 1 token

Previous tokens salted into pseudorandom function (PRF) to partition next vocabulary into Green/Red.

Green List Fraction (γ) 0.50

Theoretical null probability that an unwatermarked token falls into the green partition.

Detection Formula (Z-Score):
$z = \frac{|G| - \gamma T}{\sqrt{T \gamma (1-\gamma)}}$
$z > 3.0$ corresponds to $p < 0.0013$ confidence of AI origin under EU AI Act transparency testing.

Dual-Track Generation & Hypothesis Test

Prose Output High Entropy 0 tokens

Green Tokens

Avg Entropy

0.0 b

Z-Score

0.00

Candidate Logits (Click token to inspect) -

Select any token above to view PRF partition & biased distribution.

Code Output Low Entropy (Masked) 0 tokens

Green Tokens

Avg Entropy

0.0 b

Z-Score

0.00

Candidate Logits (Click token to inspect) -

Select any code token to see why low entropy suppressed watermarking.

Empirical Z-Score vs Standard Normal $N(0,1)$ Distribution

Threshold $z = 3.0$ ($p \approx 0.0013$)

Edit & Evasion Attack Arena

Can an adversary erase the watermark via paraphrasing, deleting words, or refactoring code? Modify the text below to observe statistical degradation in real time.

Simulated Perturbations:

Tokens ($T$): 0

Green ($|G|$): 0

Green Ratio: 0%

Attacked Z-Score: 0.00

Detection Verdict: Watermark Intact

The Mathematics of Low-Entropy Watermark Masking

In natural prose, there are often dozens of equally expressive token candidates (high Shannon entropy $H = -\sum p_i \log_2 p_i$). Anthropic’s model uses a pseudorandom hash of previous tokens to carve vocabulary into a 50% Green List and 50% Red List, adding $\delta$ bias to green options. Because multiple valid words exist, forcing a green synonym incurs almost zero loss in coherence.

However, in computer code, syntax constraints force candidate probability toward near-deterministic spikes ($p(\text{return}) \approx 0.99$, $H < 0.5$ bits). If a watermark blindly penalized red-list tokens, it would force syntax violations or hallucinated variables. Modern LLM watermarking automatically drops bias when local entropy is low, explaining why your code remains practically unwatermarked while your essays carry an undeniable statistical signature.

Trace the saved watermark counting rules and fixture limits

Your browser does not support video.

Read the explanation

The written detector compares green count to token count times the assigned green fraction, then divides by square root of count times fraction times one minus fraction. With an illustrative one hundred evaluated tokens and fraction one quarter, expected count is twenty-five and standard deviation about four point three three. Thirty-five green tokens give z about two point three zero nine; forty-five give four point six one nine. Both bars depict z on one hundred thirty pixels per unit. These illustrative counts explain the algebra, not a measured false-positive rate or proof of authorship. The entropy simulator exponentiates synthetic candidate logits, normalizes the weights and calculates minus the sum of probability times log base two probability. An illustrative equally likely pair has entropy one bit; four equally likely candidates have two bits. Both bars use three hundred pixels per bit. The source candidate lists and logits are authored, with some randomized display values. It does not call a language model or expose actual proprietary model logits. Its cutoff suppresses the bias when candidate entropy is strictly less than the entered threshold. For illustrative entropy one point two bits and cutoff one point five, bias is suppressed. Entropy two bits is above that same cutoff and permits adding delta to green candidate logits. Both bars measure entropy at three hundred pixels per bit. Importantly the original token text is preserved, and green membership is still assigned by the same hash in both branches. This tool demonstrates candidate bias annotation, not resampling a new model output or certifying AI provenance.