Green-List Token Bias and Its Role in Watermark Detection

Green-list token bias is a deliberate statistical distortion built into the KGW watermarking scheme at the moment each token gets chosen, and the entire detection apparatus built on top of it exists to measure that distortion precisely.

What the KGW scheme does at the token level

At every step a language model produces a set of logits, one score for each word or sub-word in its vocabulary. The KGW scheme takes the token that came just before and runs it through a hash function along with a secret key. That hash splits the entire vocabulary into two groups: a green list and a red list. The size of the green list is set by a parameter called gamma, so gamma fixes what fraction of the vocabulary counts as green at any given step.

Once the split happens, the scheme adds a fixed amount, delta, to the logit score of every green token. The model then samples the next word from this adjusted distribution, not the original one. The exact rule is simple: a token's modified logit equals its original logit plus delta if it sits in the green set, and equals its original logit, unchanged, if it sits in the red set.

Because the hash depends on the preceding token and a secret key nobody outside the system holds, there is no way for an outsider to know which tokens were green at any particular position without that key. A person reading the text cannot point to word seventeen and say "that one was pushed." The green-red split looks arbitrary from the outside, by design.

That tension between a detectable signal and a natural-sounding document is built into the scheme from its first design choice, and it is what makes measurement possible.

The z-test's conversion of green-token bias into a detection score

Since delta pushes green-token selection up at every position, a document generated this way ends up with more green tokens than you would expect from chance alone. The z-test exists to measure exactly that excess.

The formula is straightforward: z equals the observed count of green tokens, minus gamma times the total number of eligible tokens, divided by the square root of gamma times one minus gamma times the total token count. KGW's own documentation lays out the decision rule directly, reject the assumption of no watermark, and classify the text as machine-generated, once z crosses a set threshold, called M. From there, a p-value gets computed using the regularized incomplete Beta function.

The relationship is direct: more green tokens relative to what gamma predicts produces a higher z-score, and a higher z-score gives the detector more confidence that a human did not write the text. Longer documents give the test more tokens to count, and more tokens means more statistical power, so the same per-token bias becomes easier to detect as the document grows.

It is checking for a single specific thing, an excess of green tokens, because that excess was planted intentionally by the generation process. None of this requires reading the text for sense or meaning. It does not care if the essay is well-argued, badly argued, about astrophysics or about sandwiches. That indifference to content is precisely what makes a single model's output traceable no matter what it says.

How green-list bias accumulates into a document-wide fingerprint

The fingerprint left by KGW watermarking does not sit in a handful of suspicious words that a careful editor might spot and cut. It is spread across every position in the document, and that spread is what makes the mark hold up against ordinary human revision while still being detectable with real confidence over a long enough stretch of text.

Each position gets its own green-red split, because the hash depends on the token immediately before it. The signal spreads through the whole sequence.

Length works in the detector's favor here too. A document twice as long does not need twice the bias to produce a stronger detection score.

Changing one token in the middle of a document, because the green-red split depends on the token before it, gives every position after that edit a different green-list assignment than it would have had. Understanding that the fingerprint lives everywhere, statistically, rather than in any single sentence, is the starting point for understanding what it would actually take to remove it.

Low-entropy positions and mixed-source text: where the KGW detection model breaks down

The z-test rests on assumptions about how text behaves, and real-world text regularly breaks those assumptions. The fingerprint is not equally reliable at every position or in every kind of document, even when nobody is trying to defeat it.

Low-entropy positions are one weak spot. If an unmodified token already carries a probability near 1.0, adding delta to its logit barely changes anything, because there was almost no room to push it higher. The green-list test at that position carries almost no information, since the model would have picked that word with or without the bias.

Mixed-source documents create a different kind of problem. Tools built specifically to address this, the Geometric Cover Detector and the Adaptive Online Locator, exist precisely because the aggregate z-test misses these cases, though both require extra computation and careful calibration to run.

None of this is a rare corner case. Mixed-source documents are the normal output of editorial workflows where writers draft with AI assistance and then layer in their own sentences, cut sections, and rearrange paragraphs.

How deliberate evasion attacks target the green-list signal directly

Since the entire KGW fingerprint comes down to green-token excess, anyone who manages to push that excess back under the detection threshold has defeated the watermark, and researchers have built increasingly efficient ways of doing exactly that.

Evasion methods split into two broad categories, depending on whether the attacker needs access to the watermarked model itself. Query-free attacks skip all of that. They work directly on the finished text in a black-box setting, needing nothing but the output itself.

Even the simplest query-free method poses a real threat. A newer method, called BIRA (the Bias-Inversion Rewriting Attack, published in 2025), goes further by working against the KGW mechanism directly, targeting the green-list bias itself. Tested against one widely used language model, BIRA reaches near-complete attack success, well beyond what plain paraphrasing achieves. The mechanism does not require knowing the actual green list, only a proxy for it. It works in realistic black-box conditions where an attacker has no inside knowledge of the watermarking key.

The strongest pushback against this entire line of argument is that evasion comes at a cost: you can dodge the detector, but only by damaging the writing itself. That objection deserves to be taken seriously. The evidence only partly settles it. BIRA's own reporting acknowledges a trade-off between evasion success and text quality, and the paper argues that trade-off can be managed. A separate ICML 2025 paper by Diaa and colleagues raises a harder problem: robustness claims for watermarking schemes have generally been tested only against attackers who do not adapt their methods to the specific watermark in use. That means published robustness numbers may not hold once a real, adaptive attacker is in the picture.

Single-model pipelines are structurally traceable regardless of content quality

Put the mechanism, the detection test, and the evasion landscape together, and a single structural fact emerges: traceability in KGW watermarking comes from the architecture of single-model generation, not from anything about how good or bad the resulting text happens to be.

When one model generates an entire document under one secret key, every token in that document was drawn from the same biased distribution. The z-test does not grade prose. It counts green tokens.

Existing watermarking schemes were largely built with this single-model picture in mind. They were not built to trace how information moves across multiple models working together in a pipeline. That limitation is explicit in the research itself: these methods are typically designed for single-model settings rather than tracing information flow across multiple agents.

Once multiple models each apply their own green-list bias at different stages of a pipeline, that single coherent signature disappears. The leading evaluation metrics for LLM-based creative agents in 2026, including style adherence, brand voice consistency, and human preference score, are all put under strain by naive multi-model combination. Getting this right is as much a quality problem as it is a compliance one.

Regulatory mandates have made green-list traceability a compliance exposure, not just a technical curiosity

The statistical fingerprint that makes KGW watermarking detectable is now also the subject of binding regulation, and that regulation puts content teams in a genuinely difficult spot between provenance obligations on one side and evasion pressure on the other.

Enforcement of Article 50 of the EU AI Act began on August 2, 2026, requiring providers of generative AI systems to mark synthetic output in a format machines can detect. Violations carry fines up to €15 million or a percentage of a company's global annual turnover.

The EU's Code of Practice on AI-Generated Content spells out what compliance actually requires: two mandatory layers, digitally signed metadata and imperceptible watermarking, with forensic fingerprinting and logging treated as optional rather than required, and visible disclosure handled as a separate obligation that falls on deployers. The practical effect of the rule splits the industry in two: proprietary API providers can enforce watermarking strictly at the point of generation, while open-weight model ecosystems have a much harder time enforcing anything, since nobody controls every point where the model might run.

This gap has already started attracting commercial solutions. In August 2026, Rezolve AI introduced a patent-backed, model-agnostic platform that combines signed C2PA Content Credentials, secure provenance records, and watermarking embedded directly in content, part of what is described as a fast-growing digital provenance market. Detaching a manifest from its content is straightforward, and researchers have documented ways to bypass C2PA protections entirely by stripping or forging watermarks and mimicking the digital fingerprints meant to prove authenticity. That weakness is the reason the real compliance question sits in the watermark architecture itself, not in whatever metadata wrapper gets attached around it afterward.

What genuine provenance traceability requires beyond the z-test

The z-test only answers one narrow question: was this text watermarked with a key the detector knows about? Real provenance across a multi-agent, multi-model pipeline demands attribution at a level of detail the z-test was never built to capture.

Multi-bit watermarking schemes push past the simple present-or-absent answer that early KGW work focused on. Even then, multi-bit attribution stays locked inside the provider's own systems: extracting an embedded identifier does not let an outside party connect it to a real person or account without access to the provider's private records.

Provenance also has to reach back further than any single generated document, into the datasets and models that produced it. Implicit identity technologies trace the lineage of LLM-related assets by enabling retroactive audits, built on dataset fingerprinting and the identification of models that have been rebranded or derived from earlier ones. That work runs independently of any watermark embedded at generation time.

A 2026 proposal called AgentMark takes the intervention point somewhere else entirely, moving it from the token-generation layer up to the behavioral planning layer of an agent. As AgentMark's own framing puts it, token-level content watermarking does not provide direct provenance for planning-time behaviors in agent pipelines.

Two architectural strategies exist for binding provenance to content: proactive binding, where the watermark gets embedded at the moment of creation, and retroactive inference, where attribution gets reconstructed afterward through similarity analysis when no watermark was ever applied. But even that breadth does not solve the problem of tracing a document as it moves across several different providers in the same pipeline.

Dispersed multi-model authorship changes the statistical structure the detector is looking for

If the KGW fingerprint is a single coherent signature built up token by token from one model's biased distribution, the only response that addresses the problem at the same level is generating tokens from genuinely different distributions, not rewriting a single model's output after the fact.

Paraphrasing with another model does not remove the problem, it relocates it. BIRA illustrates this indirectly: defeating one watermark through rewriting says nothing about whether the rewriting model has introduced a new, detectable signature of its own.

Spreading token-level authorship across several models from different providers changes the picture in a more fundamental way. No single key's green-list bias dominates the resulting sequence, so the z-test, calibrated against one binomial null model tied to one key, cannot detect it. That is architecturally different from editing text after it has already been generated, because the diversity exists at the moment each token gets chosen, rather than being layered onto tokens that already carry one model's bias.

The obvious concern here is voice. Solving for detection without solving for those metrics is only half the job.

A z-score that stays below the detection threshold by construction, because the tokens were genuinely drawn from a mix of distributions rather than scrubbed after the fact, is the only real evidence that the structural problem has been solved at the structural level where it actually lives.