--- title: How Watermarks Track AI Generated Content - Computerphile description: An explainer walks through how AI text watermarking actually works under the hood, motivated by new EU regulation requiring major AI providers (Google,... canonical: https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Watermarks Track AI Generated Content - Computerphile | daily.dev og:description: An explainer walks through how AI text watermarking actually works under the hood, motivated by new EU regulation requiring major AI providers (Google,... og:url: https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav og:image: https://api.daily.dev/og/posts/xasF86SAv.png og:image:alt: How Watermarks Track AI Generated Content - Computerphile og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Watermarks Track AI Generated Content - Computerphile **[Computerphile](https://daily.dev/sources/computerphile)** · 31 min read · 4 upvotes · 0 comments ## Summary An explainer walks through how AI text watermarking actually works under the hood, motivated by new EU regulation requiring major AI providers (Google, Anthropic, etc.) to watermark generated output globally. The technique biases which token an LLM picks at each step using a hash-based 'tournament' between candidate tokens, seeded by a secret key and the recent context, so the output distribution statistically matches the original likelihoods while still being detectable later without visibly altering the text. Detection recomputes 'G-scores' for chosen tokens and checks whether they trend above 0.5, which only major providers can do since they hold the secret key. A live demo using a local Qwen 3 model shows strong detection signal on essays (p-values as low as 0.001) but much weaker signal on code, since code has lower entropy and fewer real token choices, making it far easier to strip a watermark from code than from prose by editing comments and variable names. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does AI text watermarking actually work at the token level? Watermarking biases which token a large language model outputs by running a pseudo-random tournament among candidate tokens at each position, seeded by a secret key, the token's recent context (typically the last four tokens), and the tournament round. Tokens get pseudo-random zero-or-one scores from a hash function, and higher scores win matchups, so the overall output distribution still matches the model's true probabilities while embedding a detectable statistical bias. _daily.dev surfaces deeper explainers like this for developers tracking how AI-generated content gets detected._ ### Why is it harder to detect an AI watermark in generated code than in an essay? Code has much lower token entropy than prose because syntax constraints force many tokens to be deterministic, such as a semicolon after a for-loop body. In one demo, only 265 of 831 output tokens in a Python to-do list script were real choices, versus 437 of 600 tokens in an essay, so watermark detection on code produced a much weaker p-value of 0.575 and became far weaker after editing comments and variable names. _developers weighing AI-assisted coding tradeoffs can find this kind of technical breakdown on daily.dev._ ### Can EU AI watermarking regulations be evaded by editing AI-generated text? Editing text weakens but does not fully erase the watermark, since each token's watermark score depends on the previous four tokens, so changing roughly one in every three or four tokens randomizes the signal; the EU does not mandate watermarking for passages under 200 tokens because detection becomes unreliable below that length, and statistical significance becomes clear around 300-400 tokens. _anyone following AI content regulation can track how these detection tradeoffs play out on daily.dev._ --- Tags: [#python](https://daily.dev/tags/python), [#llm](https://daily.dev/tags/llm) [View this post on daily.dev](https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Watermarks Track AI Generated Content - Computerphile","url":"https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav"},"datePublished":"2026-09-03T13:51:59.442Z","dateModified":"2026-09-03T13:52:25.836Z","description":"An explainer walks through how AI text watermarking actually works under the hood, motivated by new EU regulation requiring major AI providers (Google,...","image":"https://i.ytimg.com/vi/kVXp6UNVPTo/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/kVXp6UNVPTo/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Computerphile","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Computerphile","logo":"https://media.daily.dev/image/upload/s--hZFFIKfd--/f_auto/v1712315606/logos/computerphile","url":"https://daily.dev/sources/computerphile"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,llm","timeRequired":"PT31M","video":{"@type":"VideoObject","name":"How Watermarks Track AI Generated Content - Computerphile","description":"An explainer walks through how AI text watermarking actually works under the hood, motivated by new EU regulation requiring major AI providers (Google,...","thumbnailUrl":"https://i.ytimg.com/vi/kVXp6UNVPTo/sddefault.jpg","uploadDate":"2026-09-03T13:51:59.442Z","duration":"PT31M","url":"https://api.daily.dev/r/xasF86SAv","embedUrl":"https://www.youtube.com/embed/kVXp6UNVPTo"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Computerphile","item":"https://daily.dev/sources/computerphile"},{"@type":"ListItem","position":3,"name":"How Watermarks Track AI Generated Content - Computerphile"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-watermarks-track-ai-generated-content---computerphile-xasf86sav#faq","mainEntity":[{"@type":"Question","name":"How does AI text watermarking actually work at the token level?","acceptedAnswer":{"@type":"Answer","text":"Watermarking biases which token a large language model outputs by running a pseudo-random tournament among candidate tokens at each position, seeded by a secret key, the token's recent context (typically the last four tokens), and the tournament round. Tokens get pseudo-random zero-or-one scores from a hash function, and higher scores win matchups, so the overall output distribution still matches the model's true probabilities while embedding a detectable statistical bias. daily.dev surfaces deeper explainers like this for developers tracking how AI-generated content gets detected."}},{"@type":"Question","name":"Why is it harder to detect an AI watermark in generated code than in an essay?","acceptedAnswer":{"@type":"Answer","text":"Code has much lower token entropy than prose because syntax constraints force many tokens to be deterministic, such as a semicolon after a for-loop body. In one demo, only 265 of 831 output tokens in a Python to-do list script were real choices, versus 437 of 600 tokens in an essay, so watermark detection on code produced a much weaker p-value of 0.575 and became far weaker after editing comments and variable names. developers weighing AI-assisted coding tradeoffs can find this kind of technical breakdown on daily.dev."}},{"@type":"Question","name":"Can EU AI watermarking regulations be evaded by editing AI-generated text?","acceptedAnswer":{"@type":"Answer","text":"Editing text weakens but does not fully erase the watermark, since each token's watermark score depends on the previous four tokens, so changing roughly one in every three or four tokens randomizes the signal; the EU does not mandate watermarking for passages under 200 tokens because detection becomes unreliable below that length, and statistical significance becomes clear around 300-400 tokens. anyone following AI content regulation can track how these detection tradeoffs play out on daily.dev."}}]} ```