LLMウォーターマークってなんだ？This article explains LLM watermarking — a technique that embeds statistical…

As generative AI systems produce increasingly fluent prose, being able to verify whether a passage was machine-written has become a practical concern for educators, publishers, and platform operators. A recent explainer published on Zenn walks through LLM watermarking, a technique that embeds a statistical signal into text as it is generated so that AI authorship can later be checked, and it is candid about where the method works and where it falls short.

The article starts from a familiar problem: if someone claims "this text was written by this AI," can you actually confirm it from the words alone? It reviews the intuitive options and finds each unsatisfying. Inserting hidden characters into the output is trivial to strip out. Attaching a certificate of provenance depends on metadata that is easily lost or forged. Judging whether a passage merely "sounds like AI" is subjective and unreliable, since both false positives and false negatives are common. Each approach is easy to tamper with, and humans are not good at spotting machine text by eye.

Watermarking takes a different route by intervening during generation itself. Rather than editing the finished text, the method nudges the model's token-by-token choices in a way that is imperceptible to readers but detectable by a statistical test. In the widely cited design, at each step a pseudorandom function seeded by the preceding tokens splits the vocabulary into a favored subset and a disfavored one, and the model is biased toward selecting from the favored group. Because a detector who knows the seeding rule can measure how often those favored tokens appear, watermarked text shows a skew that ordinary human writing would not, and the difference can be scored for confidence.

The appeal of this approach is that the signal lives in the statistical fingerprint of the word choices rather than in any removable tag. Detection does not require storing the original output or even accessing the model that produced it, only the shared key and hashing scheme. That makes it more robust than a metadata label and harder to defeat with a simple find-and-replace edit.

The limitations, which the article emphasizes, are substantial. The watermark can be weakened or removed by paraphrasing, translating, or heavily editing the text, since these operations change the very token sequence the signal is riding on. Short passages carry less signal and are harder to judge confidently. Low-entropy outputs, where only a few continuations are reasonable, such as code or terse factual answers, leave little room to embed a bias without degrading quality, so there is an inherent trade-off between watermark strength and output fluency. Perhaps most importantly, the scheme only works if the model provider chooses to apply it; anyone running an unwatermarked model, including many open-weight systems that can be run locally, can generate text that carries no signal at all. There are also research demonstrations of spoofing, where an adversary who learns the pattern forges text that falsely triggers the detector.

This context helps explain why watermarking is being pursued alongside, rather than instead of, other provenance efforts. Google DeepMind has described and open-sourced SynthID-Text for marking output from its models, and OpenAI has reportedly built but not released a text watermarking tool, citing concerns about effectiveness and impact on users. In parallel, standards such as C2PA focus on cryptographically signed content credentials, an approach better suited to images and video where metadata can travel with the file. Post-hoc detection classifiers, including commercial tools aimed at academic settings, remain in use but have a track record of unreliable results.

The overall picture the article presents is measured. LLM watermarking appears to be a meaningful improvement over guessing whether text "feels" AI-generated, and it offers a principled, tamper-resistant signal when the generator cooperates. But it is not a complete solution to attribution, and it is likely to be most useful as one layer within a broader system of content provenance rather than a definitive test on its own.