That is not a good way to think about this. I don't have deep knowledge of how LLM's work, but the following is accurate enough to illustrate the point. Let's

That is not a good way to think about this. I don't have deep knowledge of how LLM's work, but the following is accurate enough to illustrate the point. Let's say the LLM is in the middle of text generation and "decides" that the next token is "dog" with p=0.55, or "cat" with p=0.45. With a temperature of 0, the model always picks dog, because it's the most likely next token. With a temperature of 1 the model picks dog 55% of the time and pick cat 45% of the time. With this watermarking scheme, the model might alter these probabilities s.t. p_dog for this particular generated token goes up or down. Let's say it does down, s.t. p_dog is now 0.45 and p_cat=0.55. Now, with T=1 the model picks cat 55% of the time and dog 45% of the time. Regardless of whether the "watermarking function" raises or lowers p_dog, the probability distribution for this token has changed, and whatever math this trillion dollar company and its brainiacs came up with to decide that p_dog ought to be 0.55 has been "adulterated". As others have mentioned there is no way around this. --- Regarding the watermarking scheme, it works because it doesn't just alter p_dog for this single output token. It alters probabilities for many of the generated tokens (it could do this to all of the output tokens; it's an implementation detail). E.g. at token N, it favors "cat", at token N+1 it favors "house", etc. This way, if you have the secret key that lets you generate the watermarking function for any output token, you can analyze a run of tokens and check whether it's likely they were generated according to your watermarking scheme. The longer the run of tokens, the more certain this check becomes (it becomes extremely certain quite fast).