LLM watermarking turns the model’s linguistic entropy into bandwidth. Wherever the model has multiple plausible ways to say the same thing, those degrees of freedom become a channel through which a hidden (watermarking) signal can be transmitted.

Advanced LLM watermarking is closer to spread-spectrum radio than to stamping text with a signature. The language itself is the carrier; a weak cryptographic signal is spread across thousands of otherwise natural token choices. To everyone listening normally, it’s just language. With the right key, you can correlate against the hidden signal and pull it out of the noise.

The text is not where the watermark sits, it is the carrier wave. The watermark lives in tiny coordinated deviations in how that carrier is generated. Without the key they look like ordinary sampling noise. With the key, they line up coherently into a signal.

Watermarking an LLM's output, in Kirchenbauer et al., is basically turning token generation into a dynamic casino where the house secretly nudges the model toward green tokens. A z-test detector regenerates those context-dependent green sets and asks whether the generated text landed on them far more often than chance would plausibly explain. It isn't detecting “AI style”; it's detecting an intentionally planted statistical bias.