The Tournament Is a Distribution Update
8 min read
A text watermark lets a provider recognize generated text using a secret key. SynthID-Text uses the key to assign random scores to tokens, pieces of text, and favors tokens with higher scores.
Google DeepMind reports using SynthID-Text to watermark Gemini [DS+, Nature ’24], and in August 2026 Anthropic announced that future Claude models will use a version of the same approach.
One way to favor those tokens is a tournament: draw candidates from the model, compare them in pairs, and repeat with the winners. The beautiful shortcut is to calculate the winner’s distribution without playing the matches.
A Tournament for Tokens
Let \(p\) be the model’s next-token distribution after temperature and any truncation. The contestants are independent draws from \(p\). Each round scores every token zero or one; a one beats a zero, and ties use a fair coin. Hashing the secret key with the few preceding tokens supplies the scores, so a detector with the key can reconstruct them from the text without the model or its prompt. The tournament favors score-one tokens for a fixed key, while averaging over fresh random keys preserves the model’s token probabilities.
The figure shows two rounds with four sampled tokens, \(a,b,c,d\). The first-round score function \(g_1\) favors \(a\) and \(d\); the second-round function \(g_2\) favors \(a\) over \(d\), leaving \(a\) as the output. Toggle a score or a tied match’s coin to see how the winner changes.
Samples
four draws from p
Round 1 · g1
Winners
after round 1
Round 2 · g2
Output
after round 2
Round 1: a and d advance. Round 2: a is the output.
An \(m\)-round tournament starts with \(2^m\) independent draws from \(p\) and uses the same score function \(g_\ell(x)\) in every match of round \(\ell\). At thirty rounds, that is more than a billion draws for one output token. To compute its output probabilities, we only need to work out what happens in one round.
One Round Rescales the Probability Vector
Take the first round of the example, with \(p=(0.4,0.3,0.2,0.1)\) on \((a,b,c,d)\) and \(g_1=(1,0,0,1)\), so half the mass sits on score-one tokens. A contestant that is \(a\) wins its match if the opponent scores zero, which happens with probability one half, and wins half the time otherwise. Either of the two slots can hold that \(a\), so \(a\) leaves the round with probability \(2\times0.4\times(\tfrac12+\tfrac12\cdot\tfrac12)=0.6\). The same count gives \(b\) probability \(2\times0.3\times\tfrac12\cdot\tfrac12=0.15\): it wins only against a score-zero opponent, and then only on the coin. Each is the incoming probability times a factor that depends only on the score, \(1.5\) for score one and \(0.5\) for score zero.
In general, write \(\mu_\ell\) for the incoming mass on score-one tokens at round \(\ell\):
\[ \mu_\ell=\sum_{y\in V}p_{\ell-1}(y)\,g_\ell(y), \]
where \(V\) is the set of tokens with positive probability after any truncation, \(p_0=p\), and \(p_{\ell-1}\) is the distribution of a contestant entering round \(\ell\). A contestant is an independent draw from \(p_{\ell-1}\), so \(\mu_\ell\) is the probability that an opponent scores one.
Lemma: Every token leaving round \(\ell\) has distribution:
\[ p_\ell(x)=p_{\ell-1}(x) \left[1+g_\ell(x)-\mu_\ell\right]. \]
The update preserves total probability: the incoming probabilities sum to one, and their score-weighted sum is \(\mu_\ell\). Thus:
\[ \sum_{x\in V}p_\ell(x)=1+\mu_\ell-\mu_\ell=1. \]
Proof
Fix a token \(x\) with \(g_\ell(x)=1\). An occurrence of \(x\) wins outright against a score-zero opponent and wins half the time against another score-one token. Either contestant slot can supply that occurrence, so its winning probability is:
\[ \begin{aligned} p_\ell(x) &=2p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr) +2p_{\ell-1}(x)\mu_\ell\cdot\frac12 \\ &=2p_{\ell-1}(x) -p_{\ell-1}(x)\mu_\ell \\ &=p_{\ell-1}(x)\bigl(2-\mu_\ell\bigr), \qquad g_\ell(x)=1. \end{aligned} \]
A score-zero token can win only when its opponent also has score zero. The same tie calculation gives:
\[ \begin{aligned} p_\ell(x) &=2p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr)\cdot\frac12 \\ &=p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr), \qquad g_\ell(x)=0. \end{aligned} \]
Substituting \(g_\ell(x)=1\) in the first case and \(g_\ell(x)=0\) in the second combines them into the claimed formula. Within a round the matches use disjoint contestants and separate coins, so the winners are independent draws from \(p_\ell\), which is the premise for round \(\ell+1\). Repeating through round \(m\) gives the final winner’s distribution \(p_m\).
The interactive figure below runs the example’s two rounds as probability updates.
p0
input distribution
Round 1 · g1
μ1 =
p1
winner distribution
Round 2 · g2
μ2 =
p2
winner distribution
The scores start as in the bracket, \(a\) and \(d\) scoring one under \(g_1\) and \(a\) and \(c\) under \(g_2\). Change any score to see both the immediate update and its effect on the following round. The final column is \(p_2\), the distribution from which the algorithm draws its one token.
Each round costs one weighted sum for \(\mu_\ell\) and one pass over the vector, so \(m\) rounds cost \(O(m|V|)\) for a support of \(|V|\) tokens, and the bracket’s \(2^m\) draws and \(2^m-1\) matches are never made. (When \(2^m\) is small next to \(|V|\), playing the bracket is cheaper; what the lemma guarantees is equal output distributions, and the update also exposes the whole watermarked vector, which the bracket never does.)
Random Keys Restore the Model Distribution
The update describes the effect of a fixed score function. We also need to account for the randomness used to choose that function. SynthID’s hash behaves like a fair coin for each score, but nothing below needs the coin to be fair, so let each \(g_\ell(x)\) be an independent Bernoulli(\(q\)) draw, independent of the earlier rounds. Hold the incoming distribution \(p_{\ell-1}\) fixed and average the update over \(g_\ell\) alone.
Lemma: Averaging over this fresh random function returns every token to its incoming probability:
\[ \mathbb E_{g_\ell}\!\left[p_\ell(x)\right] =p_{\ell-1}(x). \]
Proof
A fixed token has mean score \(q\):
\[ \mathbb E_{g_\ell}\!\left[g_\ell(x)\right]=q. \]
So does the incoming score-one mass, because it is a probability-weighted average of such scores:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[\mu_\ell\right] &=\mathbb E_{g_\ell}\!\left[ \sum_{y\in V}p_{\ell-1}(y)g_\ell(y) \right] \\ &=\sum_{y\in V}p_{\ell-1}(y) \mathbb E_{g_\ell}\!\left[g_\ell(y)\right] \\ &=q\sum_{y\in V}p_{\ell-1}(y) \\ &=q, \end{aligned} \]
where we moved the expectation inside the sum, then used that every token has mean score \(q\) and that \(p_{\ell-1}\) sums to one. The update is linear in \(g_\ell(x)\) and \(\mu_\ell\), so the expectation passes through it:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[p_\ell(x)\right] &=p_{\ell-1}(x)\left( 1+\mathbb E_{g_\ell}[g_\ell(x)] -\mathbb E_{g_\ell}[\mu_\ell] \right) \\ &=p_{\ell-1}(x)(1+q-q) \\ &=p_{\ell-1}(x). \end{aligned} \]
Because \(g_\ell\) is independent of the earlier score functions, averaging over it with the earlier ones held fixed is the lemma, and the outer average then sees \(p_{\ell-1}\) in place of \(p_\ell\):
\[ \begin{aligned} \mathbb E_{g_1,\ldots,g_\ell}\!\left[p_\ell(x)\right] &=\mathbb E_{g_1,\ldots,g_{\ell-1}}\!\left[p_{\ell-1}(x)\right] \\ &=p_0(x), \end{aligned} \]
where the second line repeats the same step back through round \(1\).
For a fixed key, each round tilts its incoming distribution toward the score-one tokens of its own \(g_\ell\). Across random keys, every token has its original probability. This guarantee is called single-token non-distortion: it is a statement about one position, because a context that repeats produces the same score functions again, so the randomness at different positions of a sequence is not independent.
The Signal a Fixed Key Leaves
The detector counts how often the emitted tokens scored one, so the quantity to track is the probability that a round’s winner scores one. Entering round \(\ell\), that probability is \(\mu_\ell\).
Lemma: Leaving round \(\ell\), the winner scores one with probability:
\[ \sum_{x:\,g_\ell(x)=1}p_\ell(x) =\mu_\ell+\mu_\ell(1-\mu_\ell). \]
Proof
Every score-one token’s probability is multiplied by \(2-\mu_\ell\), so the score-one mass is:
\[ \begin{aligned} \sum_{x:\,g_\ell(x)=1}p_\ell(x) &=(2-\mu_\ell)\sum_{x:\,g_\ell(x)=1}p_{\ell-1}(x) \\ &=(2-\mu_\ell)\,\mu_\ell \\ &=\mu_\ell+\mu_\ell(1-\mu_\ell). \end{aligned} \]
The second line uses that the incoming score-one mass is \(\mu_\ell\) by definition.
The rise \(\mu_\ell(1-\mu_\ell)\) is the variance of a coin with bias \(\mu_\ell\). It is largest when the incoming mass splits evenly between the two score groups, and zero when every contestant is on the same side, where every match is a tie.
The coin’s bias \(q\) also affects the rise; return to independent Bernoulli(\(q\)) scores with \(p_{\ell-1}\) held fixed.
Claim: The expected rise is the coin’s variance times the probability that two independent draws from \(p_{\ell-1}\) differ:
\[ \mathbb E_{g_\ell}\!\left[\mu_\ell(1-\mu_\ell)\right] =q(1-q)\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \]
Proof
Split the expectation into a mean and a second moment, using that \(\mu_\ell\) has mean \(q\) from the previous section:
\[ \mathbb E_{g_\ell}\!\left[\mu_\ell(1-\mu_\ell)\right] =q-\mathbb E_{g_\ell}\!\left[\mu_\ell^2\right]. \]
Squaring the sum that defines \(\mu_\ell\) pairs every token with every token:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[\mu_\ell^2\right] &=\sum_{x\in V}\sum_{y\in V}p_{\ell-1}(x)p_{\ell-1}(y)\, \mathbb E_{g_\ell}\!\left[g_\ell(x)g_\ell(y)\right] \\ &=q\sum_{x\in V}p_{\ell-1}(x)^2 +q^2\sum_{x\ne y}p_{\ell-1}(x)p_{\ell-1}(y) \\ &=q\sum_{x\in V}p_{\ell-1}(x)^2 +q^2\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \end{aligned} \]
On the diagonal, \(g_\ell(x)^2=g_\ell(x)\) has mean \(q\); off the diagonal, independence gives \(\mathbb E_{g_\ell}[g_\ell(x)g_\ell(y)]=q^2\); and the off-diagonal products sum to one minus the diagonal ones. Subtracting from \(q\) and collecting the two sums:
\[ \begin{aligned} q-\mathbb E_{g_\ell}\!\left[\mu_\ell^2\right] &=q-q^2-\bigl(q-q^2\bigr)\sum_{x\in V}p_{\ell-1}(x)^2 \\ &=q(1-q)\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \end{aligned} \]
The first factor is largest at the fair coin SynthID uses:
\[ q(1-q)=\frac14-\left(q-\frac12\right)^2\le\frac14, \]
with equality at \(q=1/2\). The second factor is the probability that two independent incoming tokens differ: near one for a diffuse, high-entropy distribution and zero for a point mass, where every match is a tie.
Like exponential tilting, the update reweights a distribution by a score. Tilting multiplies \(p_{\ell-1}(x)\) by \(e^{\lambda g_\ell(x)}\) for a strength \(\lambda\) and divides by a normalizing constant; the tournament’s linear factor \(1+g_\ell(x)-\mu_\ell\) needs no normalization, because subtracting the opponent’s average score already centers it.
To detect, recompute every position’s score functions from the key and the preceding tokens, and average the scores the emitted tokens received over all positions and rounds. Watermarked text scores above one half on average, and text written without the key does not. (The production system also trains a Bayesian detector on these scores.) The evidence is statistical rather than proof of authorship: it needs enough tokens at which the model was uncertain, and paraphrasing or editing weakens it.
The same secret-randomness pattern appears in exponential minimum sampling: conditioning on the key creates a detectable correlation, while averaging over it preserves the original distribution.