Tellmark

An honest, in-browser model of how AI-text watermarks are planted with a secret key — and detected.

A watermark like Google's SynthID-Text is a statistical tell: it doesn't add hidden characters or metadata, it quietly biases which words a model chooses using a secret key, in a way that's invisible to read but measurable in bulk. Tellmark lets you plant that mark on a passage, then watch a detector recover it — and watch it go dark the instant the key is wrong.

Everything runs client-side in a single HTML file. No backend, no build step, no text ever leaves the page.

Live: enable GitHub Pages on this repo (Settings → Pages → deploy from main), or just open index.html in a browser.

---

The one idea this makes concrete

A watermark detector only works if it holds the same secret key used to write the mark. That single fact is the whole security model, and it's why the two products people usually ask for don't exist:

• "Detect if any text is AI-generated." To check a Gemini answer for SynthID, you'd need Google's private watermarking key. Google has never published it. Without it, the detector's per-token values are just coin flips — the score sits at chance and nothing is found. That's by design.
• "Remove the AI watermark." You can't strip a signal you have no key to even see. (And where a watermark is removable, it comes off with ordinary paraphrasing — the marks are documented as not robust to rewriting — so there's nothing to build.)

Tellmark demonstrates both walls directly: detect watermarked text with the right key (strong hit), the wrong key (nothing), and paste arbitrary text (nothing).

What it is / isn't

• ✅ A faithful in-miniature implementation of the SynthID-Text mechanism: keyed per-token g-values, tournament sampling to plant the mark, and a mean-g z-score detector.
• ✅ A teaching tool for how keyed text watermarking works and why key custody is the whole game.
• ❌ Not a detector for real Gemini / ChatGPT output (that needs the provider's private key and tokenizer).
• ❌ Not a watermark remover / "humanizer." It doesn't strip anything.

How it works

1. Seed — At each position, the secret key plus the preceding n-gram are hashed into a pseudo-random g ∈ {0,1} for every candidate next word. Same key + context always yields the same value.
2. Steer — The generator draws several plausible next words and prefers the ones whose g landed on 1 (a small "tournament"). Any single choice looks natural; across a passage the text drifts g-positive.
3. Score — To detect, re-derive g for every word with the same key and average it. Human or wrong-key text averages ≈ 0.50; watermarked text sits well above, and a z-score (mean − 0.5)·√n / 0.5 says how confident the call is. Detection threshold is z ≥ 3.0 (p ≈ 0.0013).

Typical numbers from the built-in generator (~370 scored tokens): correct key z ≈ 7, wrong key z ≈ 1, human text z ≈ 0.

Files

• index.html — the entire app (markup, styles, and engine in one file).

Credits & references

• Method: SynthID-Text, Google DeepMind — Nature paper, open-sourced in Hugging Face Transformers.
• The underlying idea traces to Aaronson's statistical watermarking and Kirchenbauer et al., A Watermark for Large Language Models (2023).

License

MIT — see LICENSE.