Instead of adding in secret whitespace unicode characters, wouldn't an approach similar to a Bloom filter work pretty well? Just spitballing here. 1. Identify

Instead of adding in secret whitespace unicode characters, wouldn't an approach similar to a Bloom filter work pretty well? Just spitballing here. 1. Identify the ~N most common tokens (let's say N is 5), and call this set S. 2. Restrict the model so that every T tokens it emits, the Tth token must be from the set S. Maybe you can be clever and say T must be a prime number or something. Anyway, the quality of the output should suffer minimally, since even though you are constraining the model to pick "sub-par" tokens every T tokens, it still gets to pick from the N most common ones anyway. And to validate, you simply scan the text and see if every T tokens is always from the set S. If yes, there's a high probability it has the watermark (similar to a Bloom filter, adjust the values to adjust the probability). If no, then it's 100% guaranteed to not have the watermark. Of course, there are pitfalls. What if you ask the model to generate code? Which is full of uncommon symbols. If you happen to get unlucky, then maybe the only token that makes sense at a given position is '}', and if you force the model to select from ['the', 'a', 'not'] etc then it simply cannot produce a good output. Still, the approach is interesting if you ask me.