In my SynthID post I rewrote 100 watermarked texts with three local models, and the detector still saw a trace in most of them. Every rewriter ran at one sampling setting: temperature 0.7, with Ollama's defaults of top-p 0.9 and top-k 40. I never varied it.
A reader asked the obvious question. SynthID lives in exact token sequences: the watermark nudges each token based on the 4 tokens before it, so a rewrite carries watermark only where it reproduces a 5-token window from the original. Would a hotter rewriter shatter those windows faster? Or would it just shatter the meaning faster?
I did not know. So I ran it.
Short answer: both, in that order. Turning the temperature up to 1.3 while keeping the usual nucleus cut nearly halved the number of rewrites the detector flagged, and a blind judge could not tell the difference in meaning or readability. Removing the nucleus cut as well removed only a little more watermark, and that is where the text broke: a quarter of those rewrites lost or distorted facts. Greedy decoding went the other way and kept more watermark. And nothing got to zero.
Why the sampling knob should matter
Two things decide how much of the original's wording a rewriter reuses.
Temperature sets how strongly the rewriter prefers its most probable next token. Low temperature means the most natural phrasing, and the most natural phrasing is often what the original model wrote too. That was the lesson of the second-pass result in the first post, where paraphrasing a paraphrase landed back on the original's phrases. A hotter rewriter should land on them less often.
Top-p, the nucleus cut, decides which tokens can be sampled at all. At top-p 0.9 the rewriter only ever picks from the plausible set, however hot the temperature. At top-p 1.0 the whole tail is open, including tokens the model thinks are unlikely.
In the first post, the share of the original's 5-grams that survived a rewrite tracked the watermark z-score with a correlation of 0.77. So the prediction is simple: anything that lowers 5-gram overlap should lower the signal. The question is what it costs.
The setup
-
Rewriter:
gemma3:12b, the heaviest washer from the first post. Same prompt, same seed, same context length. Only the sampling options changed. - Five settings: temperature 0 (greedy), 0.7 (the original run, used as the baseline), 1.0, 1.3, and 1.3 with top-p raised to 1.0.
- Texts: the same 100 watermarked originals, 190 to 900 words across 10 genres. Each setting also rewrote the 100 clean originals, so I can check that the detector's null does not move when the rewriter gets hotter. That was a lesson from the readers of the first post.
- Detector and cutoffs: unchanged from the October update. The z cutoff of 2.42 was set on a calibration half of 850 clean texts for a 1% false-positive rate. Nothing was recalibrated for this test.
- Comparisons: every setting rewrote the same 100 originals, so differences from the baseline are paired by source text, with bootstrap intervals over the 100 sources.
- Meaning: 500 original-and-rewrite pairs, shuffled into 25 batches of 20 with the settings mixed, graded by a Claude judge on meaning (1 to 5: facts, names, numbers, steps and plot events preserved, nothing invented) and fluency (1 to 5). The judge never saw which setting produced a rewrite.
What happened
| Rewriter setting | 5-grams kept | Mean z | Flagged (mean test) | 95% CI | AUC vs clean | AUC vs rewritten null |
|---|---|---|---|---|---|---|
| temp 0 (greedy) | 12.7% | 1.78 | 31% | 23 to 41 | 0.80 | 0.79 |
| temp 0.7 (first post) | 10.4% | 1.56 | 25% | 18 to 34 | 0.79 | 0.80 |
| temp 1.0 | 9.3% | 1.38 | 21% | 14 to 30 | 0.77 | 0.79 |
| temp 1.3 | 8.2% | 1.08 | 14% | 9 to 22 | 0.71 | 0.71 |
| temp 1.3, top-p 1.0 | 5.9% | 0.88 | 11% | 6 to 19 | 0.70 | 0.67 |
Paired against the 0.7 baseline over the same 100 texts:
| Rewriter setting | Change in z | 95% CI | Change in 5-grams kept | Meaning (1 to 5) | Change in meaning | Fluency (1 to 5) | Change in fluency |
|---|---|---|---|---|---|---|---|
| temp 0 | +0.22 | -0.01 to +0.46 | +2.3 pts | 4.26 | +0.07 (-0.06 to +0.19) | 4.92 | -0.03 (-0.09 to +0.03) |
| temp 0.7 | baseline | 4.19 | 4.95 | ||||
| temp 1.0 | -0.18 | -0.44 to +0.08 | -1.1 pts | 4.22 | +0.03 (-0.09 to +0.15) | 4.90 | -0.05 (-0.11 to +0.01) |
| temp 1.3 | -0.48 | -0.72 to -0.23 | -2.1 pts | 4.11 | -0.08 (-0.19 to +0.03) | 4.93 | -0.02 (-0.09 to +0.05) |
| temp 1.3, top-p 1.0 | -0.67 | -0.99 to -0.36 | -4.4 pts | 3.82 | -0.37 (-0.50 to -0.24) | 4.32 | -0.63 (-0.77 to -0.49) |
Greedy decoding keeps more watermark. At temperature 0 the rewriter kept 12.7% of the original's 5-grams instead of 10.4%, and the flagged rate went up from 25% to 31%. The z change is +0.22 with an interval that just touches zero, so call it a lean rather than a proof. But the direction is the second-pass effect again: the most probable phrasing is the original's phrasing, and the watermark comes with it.
Up to the nucleus cut, temperature is a free knob. At 1.3 with the default top-p 0.9, the flagged rate dropped from 25% to 14%, and the paired z change of -0.48 has an interval well clear of zero. The judge saw nothing: meaning 4.11 against 4.19, fluency 4.93 against 4.95, both differences inside noise. Temperature 1.0 was halfway and not clearly different from 0.7 on anything.
Open the tail, and the text breaks before the watermark does. Raising top-p to 1.0 at the same temperature took the flagged rate from 14% to 11%, which the intervals cannot separate. What it clearly did was damage the rewrites. Mean meaning fell by 0.37 points and fluency by 0.63, and a quarter of texts scored 3 or lower on meaning against 7% for the baseline. The judge's notes are specific: a science explainer dropped the inverse fourth-power law and invented "two to ten times"; a story dropped a mother's death date and reversed who said what in a dialogue; an incident report's "voltage drop below threshold" became "voltage reading below permissible level," which flips the sense. One in ten of these rewrites also read awkwardly, where none of the others did.
The null does not move. Clean rewrites scored a mean z of 0.07, -0.01, -0.04, 0.08 and 0.20 across the five settings, and they lost 5-grams at the same rate as the watermarked ones. The drop in signal is signal loss, not a shift in what clean text looks like to the detector.
Nothing gets to zero. Even the hottest setting left 11% of rewrites flagged at a 1% false-positive cutoff, and the AUC against the rewritten null was still 0.67. The point from the first post stands: too faint to accuse any one short text, strong enough to add up across a body of work.
One more number. Across all 500 judged rewrites, the correlation between 5-grams kept and the meaning score was 0.15. Keeping the original's wording buys almost no faithfulness. Faithfulness comes from the model understanding the text, and copying is just a habit that happens to carry the watermark.
What it means
For someone trying to hide AI use: the rewriter's temperature is a real lever, and it is free up to the nucleus cut. A hot rewrite with top-p left at its default removed about half of what the default setting left behind, at no measurable cost. Past the nucleus cut there is almost nothing more to gain, and the text starts losing facts. Deterministic rewriting is the worst choice.
For someone trying to detect AI use: the attacker has a knob you cannot see, and the first half of its range costs them nothing. The trace that survives the best attacker setting here is about one rewrite in ten at a 1% false-positive rate. Your pooled statistics still work; your per-document verdicts get weaker.
For the 5-gram proxy from the first two posts: it held again. Every setting that lowered overlap lowered the signal, in order. If you cannot run a detector, counting surviving 5-grams still tells you most of the story.
Caveats
- One rewriter, one prompt, one seed per setting. Temperature 0 is deterministic by construction. A different rewriter could have a different nucleus cut where the text breaks.
- One judge per item. No second rater, no agreement check. The 1-to-5 scale is coarse, so read the paired intervals, not the raw means. The baseline is not spotless either; the judge caught the 0.7 run turning a tea price of "a crown per pound" into "one pound per crown," and two other settings turning a 17-year-old bistro into a 17-year-old owner.
- 100 texts per setting. The flagged-rate intervals are wide. The AUC columns and the paired z differences are the stronger evidence.
- I did not vary top-k, or the generator's own temperature. The watermark strength at generation time was fixed at the first post's setting.
- The Ollama model is 4-bit quantized, as before.
The pipeline
Four short scripts on top of the first post's code: one runs the rewrites per setting through Ollama's HTTP API, one scores them with the same detector and counts surviving 5-grams, one does the paired analysis against the stored cutoffs, and one builds the blinded judge batches and collects the scores. About three hours of GPU time, nearly all of it rewriting.
Thanks to the reader who asked. It was the right question, and the answer was not the one I would have guessed: the knob works, but the cliff is in top-p, not temperature.
Top comments (0)