Shredding LLM Output Across Multiple Models

Shredding large language model output across multiple providers works because it attacks the mathematics of detection directly, not the surface of the text. The method disperses token-level signatures across independent models until no single model's statistical fingerprint survives the threshold a watermark detector uses to flag a document.

Embedding KGW Watermarks at the Token Level

The KGW watermarking scheme does not stamp a label onto finished text. It intervenes in the act of generation itself, at every single decoding step. Each time the model is about to choose its next token, it hashes the recent context tokens and uses that hash to split the entire vocabulary into two groups: a green list and a red list, both specific to that moment and that context. A fixed positive bias, called δ, gets added to the green-list tokens before the model samples its next word, so green tokens come out of the model more often than chance alone would predict.

Detection reverses this logic. A detector counts how many tokens in a document fall in the green list and runs a one-sided z-test comparing that count to what it would expect if token selection were unbiased: z equals the observed green-token count minus the expected count, divided by the standard error. A high z-score means the text could not plausibly have come from an unbiased process, and the document gets flagged as machine-generated.

The null hypothesis behind the test is simple: any token has an equal shot at landing in the green list if no watermark is present. Watermarked text violates that assumption by construction, and the violation compounds with every token the model produces. The violation is invisible to a human reader: two sentences can look, sound, and read identically, while one carries a green-token bias embedded in its probability distribution and the other does not. BIRA's theoretical work, from Hwang, Park, and Ok at POSTECH, formalizes why this matters beyond the obvious: reduce the average conditional probability of sampling a green token by even a small margin, and the probability of detection decays exponentially. The same architecture that makes the watermark effective is what makes it fragile once its underlying statistics get disturbed. The fingerprint lives in the relationship between tokens and their context, not in any word a reader could point to.

The Inescapable Statistical Fingerprint of a Single Model's Output

A single model's output is vulnerable precisely because the bias is not local to one sentence. It accumulates across the whole sequence, and the z-test is built to aggregate exactly that kind of accumulation. Every green-token count adds to the running total, and the longer the document runs, the tighter and more reliable the statistical estimate becomes. A content team producing a longer article writes more and simply hands the detector a larger sample to work with.

KGW earned its status as the field's baseline watermark because it is cheap to deploy and compatible with ordinary decoding pipelines used across the industry. That same ease of deployment is what makes detection just as straightforward on the other end. The fingerprint is a pattern spread across hundreds of individually unremarkable token choices, invisible line by line and unmistakable in aggregate, rather than a single suspicious phrase an editor could spot and cut.

Token-distribution watermarks depend on three things: which tokens got generated, the local context each token was drawn from, and the specific tokenizer in use. All three get fixed the moment a model finishes a generation pass. Anything that touches that output afterward, including a second pass from another model, inherits the original green-token pattern unless that second pass actively disrupts the sampling distribution that produced it. The vulnerability is not a matter of picking a careless model or a sloppy prompt. Any single model, used on its own and used consistently, leaves a fingerprint that a detector can find by design, which is exactly the condition the next section has to confront.

Why Post-Hoc Editing and Paraphrasing Fail

Editing a watermarked document after the fact does not touch the problem, because the watermark lives in the statistical relationship between token choices, not in the words sitting on the page. Insertion, substitution, and deletion are the standard tools of post-editing, and they are, by design, the operations the KGW scheme is built to survive. The logit bias gets baked into the output before any human or downstream process has a chance to intervene, so rearranging a few words afterward moves the evidence around without erasing it.

Paraphrasing with the same model that generated the original text runs into a related wall. A second pass from the same model draws from the same biased vocabulary partition as the first, so the green-token overrepresentation simply reasserts itself in the new draft. Running the same model through several rounds of paraphrasing introduces its own cost: semantic drift accumulates with every iteration, degrading the content's meaning and tone without reliably pushing the z-score below threshold. HALO's research states that paraphrasing "remains impractical for wide adoption" because evasion generally requires multiple iterations, and those iterations cause semantic drift in the output. Query-based attacks that infer the green list directly and remove flagged tokens surgically demand access to the watermarked model's internals and partial knowledge of its watermarking scheme, conditions no content team working against a third-party API actually has.

The common thread across every one of these approaches is that they stay inside a single model's probability distribution. A fix that never leaves that distribution is bounded by it, because the distribution is the fingerprint. Escaping detection requires leaving the statistical space the watermark was embedded in, not rearranging what sits inside it.

Cross-Model Token-Level Blending and the Z-Score

Multi-model shredding works by giving the detector a token sequence drawn from several independent probability distributions at once, none of which alone produces a coherent green-token signal strong enough to survive aggregation. BIRA's theoretical result supplies the underlying condition: reduce the average conditional probability of sampling a green token by even a modest margin, and detection probability falls off exponentially. Multi-model dispersal satisfies that condition not through suppression of any one model's output, but through structural independence between the models contributing tokens.

BIRA's own empirical result shows how sharply this plays out. A rewriting attack dropped the KGW z-score from 6.03 to 0.83 on Llama output, moving the text from robustly flagged to effectively invisible to the detector. Cross-provider dispersal pushes the same logic further than a single rewriting pass can. Different model families run different tokenizers, different vocabulary partitions, and different context-hashing schemes, so a token that counts as green under one model's watermarking key carries no such status under another's. Blending text across providers does not just dilute a signal. It scatters it across incompatible coordinate systems that share no common green list to accumulate against.

Token-level selection achieves this: choosing the best candidate token line by line from a slate of model outputs means no single model's bias ever has room to build across the full sequence, because no single model wrote the full sequence. The z-score never accumulates to a detectable level because there is no one distribution for it to accumulate within. Lettershred's architecture operationalizes exactly this pattern: a brief goes in, a dozen or more model kernels draft candidate lines in parallel, a judge panel selects the strongest line across providers token by token, and a final enhance pass unifies the result into one voice. The large majority of tokens in the finished piece get rewritten through this cross-provider process, and the measured z-score drops from 15.46, a figure a KGW detector would flag immediately, to -0.32, well under the detection threshold of 4. The output was never authored by one model from start to finish, so no single model's watermark was ever fully embedded in it to begin with. That is compliance achieved by construction, not by a cleanup pass applied afterward.

Evasion Research and the Structural Soundness of Dispersal

Independent evasion research arrives at the same structural condition that cross-model dispersal satisfies by design, which lends the approach grounding beyond any single company's internal benchmarks. BIRA achieves evasion rates above 99% across a range of watermarking schemes while preserving semantic fidelity well beyond prior baseline methods, by applying a negative logit bias to a proxy suppression set identified through token surprisal. That is a direct, if differently engineered, enactment of the same condition dispersal satisfies architecturally: push the green-token conditional probability down, and detection collapses.

BIRA's theoretical framework adds a sobering detail: the margin δ needed to trigger that exponential decay in detection probability is small. The z-score is not a durable barrier so much as a brittle threshold that gives way under modest redistribution of token probabilities. HALO's research reaches a related conclusion from a different direction. Its multi-agent orchestration framework evades detection while preserving task instruction-following, through coordination among models rather than repeated rewriting by one, achieving something pure paraphrasing destroys.

What unites BIRA, HALO, and cross-provider dispersal is not technique but theory. All three reduce the conditional probability of sampling green-list tokens across a sequence, and they simply arrive at that reduction by different routes: logit manipulation in BIRA's case, agent orchestration in HALO's, cross-provider blending in dispersal architectures like Lettershred's. Paraphrasing chains that run text through several independent language models show the same pattern at the detector level: the more independent the models contributing to a final text, the more completely the watermark signal disperses.

Semantic Fidelity and Voice Consistency in a Multi-Model Pipeline

The strongest objection to multi-model shredding is that blending output from several models will produce something incoherent, a document that reads like it was stitched together by committee. The concern is legitimate. When one model drafts in a defined brand voice and a second model rewrites that draft, the second model brings its own stylistic habits with it, and nothing about the process guarantees that voice carries over intact between models with no shared internal state.

The answer lies in where coherence gets enforced. A three-tier structure separates the function of generating diverse candidates from the function of enforcing a single voice: a foundation layer produces drafts in parallel across model kernels, an orchestration layer selects and sequences tokens from among them, and an application layer enforces brand voice on the result. Diversity and coherence become the responsibility of different layers, so neither has to be sacrificed for the other. Lettershred's judge-panel mechanism selects the strongest line across model outputs using quality and voice consistency as the standard, not watermark evasion alone. The finished piece is unified not by averaging several models' tendencies together but by choosing the right token from the right model at each position in the text. A final enhance pass then draws the selected tokens into one coherent voice.

BIRA's own results show that aggressive suppression of the green-token signal still leaves semantic similarity between attacked and original text high, so evasion and fidelity can be achieved together. The risk documented in studies of multi-turn conversation, that language models lose coherence over the course of a dialogue, describes a real failure mode, but it is a failure mode specific to sequential dialogue. A judge panel selecting among parallel candidate lines is a one-shot selection process, and that structural difference is what keeps drift from compounding the way it does across a long back-and-forth exchange. For a content team, the practical upshot is that existing briefs, outlines, and approval workflows do not need to change. The multi-model layer sits between draft generation and final output without requiring anyone to redesign how work gets commissioned or reviewed.

The compliance stakes that make architectural watermark resistance a practical requirement

The case for cross-model dispersal is not only a technical one. Regulatory and institutional pressure around AI provenance has reached a point where a single-model pipeline without watermark resistance carries real exposure. The EU AI Act's requirements around provenance documentation and technical records of training methodology come with enforcement deadlines, which makes lineage infrastructure something content operations need in place now. Separately, several jurisdictions, including China and the EU, have put mandatory labelling requirements on AI-generated content into force, creating disclosure obligations that bear directly on whether a document's provenance can be traced back to a single model.

Detection is already running at institutional scale, not sitting as a theoretical capability. A 2025 analysis of submitted manuscripts found that only 9% of papers disclosed AI use despite containing AI-generated text, a gap between actual use and disclosed use that is wide and shows a real, mounting pattern of detection pressure. The fingerprinting landscape extends past content watermarks into model provenance itself, with techniques now able to trace derivative or rebranded models back to their foundational counterparts, which supports the kind of transparent chain of custody regulators are asking institutions to maintain.

For a content team, the exposure runs deeper than any single flagged document. A pipeline that relies on one model consistently leaves the same statistical fingerprint across every piece it produces, which builds a corpus-level provenance record that can be audited well after the fact, not just at the moment of publication. An architecture that disperses tokens across providers so the output sits below the detection threshold by construction is a compliance posture built into the pipeline itself, not a patch applied once a problem surfaces. No single model's fingerprint was ever fully present, so there is nothing for a retroactive audit to recover.

The Z-Score Benchmark as the Standard of Proof

Any claim about watermark resistance is only as credible as the test behind it, and the z-score measured against a real KGW detector is the one test that evaluates the actual statistical condition detection relies on. A vendor claiming its output "evades AI detectors" without stating a measured z-score against a named watermarking scheme is making a claim that cannot be checked against the mechanism this piece has walked through step by step: the green-list partition, the logit bias, the aggregation of green-token counts into a single test statistic. Lettershred's own figures, a drop from 15.46 to -0.32 against a detection threshold of 4, are stated in exactly that form, and that specificity is what makes the figure checkable.

Content teams evaluating any tool in this space should ask for the same thing: a z-score, against a named detector, under a stated watermarking scheme, before and after. Anything short of that is a proxy, and proxies can be gamed in ways the underlying statistic cannot. The mechanism described across this piece, from how KGW embeds its signal at the token level to how cross-model dispersal breaks the conditions that signal depends on, points to one standard of proof that actually tracks whether a pipeline dissolves a watermark's footing or simply rearranges it.