Three views of the same mechanism, from the study data. The watermark accumulates statistical confidence as text gets longer, so an attacker has to insert proportionally more to keep the signal scrambled — but not enough more. Across every model and every context length tested, out to 1,048,576 tokens, a 40% insertion rate drives the detector below threshold with no exceptions. The attack’s cost rises with length; it never overtakes.
gpt-oss-120b, one 32k generation per domain scored at 2k / 8k / 32k prefixes. The detector's z-score grows roughly like √n while per-token signal stays flat, so longer text is harder to attack, not easier. Prose carries the strongest mark at every length.
gpt-oss-20b, 240-cell benchmark (code domain, to 8k). Each cell is how many of 8 random insertion seeds drove the detector below threshold. 10% insertion clears 1k tokens but fails by 4k — the required rate climbs with length. This is the short-context view; chart 3 carries the same axes out to 1,048,576 tokens.
The extended sweep: three models × every context length × insertion rate, each cell a median detector z over 5 seeds. Teal = the attack won (z < 2.33); orange = still detected. Qwen3.8-27B reaches 1M tokens; the gpt-oss models to 131k. Read down any column: by 40% insertion the whole grid is teal. Longer context buys the detector a bigger head start (deeper orange at low rates for long documents) but never a finish line.
Data: github.com/aloshdenny/claude-awm · results/res_120b_lengths.json, results/res_vs_bench_20b.json · regenerate with site/gen_charts.py