One way to watermark (assuming temperature is otherwise positive) would be to output the most likely (or optimal) token every so often.

But wouldn't you have to know the exact context before this token in order to verify the watermark? I.e. a paragraph wouldn't be sufficient; you would need the system prompt, previous prompts, and even hidden thinking?