It literally re-weights the output tokens from what the LLM would otherwise have chosen. It _has_ to. It can't be positive, because then that's not watermarking, it's a better LLM.

It's a very unintuitive algorithm, and is pretty clever.

I recommend reading up on it: https://www.nature.com/articles/s41586-024-08025-4

But no, it only ever picks tokens that are in the probability distribution of the last layer, and it might have picked anyway.

Unless you’re at 0 temperature, there is no single token it would have chosen. It’s always picking one of multiple randomly according to a probability distribution.

Unless you’re running at temperature 0, there’s not one single token that the model definitely would have chosen each time.