Comment by frabcus

That's not the case, because LLMs are non-deterministic.

It only alters outputs when the last layer of the neural network give significant weights to multiple tokens, and it would anyway have picked a random answer.

Instead it picks a non-random one, but non-random in such a way that you can't tell without the private key of the watermarking.

This mostly adds randomness these days for branches in syntax that make no difference, and the model has no reason to believe make a difference. Anything that matters, it is much more confident in the last layer of weights on the token to use.