Generative Language Model Watermarking Forensics, Statistical Limits of Phenotype Identification, and Cross-Lingual Vulnerabilities

As generative Transformer architectures (e.g., GPT-4o, Claude 3.5, DeepSeek-V3) proliferate across statutory, academic, and administrative domains, establishing rigorous forensic attribution methodologies has become critical under the EU AI Act. In this monograph, we establish a mathematically sound demarcation between keyed cryptographic watermarking and unkeyed statistical phenotype identification: Cryptographic Boundaries: We prove that the Aaronson Gumbel-Max PRF scheme is distortion-free; without the secret key, unkeyed blind inversion is impossible. At verification time, authorized detection evaluates PRF ranks using solely the secret key and observed text, without requiring model logits. For the Kirchenbauer green-list architecture, exact binomial hypothesis testing achieves definitive attribution (Z >= 4.0, p approx 3.17e-5). OpenAI textGrain Analysis: We analyze OpenAI's Block Entropic Optimal Transport (Block OT) scheme (October 2026). While the null distribution satisfies an exact Gamma(n, 1) law, we derive the closed-form first-order asymptotic power perturbation: Delta Y proportional to sqrt((1 - ||p||^2)(m-1)/m * beta * H(P)). We prove convergence strictly for lambda > 1.0 due to the Gumbel moment generating function pole at t = 1. In the unregularized limit lambda -> 0, the coupling degenerates into a capacitated optimal assignment problem (Hungarian matching), establishing an empirical ceiling of 2.563 +- 0.013 nats (B=16, m=8). High-precision Monte Carlo simulations (N = 10,000) and GPT-2 entropy measurements demonstrate why real detection requires 200–400 tokens to achieve 95% power at alpha = 0.01. Cross-Lingual Vulnerabilities: Evaluating OpenAI BPE tokenizers across 60 holdout documents reveals that inflected Polish words decompose into 2.395–2.809 tokens/word vs 1.178–1.185 in English (2.03x–2.37x higher fragmentation). We formulate the analytical hypothesis that morphological agreement cascades accelerate context window destruction under edits. Unkeyed Detection Limits: On a frozen pre-2022 paired holdout benchmark (N=60, SHA-256: 4c9e6f6d00c74c9641ac8da9283754a4ce79035959f01e300ea156afeb8b6832), unwatermarked statistical classifiers achieve ROC-AUC of 0.470–0.488, with decided human False Positive Rates of 14.8%–23.3% and 100% vulnerability to simple prompt steering. Legal & Research Notice: This publication represents independent academic research in applied mathematics and NLP. Evaluated statistical models must NOT be used to adjudicate, grade, or sanction human authors.