A collision-entropy floor for watermark/retrieval AI-text detection. Looking for a sanity check before I take this further [D]

Hello everyone!

I've been working through a formalization of why similarity-based AI-text detectors (watermarking, retrieval-based matching) hit a hard floor on false-positive rate, and I'd like holes poked in it before I put more time in.

Self-verified only so far, no external review. Below you can find the core argument inline but if interested I can link the full PDF with proof.

SETUP

Fix a distribution P over possible texts given some constraint C (a topic, a set of facts, a genre). A similarity-based detector computes some statistic T from a candidate text and compares it to a reference. Watermarking's green-list count and retrieval's embedding vector are both instances of T; different implementations, same abstract move: coarsen the text down to something comparable.

THE BOUND

For any deterministic T, let H2 denote Rényi-2 (collision) entropy. If X, Y are i.i.d. draws from P, then applying T to both gives i.i.d. draws from the pushforward T*P, and:

H2(T*P) ≤ H2(P)

Proof is three lines: partition the domain by T's preimages, note that (Σp_i)² ≥ Σp_i² for nonnegative p_i (cross terms are nonnegative), sum over the partition. That's it. No hidden machinery.

WHY THIS MATTERS FOR DETECTION

Collision probability for i.i.d. draws from any discrete distribution Q is exactly 2^(-H2(Q)). Not asymptotic, exact. So the false-positive rate of any detector built on statistic T satisfies:

FPR_T(C) ≥ 2^(-H2(raw text | C))

for every possible T, including ones nobody's designed yet.

As the constraint tightens (H2 → 0, i.e. the topic only admits a small number of "correct" outputs — think a product spec sheet with a fixed list of facts), this floor rises to 1 for every detector simultaneously. TPR ≤ 1 always, so TPR − FPR → 0: the ROC curve of any collision-based detector collapses to chance, and no threshold recalibration saves it, because the problem isn't the threshold, it's that the underlying distributions being compared have converged.

Relation to existing work (please tell me if I'm missing something here specifically)

The token-level special case of this is already in Kirchenbauer et al. 2023 (spike entropy, low-entropy text is both hard to watermark and hard to distinguish from human completions) — I'm not claiming that part is new, just generalizing the mechanism past the token layer.

More relevant: I found Silva (2026, SSRN) after writing most of this, who proves a much more complete impossibility framework via total variation distance between human and model distributions, and explicitly marks watermark detection as out of scope for his framework in his own taxonomy table.

My claim is that this is exactly the gap: his is a classification game (two fixed populations), mine is a matching game (one distribution, is this specific text derived from that specific reference). I can show the two connect, the matching-game optimum equals the expectation, over a randomly drawn reference, of his fixed-reference classification advantage, and I've extended it further to the realistic paraphrase case, where the bound splits into a mutual-information term (how much of the reference survives the paraphrase channel) and a total-variation term (exactly Silva's quantity).

So the two frameworks end up as two additive components of one bound rather than competing accounts. This is the part I'm least sure holds up under real scrutiny.

WHAT I'M ASKING

Is the core data-processing argument (H2 can't increase under coarsening) actually as clean as I think, or am I missing an edge case?

Does the Silva bridge hold, or have I fooled myself with a convenient special case (point-mass reference, exact derivation only)?

Is there prior art specifically on Rényi-2/collision entropy applied to detection that I should be citing and haven't found?

Please note: I'm not trying to oversell this: the token-level base case is Kirchenbauer's, the classification impossibility is Silva's and Sadasivan's.