I read a blog post by Scott Aaronson saying they can watermark by using a cryptographically biased random number generator when selecting which token to output from the stream. I didn't entirely follow how that helps but a little bias per token adds up pretty quickly.