Google presents invisible watermark for AI-generated texts

Google presents invisible watermark for AI-generated texts

Researchers at Google DeepMind in London have developed a "watermark" to invisibly mark text generated by artificial intelligence (AI) - this has already been used by millions of chatbot users.

The watermark, published Oct. 23 in the journal Nature 1, is not the first created for AI-generated texts. However, it is the first to be demonstrated in a large-scale, real-world context. “I think the biggest news here is that they're actually using it,” says Scott Aaronson, a computer scientist at the University of Texas at Austin who, until August, worked on watermarking at OpenAI, the makers of ChatGPT based in San Francisco, California.

AI-generated text recognition is becoming increasingly important as it represents a potential solution to the problems of Fake news and academic fraud represents. In addition, it could contribute to Protect future models from devaluation by not training them with AI-generated content.

In a comprehensive study, users of the Google Gemini Large Language Model (LLM) rated watermarked texts as equivalent to unmarked texts in 20 million responses. “I'm excited to see Google take this step for the tech community,” said Furong Huang, a computer scientist at the University of Maryland in College Park. “It is likely that most commercial tools will include watermarks in the near future,” adds Zakhar Shumaylov, a computer scientist at the University of Cambridge, UK.

Choice of words

It's more difficult to apply a watermark to text than to images because word choice is essentially the only variable that can be changed. DeepMind's watermarking - called SynthID text - changes which words the model chooses in a secret but formulaic way that can be captured with a cryptographic key. Compared to other approaches, DeepMind's watermark is slightly easier to detect and the application does not delay text creation. “It seems to be outperforming competitors’ approaches to watermarking LLMs,” says Shumaylov, who is a former employee and brother of one of the study’s authors.

The tool has also been opened up so that developers can apply their own watermark to their models. “We hope other AI model developers will adopt this and integrate it into their own systems,” says Pushmeet Kohli, a computer scientist at DeepMind. Google keeps its key secret so that users cannot use detection tools to identify watermarked text from the Gemini model.

governments set on watermarks as a solution for distributing AI-generated text. Still, there are many problems, including developers' commitment to using watermarks and the coordination of their approaches. At the beginning of this year, researchers at the Swiss Federal Institute of Technology in Zurich showed that any watermark vulnerable to removal is, a process called “scrubbing,” or “spoofing,” in which watermarks are applied to text to give the false impression that it is AI-generated.

Token tournament

DeepMind's approach is based on one existing method, which integrates a watermark into a sampling algorithm, a step in text creation that is separate from the LLM itself.

An LLM is a network of associations built by training with billions of words or parts of words known as tokens. When text is entered, the model assigns each token in its vocabulary a probability of being the next word in the sentence. The task of the sampling algorithm is to choose which token to use according to a set of rules.

The SynthID text sampling algorithm uses a cryptographic key to assign random values ​​to each possible token. Candidate tokens are drawn from the distribution in proportion to their probability and placed into a “tournament.” There, the algorithm compares the values ​​in a series of one-on-one knockout rounds, with the highest value winning until only one token remains, which is chosen for the text.

This sophisticated method makes watermark detection easier because the same cryptographic code is applied to generated text to look for the high values ​​that indicate “winning” tokens. This could also make removal difficult.

The multiple rounds in the tournament can be viewed as a combination of lock, where each round represents a different number that must be solved to unlock or remove the watermark, Huang says. “This mechanism makes it significantly more difficult to scrub, spoof or reverse engineer the watermark,” she adds. For texts with around 200 tokens, the authors showed that they could still detect the watermark even when a second LLM was used to rewrite the text. The watermark is less robust for shorter texts.

The researchers have not examined how well the watermark resists intentional attempts to remove it. The resilience of watermarks against such attacks is a “massive political question,” says Yves-Alexandre de Montjoye, a computer scientist at Imperial College London. “In the context of AI security, it is unclear to what extent this provides protection,” he explains.

Kohli hopes that the watermark will initially help support the well-intentioned use of LLMs. “The guiding philosophy was that we wanted to develop a tool that the community could improve,” he adds.

1. Dathathri, S. et al. Nature 634, 818–823 (2024).

   Google Scholar

Download references