Implementing Watermarking for Language Models [P]

[u/Saad_ahmed04]

I recently implemented a minimal, educational version of SynthID-Text-style watermarking for language models.

I saw anthropic post about how they'll start adding watermarks to their model responses and it made me very curious as to how they'll do it and what do they even mean by watermark here. Like will we start getting random ads or something in the middle of model responses or what.

Then decided to read their article and found out that watermark is not a visible message at all. It is a subtle statistical pattern introduced while the model chooses its tokens.

My implementation is not an exact reproduction of the original SynthID-Text system. I simplified or implemented a few components differently to keep the project understandable, but the main idea is there I think.

Github: https://github.com/Saad1926Q/llm-watermark

If you find it interesting then you may star the repo !!

[u/Lopsided-Bridge-9810]

Reliable watermarking for linguistically based inferencing is not possible, imo. You can feed the output to multiple other llms that don't watermark and ask to have text rewritten a certain way, you can translate the text to other languages and translate back and the entire statistic signature gets lost. Linguistic styled can be targeted and attacked. There is no watermarking happening in text based llms anytime soon. I mean labs can watermark but it's a nonsense approach.

[u/schubidubiduba → u/Lopsided-Bridge-9810]

A recent benchmark showed that even after backtranslation using Chinese as intermediate language, watermarking accuracy remains at 70%. Whether that is high enough to be useful is a different question.

[u/Lopsided-Bridge-9810 → u/schubidubiduba]

I think that only remains this high when watermarking is not mentioned and the llm is not specially instructed?

[u/schubidubiduba → u/Lopsided-Bridge-9810]

Yes this is for standard translation. I don't remember which model or prompt, or if it even was an LLM.

[u/ThisWillPass → u/schubidubiduba]

Yeah with a 600m model sure.

[u/surffrus → u/Lopsided-Bridge-9810]

Your argument is that it won't work because it can be "removed" by taking extra steps. Ok, sure.

You and others are missing the point that this is about capturing the 99% of users who just use the model and move on with their lives because they don't want to be bothered or are simply naive. Watermarking will be useful for many things, including online filters.

[u/robobub → u/surffrus]

Agreed. It's the same with image watermarks, even the less visible ones like Gemini image SynthID

[u/Lopsided-Bridge-9810 → u/robobub]

What benefit will you obtain from an image watermark? Image generators already can inject all sorts of Metadata to an image file.

[u/robobub → u/Lopsided-Bridge-9810]

Because image metadata is easily removed by just modifying the tag section. Many sites will also strip various or even all metadata for privacy reasons.

Visible watermarks are similar, though easier to notice and thus easier to remove.

Invisible image watermarks are harder in both ways. Even saving different formats, increasing compression, and cropping to an extent can still retain the watermark.

It's about extra steps and each one gets a big chunk of users but will never get all of them.

[u/Lopsided-Bridge-9810 → u/robobub]

I don't see the point, its seems like you contradict yourself (or the argument by someone else you supported):

You want watermarks/meta data, great, you got those today, use the apps that don't strip them. You are a bad actor who wants to mislead with images that are not what a watermark or no watermark suggests? Sure, no problem, a watermark is not gonna be the least of your problems. They can be removed from images very easily. So, what again is the benefit of a watermark?

See the difficulty and goal of authenticity checks and guarantees is not to cover the vast amount of usecases, it must be solid to prevent nefarious characters from mischaracterizing content. Its not the average user that you need to be concerned with, its the bad actors. And watermarking provides absolutely zero benefit in that regard.

[u/robobub → u/Lopsided-Bridge-9810]

I don't see the point, its seems like you contradict yourself

Well yes, as you said, you don't understand the purpose of these watermarks. As I explicitly said, the goal is not to get everyone or the bad actors. It's to stop 80% (simple watermarks/metadata) or 95% (invisible watermarks). It works as intended, to catch those cases. I hope you can understand why catching those are useful, but if not, I can go into more detail.

The goal of these is not to catch insistent targeted bad actors. For that, there is a solution, but it's going to take more effort and support. It's cryptography to verify human produced artifacts. It's not unlike signing binaries, transactions, or messages to verify authenticity. Some cameras have that, so we can verify real non-AI pictures. It can be added to various other types of media as well. But this can only protect against pretending to be others with higher dimensional data.

For low dimensional data like text, no, I don't think there will be a way to prove the inverse, that AI wasn't used to help create it. You'll have to do other checks depending on the purpose. E.g for school, evaluating comprehension and process.

[u/Lopsided-Bridge-9810 → u/robobub]

"catch" what "cases", what are you even aiming to achieve? And no, there is no solution to prevent bad actors from misleading with doctored images or text generated my language models,as you incorrectly claimed. And you clearly don't understand a thing about computer science. A digitally signed pdf document, for example, or a hash for a file is 100% solid and reliable in all circumstances and edge cases. Change one byte and the authenticity is guaranteed to not be guaranteed anymore. Signatures by cameras today are all referee engineered and available to inject into images even when the image was not originating from a specific camera. And that is not even the problem that researchers try to solve: it's not important to guarantee that an image originated from a specific camera, it's to guarantee that an image originated from any camera.

The question remains, what are you hoping to "catch" and which "cases" are you even targeting with a watermark?

[u/robobub → u/Lopsided-Bridge-9810]

"catch" what "cases", what are you even aiming to achieve?

So you are asking what is the point of capturing 95% of these cases? I'll humor you if you really don't understand:

• easily identifying lots of ai generated content from various places like social media that the general public is falling for
  • this can either be automatically removed
  • triaged differently in moderation
  • even just deprioritized in the feed
  • notify the poster: many posters have no idea they are forwarding AI generated stuff
• measuring AI slop prevalance for various other metric purposes
• creates friction for the lower effort bad actors

and no, they won't just outright be banned and notified that they need to evade detection better. They will just suppress their slop in the feed, yielding some amount of loss of interactions from real users. Between that and the not as easy to evade more subtle watermarks means a significant reduction in harm.

And no, there is no solution to prevent bad actors from misleading with doctored images or text generated my language models,as you incorrectly claimed. And you clearly don't understand a thing about computer science. A digitally signed pdf document, for example, or a hash for a file is 100% solid and reliable in all circumstances and edge cases. Change one byte and the authenticity is guaranteed to not be guaranteed anymore.

I'll clarify this for you. What I was referring to is people pretending to be the white house or other public figure, posting some statement, image, or video. Those can easily be signed and if modified, well, it can be identified it's not a true press release.

Signatures by cameras today are all referee engineered and available to inject into images even when the image was not originating from a specific camera.

Source on something like C2PA being defeated in practice? To clarify, I brought this up as a separate thing from watermarks.

Also some cameras will embed 3D depth information from phase detection points all over the sensors, so this will even defeat taking a photo of a fake printed out scene.

And you clearly don't understand a thing about computer science.

Lol. It's pretty clear that you aren't really understanding my responses before firing off your own. If you want me to respond again, demonstrate some real effort.

[u/Lopsided-Bridge-9810 → u/robobub]

Are you seriously thinking that those who aim for clicks will not push their images through apps that make images pass through all sorts of filters, even if such filters existed? We are talking hard cold cash for them that's what they do to earn money. Also, signatures can be very easily reverse-engineered. You have no idea how easy that is.

You are incredibly naive. I am done with this exchange, clearly you have very little understanding how this all works.

[u/Lopsided-Bridge-9810 → u/surffrus]

Online filters? Care to elaborate? About utility other than source identification perhaps you are right, but the most important application is binary, whether something was created by llms or not and watermarking won't solve this problem.

[u/Lopsided-Bridge-9810 → u/surffrus]

What are the useful "many things" can you name a single example? What do you mean with "online filters", example?

[u/surffrus → u/Lopsided-Bridge-9810]

Are you just being obtuse for winning an argument? You really can't think of one example where this would be useful?

• ML labs skipping AI watermarked text in training their models (this is the ML subreddit, right?)

• Web crawlers down-weighting AI pages.

• Social media (like Facebook) removing or down-weighting AI content.

• Education institutions detecting it...for obvious reasons.

• Email spam filters

[u/Lopsided-Bridge-9810 → u/surffrus]

I have zero skin in this and don't care but you seem to be sour something you invested time into gets questioned.

• ML labs skipping AI watermarked text in training their models (this is the ML subreddit, right?) -> why would ml labs want to do that? Are you aware of the term distillation?

• Web crawlers down-weighting AI pages. -> why would a web crawler want to do that? You are aware that this would skip entire pages of content, for example crawling a reddit page, just because a user commented with an Ai generated grammar and spelling corrected paragraph of text? Why would anyone want to do that?

• Social media (like Facebook) removing or down-weighting AI content. -> why? Your Ai-free social media platform so that you can all hold hands and be self congratulatory?

• Education institutions detecting it...for obvious reasons. -> a hard no here. We already discussed this and I told you that those who display the energy to cheat will ensure their llm inferenced text won't be detectable as such.

• Email spam filters -> you are aware that even banks and insurers and public services now send emails that are largely Ai generated, are you not? You will only receive 1 in 100 of important emails just because you seem to have an issue with Ai at large.

Perhaps you should ask yourself whether you perhaps just want to cater to a group of die hards who refuse to use AI. And then your use cases make sense. For the remaining 999 in 1000 individuals your ideas a bluntly speaking stupid.

[u/Saad_ahmed04 → u/Lopsided-Bridge-9810]

Yeah I do agree with this sentiment.

The main motivation for me was to try and understand what anthropic are planning on doing. And after digging into the algorithm they’re planning on using, I do have my doubts about its effectiveness and also the very thing you said i.e. people can just ask some other llm to change the wording a bit and now the watermark doesn’t work. So yeah let’s see what happens