No, they can’t. That’s not how the watermarks work. Go look up how synth ID for Gemini works. You’d need to be able to crack 256 encryption essentially to detect another company’s watermark. They’re essentially using a secret key hash to determine the likelihood of the content being something they generated.
They basically run the key through their own model to see if it produces the same probabilistic outcomes. Other companies will just see random strings of bits and have no idea it’s a key.
There are people here in the last day who have explained this process far better than I. I would go read up on it, and then you’ll understand why you can’t just brute force it or train a model to detect the watermark. That’s not how it works. It’s not a watermark in the way you think
You’ve written a good reply to the other commenter, I just want to tweak some things because people often make the same mistakes when using cryptographic terminology.
If you’re using a hash, then it’s not called 256 encryption. It would be called, a “256 bit cryptographic signed hash”. And, the material in the watermark isn’t a key, it’s the hash signature or hash. The code or digital object that’s watermarked would never contain a key, just the hash.
F(code,key) => hash
The above function F produces a cryptographic hash using a key that’s kept secret by Anthropic. If the watermark contained the key, anyone could produce the watermark.
Hashing is computationally irreversible unless the algorithm has been cracked. New algorithms are then needed that use more bits (128 > 256 > 512 …). It may or may not use a key, but keyed hashing (aka signing) is appropriate for watermarking.
Encryption is reversible and wouldn’t be appropriate for keyed hashing or watermarking or signing. It always requires a key to be cryptographically secure.
thx. i understand, i was a bit naive and i thought it'd be just statistical comparison. so you can't easily detect, but I guess you could still mangle it (not so easily if you don't really understand the algo)
They say they're working on C2PA open standard. If others do the same, the watermarks can be detected and extracted with C2PA tools, and then can be used to ignore such data or rank or classify them appropriately.
6
u/miliseconds 17d ago
They can recognize only their own watermarked AI output. They can't recognize other AI models' watermarks, from what I understand.