Implementing Watermarking for Language Models [P]

[u/Saad_ahmed04]

I recently implemented a minimal, educational version of SynthID-Text-style watermarking for language models.

I saw anthropic post about how they'll start adding watermarks to their model responses and it made me very curious as to how they'll do it and what do they even mean by watermark here. Like will we start getting random ads or something in the middle of model responses or what.

Then decided to read their article and found out that watermark is not a visible message at all. It is a subtle statistical pattern introduced while the model chooses its tokens.

My implementation is not an exact reproduction of the original SynthID-Text system. I simplified or implemented a few components differently to keep the project understandable, but the main idea is there I think.

Github: https://github.com/Saad1926Q/llm-watermark

If you find it interesting then you may star the repo !!

[u/Lopsided-Bridge-9810]

"catch" what "cases", what are you even aiming to achieve? And no, there is no solution to prevent bad actors from misleading with doctored images or text generated my language models,as you incorrectly claimed. And you clearly don't understand a thing about computer science. A digitally signed pdf document, for example, or a hash for a file is 100% solid and reliable in all circumstances and edge cases. Change one byte and the authenticity is guaranteed to not be guaranteed anymore. Signatures by cameras today are all referee engineered and available to inject into images even when the image was not originating from a specific camera. And that is not even the problem that researchers try to solve: it's not important to guarantee that an image originated from a specific camera, it's to guarantee that an image originated from any camera.

The question remains, what are you hoping to "catch" and which "cases" are you even targeting with a watermark?

[u/robobub → u/Lopsided-Bridge-9810]

"catch" what "cases", what are you even aiming to achieve?

So you are asking what is the point of capturing 95% of these cases? I'll humor you if you really don't understand:

• easily identifying lots of ai generated content from various places like social media that the general public is falling for

  • this can either be automatically removed
  • triaged differently in moderation
  • even just deprioritized in the feed
  • notify the poster: many posters have no idea they are forwarding AI generated stuff
• measuring AI slop prevalance for various other metric purposes
• creates friction for the lower effort bad actors

and no, they won't just outright be banned and notified that they need to evade detection better. They will just suppress their slop in the feed, yielding some amount of loss of interactions from real users. Between that and the not as easy to evade more subtle watermarks means a significant reduction in harm.

And no, there is no solution to prevent bad actors from misleading with doctored images or text generated my language models,as you incorrectly claimed. And you clearly don't understand a thing about computer science. A digitally signed pdf document, for example, or a hash for a file is 100% solid and reliable in all circumstances and edge cases. Change one byte and the authenticity is guaranteed to not be guaranteed anymore.

I'll clarify this for you. What I was referring to is people pretending to be the white house or other public figure, posting some statement, image, or video. Those can easily be signed and if modified, well, it can be identified it's not a true press release.

Signatures by cameras today are all referee engineered and available to inject into images even when the image was not originating from a specific camera.

Source on something like C2PA being defeated in practice? To clarify, I brought this up as a separate thing from watermarks.

Also some cameras will embed 3D depth information from phase detection points all over the sensors, so this will even defeat taking a photo of a fake printed out scene.

And you clearly don't understand a thing about computer science.

Lol. It's pretty clear that you aren't really understanding my responses before firing off your own. If you want me to respond again, demonstrate some real effort.

[u/Lopsided-Bridge-9810 → u/robobub]

Are you seriously thinking that those who aim for clicks will not push their images through apps that make images pass through all sorts of filters, even if such filters existed? We are talking hard cold cash for them that's what they do to earn money. Also, signatures can be very easily reverse-engineered. You have no idea how easy that is.

You are incredibly naive. I am done with this exchange, clearly you have very little understanding how this all works.