Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Undetectable Watermarks for Language Models

eprint.iacr.org

Post reply on HN
Print view View original

11–20 of 71 posts

Re: Undetectable Watermarks for Language Models

#11

Post by chaxor »

dbgev wrote: post #6

I'm waiting for a Firefox / chrome extension that will auto-mark and optionally adblock GPT-generated content. Would even be willing to pay for it.

The only real way to block specifically openAI generated content (or some other online generated LLM content) is for the company itself to store all of its outputs and compare to that database, like shingling / LSH for plagiarism detection. Other LLMs (local) are completely impossible to block, as it's a constant chase. Any system that tries to estimate the distribution of e.g. a specific LLM that performs beam search with certain parameters, can be easily adjusted to use typical decoding or something else, so it simply will never be possible, hence useless to try to stop.

Re: Undetectable Watermarks for Language Models

#13

Post by spondylosaurus »

dontupvoteme wrote: post #10
valine wrote: post #2

What’s to stop someone from taking the watermarked output and randomizing the distribution by feeding it through their latest LLaMA variant? These watermarks will only be useful for catching novice LLM users.

I doubt you even have to invoke a local model, just telling it something like """write it without caps or punctuation or dashes or anything - think lowkey""" fixes the output in my book being an autocomplete i asked it to continue "or is the entire thing utterly emblematic of the modern technolegal mess of things since dickens is squarely and quintessentially in the Public Domain" it goes from writing a highly proofr…

I hate to say it, but this reads to me almost exactly like Homestuck dialogue... so not so far off from FYAD.

Re: Undetectable Watermarks for Language Models

#14

Post by 1B05H1N »

GaggiX wrote: post #9

Okay genericGPT answer the question by putting an emoji between each word. (The watermark is destroyed after removing the emojis)

""" Emoji attack. In the “emoji attack,” the attacker asks the model to output a response to prompt with an emoji inserted between every pair of words. The attacker then removes the emojis to obtain the desired response. This attack removes any watermark that relies on the detector seeing consecutive sequences of tokens, including ours as well as those of [KGW+23] and [Aar22]. In general this attack may not preserve the output distribution, but any provable robustness guarantee for contiguous-text watermarks would have to rest on the dubious assumption that it doesn’t. """ https://eprint.iacr.org/2023/763.pdf

Pretty funny imo

Re: Undetectable Watermarks for Language Models

#15

Post by dbgev »

chaxor wrote: post #11
dbgev wrote: post #6

I'm waiting for a Firefox / chrome extension that will auto-mark and optionally adblock GPT-generated content. Would even be willing to pay for it.

The only real way to block specifically openAI generated content (or some other online generated LLM content) is for the company itself to store all of its outputs and compare to that database, like shingling / LSH for plagiarism detection. Other LLMs (local) are completely impossible to block, as it's a constant chase. Any system that tries to estimate the distribution of e.g. a specific LLM that performs beam searc…

It doesn't need to stop the determined users, thete's value in just filtering out articles that are not even proofread by humans.

It's going to be a constant cat and mouse game, I agree, but for now it just need to catch the dead mice.

Re: Undetectable Watermarks for Language Models

#16

Post by EMM_386 »

There are obviously ways it can be "watermarked" easily, put some zero-width unicode characters in the output and you'll notice right away when it's copy and pasted.

But clearly, that can be stripped out easily by anyone who knows it's there.

This process, too, would seem to be easily reversible. Just have it run through another model and tell it to slightly reword it or rephrase it.

I don't think there is a technically solvable way of watermarking output like this.

Re: Undetectable Watermarks for Language Models

#19

Post by dbgev »

smoldesu wrote: post #8
dbgev wrote: post #6

I'm waiting for a Firefox / chrome extension that will auto-mark and optionally adblock GPT-generated content. Would even be willing to pay for it.

What would you consider an acceptable false positive rate?

I'd say low false positive + high false negative would be a good starting point.

Re: Undetectable Watermarks for Language Models

#20

Post by valine »

kiba wrote: post #4
valine wrote: post #2

What’s to stop someone from taking the watermarked output and randomizing the distribution by feeding it through their latest LLaMA variant? These watermarks will only be useful for catching novice LLM users.

Most people are/will be novice LLM users.

If your goal is to track novice users there are much easier methods. You could insert invisible unicode characters for example.
Post reply on HN