Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Undetectable Watermarks for Language Models

eprint.iacr.org

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Undetectable Watermarks for Language Models

#41

Post by ShamelessC »

EMM_386 wrote: post #16

There are obviously ways it can be "watermarked" easily, put some zero-width unicode characters in the output and you'll notice right away when it's copy and pasted. But clearly, that can be stripped out easily by anyone who knows it's there. This process, too, would seem to be easily reversible. Just have it run through another model and tell it to slightly reword it or rephrase it. I don't think there is a technica…

This research presents a technically solvable way for just that. Although I will admit it’s far too complex for me to understand.

Re: Undetectable Watermarks for Language Models

#42

Post by ademarre »

chaxor wrote: post #11
dbgev wrote: post #6

I'm waiting for a Firefox / chrome extension that will auto-mark and optionally adblock GPT-generated content. Would even be willing to pay for it.

The only real way to block specifically openAI generated content (or some other online generated LLM content) is for the company itself to store all of its outputs and compare to that database, like shingling / LSH for plagiarism detection. Other LLMs (local) are completely impossible to block, as it's a constant chase. Any system that tries to estimate the distribution of e.g. a specific LLM that performs beam searc…

Shazam-like fingerprinting for text. The complete LLM outputs wouldn't need to be stored, just the fingerprints along with some mechanism for trusted timestamping (could be Blockchain).

Re: Undetectable Watermarks for Language Models

#43

Post by auraham »

aaronharnly wrote: post #40

Many commenters (and the paper) are thinking about the watermarking in adversarial settings, e.g. detecting students using AI assistance improperly. But I think even simple watermarking probably has value; consider a corporate context in which the corporation itself may want to monitor and know what proportion of the code, content, or work product is AI-generated. In that setting, fairly simple markers would allow at…

There is a story about Elon Musk tracking the source of a leak in Tesla by adding spaces in emails:

> We sent what appeared to be identical emails to all, but each was actually coded with either one or two spaces between sentences, forming a binary signature that identified the leaker.

https://theintercept.com/2022/12/15/elon-musk-leaks-twitter/

Re: Undetectable Watermarks for Language Models

#44

Post by dontupvoteme »

flangola7 wrote: post #39
dontupvoteme wrote: post #7

You know that thing i want from your large language model? I just submitted my query for it in Finnish, Japanese, Russian, Hebrew, German, French, Latin, Farsi, Basque, and English. plus a few dozen more for good measure and to cover the linguistic landscape Is there any reason to believe watermarking LLMs will hold up in this scenario?

It's all numbers underneath. GPT doesn't see different languages, the same data transformations can be applied universally.

I'm dubious. At a bare minimum the 'same' prompt for code translated into other languages produces dramatically different results -- at least it did under codex.

it also thinks it can translate to Sindarin and back, but it just seems to tolkenize everything and also have a vocabulary of about 35 words, most of which are the sun and the moon.

cat in the hat is pretty amazing when translated to it and back though

Re: Undetectable Watermarks for Language Models

#45

Post by gpderetta »

dbgev wrote: post #22
alvah wrote: post #21

Earlier quoted context omitted.

The phrase "As an AI language model" could be useful here.

Is accusing people of being an AI model going to become the new Godwin's law?

Accusing people of being chat bots has a long tradition on the internet.

Re: Undetectable Watermarks for Language Models

#46

Post by DeinFreund »

Their algorithm is based on splitting the embeddings into a bit-wise representation and then sampling each bit based on the secret key, preserving the same likelihood distribution as with random sampling. (Given that the key is random)

They say this works wlog for more complex embeddings, by encoding each token as a bit string. Could someone explain this generalization to me?

If we have 4 tokens, 00, 01, 10, 11 with probabilities 0.5 for 00 and 11 and probability 0 for 01 and 10. Going through bit by bit, how will the algorithm guarantee not to produce 01 or 10?

Re: Undetectable Watermarks for Language Models

#47

Post by NoMoreNicksLeft »

dbgev wrote: post #6

I'm waiting for a Firefox / chrome extension that will auto-mark and optionally adblock GPT-generated content. Would even be willing to pay for it.

Given Mozilla's recent behavior, I think you should more likely expect the built-in GPT-generated ads that you can't disable in browser settings.

Re: Undetectable Watermarks for Language Models

#48

Post by anankaie »

valine wrote: post #2

What’s to stop someone from taking the watermarked output and randomizing the distribution by feeding it through their latest LLaMA variant? These watermarks will only be useful for catching novice LLM users.

I suspect that it will be possible to, assuming the number of popular open LLMfor this remains low, target the popular ones to have your watermark be resilient. With that said, watermarking to indicate that something was generated by AI reminds me of what someone told me about locks: They are there to keep honest people honest.

It will certainly not defeat an adversary directly targeting the technique. It is likely that a LoRA based approach would defeat this, especially if the detector for the watermark is broadly available and cheap to run.

Re: Undetectable Watermarks for Language Models

#49

Post by bryanrasmussen »

flangola7 wrote: post #35
bryanrasmussen wrote: post #30

Why would you want to watermark your content - generally watermarks are used to provide legal proof of provenance which can be important when suing someone for stealing your content but since machine learning outputs cannot be copyrighted this use is not important.

>since machine learning outputs cannot be copyrighted This is very much unexplored and unsettled territory in most jurisdictions, both judicially and legislatively. I would refrain from making such authoritative statements for now.

I guess you're right, although I do expect most jurisdictions to fall in line with the US copyright office ruling, as it would be problematic if they did not.

Re: Undetectable Watermarks for Language Models

#50

Post by totetsu »

GaggiX wrote: post #9

Okay genericGPT answer the question by putting an emoji between each word. (The watermark is destroyed after removing the emojis)

Or ask it to output the text backwards then reverse it, or output in one language then translate it to another in Google translate.. There are so many ways around this.
Post reply on HN