Live data from Hacker News

Undetectable Watermarks for Language Models

eprint.iacr.org

61–70 of 71 posts

Re: Undetectable Watermarks for Language Models

#61
post #11

Earlier quoted context omitted.

The only real way to block specifically openAI generated content (or some other online generated LLM content) is for the company itself to store all of its outputs and compare to that database, like shingling / LSH for plagiarism detection. Other LLMs (local) are completely impossible to block, as it's a constant chase. Any system that tries to estimate the distribution of e.g. a specific LLM that performs beam searc…

Shazam-like fingerprinting for text. The complete LLM outputs wouldn't need to be stored, just the fingerprints along with some mechanism for trusted timestamping (could be Blockchain).

This has been done for a very long time. Blockchains are definitely not required (this isn't just the usual hate from HN of Blockchain, it just actually doesn't make sense here). Fingerprinting by shingling (windows of text) with some normalization steps is pretty typical in plagiarism or similarity detection. A big database of docid-shingleid pairs along with weights for their frequency is often a very simple and fast way to do this analysis. The big part is getting OpenAI/anthropic/etc to do it on their data and provide a service for that, but there's obviously a lot of unwanted consequences - specifically storing of all user data (even if the shingled and docids are hashes, it's still info).

Re: Undetectable Watermarks for Language Models

#62
post #5

Earlier quoted context omitted.

Yeah soon there will be models small enough to run even on phones to reword things slightly differently. If not, an app will do it

I already have one running on my phone: https://mlc.ai/mlc-llm/

I know about this app, in fact I’m one of your beta testers, didn’t know it was running local models lol. But this thing almost 2gbs.

Re: Undetectable Watermarks for Language Models

#63
post #22

Earlier quoted context omitted.

Is accusing people of being an AI model going to become the new Godwin's law?

Accusing people of being chat bots has a long tradition on the internet.

Yes, but before, it was pretty easy to tell if the accusation is supportable or not. With LLMs, it won't be, so the accusation carries more weight.

Re: Undetectable Watermarks for Language Models

#64

Many commenters (and the paper) are thinking about the watermarking in adversarial settings, e.g. detecting students using AI assistance improperly. But I think even simple watermarking probably has value; consider a corporate context in which the corporation itself may want to monitor and know what proportion of the code, content, or work product is AI-generated. In that setting, fairly simple markers would allow at…

And I personally want some method of detecting LLM output to help protect me in my own internet reading. Even a method that is imperfect would be welcome.

Re: Undetectable Watermarks for Language Models

#65
post #16

There are obviously ways it can be "watermarked" easily, put some zero-width unicode characters in the output and you'll notice right away when it's copy and pasted. But clearly, that can be stripped out easily by anyone who knows it's there. This process, too, would seem to be easily reversible. Just have it run through another model and tell it to slightly reword it or rephrase it. I don't think there is a technica…

It's actually pretty crazy that people are trying to solve this problem. "How can we install DRM and tracking into a block of text?"

I don't think it's about DRM and tracking as much as proving authenticity.

Re: Undetectable Watermarks for Language Models

#67
post #53

I don't quite understand the aim of this paper. They focus on undetectable watermarks for LM text. But isn't rather the difficulty that it is hard to distinguish between AI generated and normal text in the first place, even with detectable watermarks? Unlike photos, audio, or video, text has an incredibly low bitrate, so there isn't much room for steganography. It's like they are trying to solve a hard problem withou…

How is it difficult with detectable watermarks? If it has the watermark it is from that specific LLM, if there is no watermark it isn't from that LLM. Unless somebody tampered with the watermark, but that's exactly where undetectable watermarks have an advantage. If you don't notice that it's there you won't tamper with it.

Scott Aaronson worked on that at OpenAI, but GPT-4 didn't use such technology, nor have I seen any other major language model which had the ability of accurately distinguishing model output and human text.

Re: Undetectable Watermarks for Language Models

#68
post #53

I don't quite understand the aim of this paper. They focus on undetectable watermarks for LM text. But isn't rather the difficulty that it is hard to distinguish between AI generated and normal text in the first place, even with detectable watermarks? Unlike photos, audio, or video, text has an incredibly low bitrate, so there isn't much room for steganography. It's like they are trying to solve a hard problem withou…

Undetectable watermarks could be quite useful for AI vendors, to track usage of their product. Potentially even track individual users.

But that doesn't mean it is possible.

Re: Undetectable Watermarks for Language Models

#69
post #2

What’s to stop someone from taking the watermarked output and randomizing the distribution by feeding it through their latest LLaMA variant? These watermarks will only be useful for catching novice LLM users.

I suspect that it will be possible to, assuming the number of popular open LLMfor this remains low, target the popular ones to have your watermark be resilient. With that said, watermarking to indicate that something was generated by AI reminds me of what someone told me about locks: They are there to keep honest people honest. It will certainly not defeat an adversary directly targeting the technique. It is likely t…

This watermark relies on subtle grammatical variations. Passing it through any model is going to wipe out the distribution.

The number of open LLMs is exploding, and the most popular ones are fine tuned by small groups / individuals. None of the folks volunteering their time and compute to fine tuning open models are going to waste resources adding your watermark.

Re: Undetectable Watermarks for Language Models

#70
post #16

There are obviously ways it can be "watermarked" easily, put some zero-width unicode characters in the output and you'll notice right away when it's copy and pasted. But clearly, that can be stripped out easily by anyone who knows it's there. This process, too, would seem to be easily reversible. Just have it run through another model and tell it to slightly reword it or rephrase it. I don't think there is a technica…

I now have a habit of copying and pasting things I receive in emails or generate with certain tools into a ascii-only notepad before recopying and pasting out, anything that I am posting or sending to others. Because I've thought about how easy certain services could track origin of content across platforms with non printing unicode or using unicode for homograph attacks.

Makes me want a systemwide right click > "Paste and strip all but ASCII" command.

Post reply on HN