SynthID – Watermarking and identifying AI-generated text

Key Concepts

• Generative AI Watermarking: Embedding a digital signature into AI-generated text to identify its origin.
• SynthID: Google's suite of tools for detecting AI-generated content (audio, video, images, and text).
• SynthID-Text: The open-sourced text watermarking method within SynthID, available on Hugging Face.
• Watermarking Key: A secret key required to detect the watermark, ensuring privacy and controlled access.
• N-grams: Sequences of n items (tokens) in a text.
• Bayesian Detector: A statistical method used to determine if a text is watermarked based on a corpus of watermarked and unwatermarked text.

Why Watermark Language Models?

• Combating Misinformation: Generative AI can amplify the spread of fake news and deepfakes. Watermarking helps trace the source of AI-generated content.
• Model Ownership: If you host a language model behind an API, watermarking allows you to verify if content found online was generated by your model.
• Digital Signature: Watermarking embeds a digital signature in the generated text, enabling recognition without retraining the model.

SynthID-Text Development: Design Decisions

The development of SynthID-Text was guided by several key design principles:

1. Detectability: The watermark must be detectable with high accuracy.
2. Quality Preservation: Watermarking should not degrade the quality of the generated text.
3. Robustness: The watermark should be resistant to small modifications of the text.
4. Lightweight: The method should not require retraining the model and should have minimal latency.

How SynthID-Text Works: The Watermarking Process

1. Token Distribution: The language model provides a probability distribution of possible next tokens.
2. Random Seed Generation: The most recent context (e.g., the last three tokens) is combined with the watermarking key to generate a random seed.
3. Watermark Value Assignment: The random seed is passed to a watermarking function, which assigns a watermark value (1 or 0) to each possible token.
4. Tournament Selection: Instead of sampling just one token, two tokens are sampled, and a "tournament" is held. The token with the higher watermark value is selected. Multiple tournament layers increase robustness.
5. Distribution Modification: The model's distribution is slightly modified to favor n-grams with a watermark value of 1.

Watermark Detection

1. Watermark Value Calculation: Calculate the watermark values for each n-gram in the text being analyzed.
2. Value Distribution Analysis: Check if the number of 1s and 0s is approximately equal.
   • Equal Distribution: Indicates no watermark.
   • Significantly More 1s: Suggests the text is watermarked and was generated by the specific model associated with the watermarking key.

Quality Preservation: Empirical and Theoretical Evidence

• Benchmark Performance: Standard benchmarks showed no significant performance difference between watermarked and unwatermarked models.
• User Preference: User studies revealed no preference between watermarked and unwatermarked responses.

Using SynthID-Text in Hugging Face: Step-by-Step

1. Configuration: Configure the watermarking method, specifying a secret sequence of watermarking keys.
2. Text Generation: Pass the watermarking_config to the model.generate function.
3. Watermark Detector Preparation: Gather a corpus of watermarked and unwatermarked text and train a Bayesian detector. A detailed example is available online.
4. Detection: Pass the text to the watermark detector to determine if it is watermarked.

Conclusion

SynthID-Text offers a practical solution for watermarking AI-generated text, enabling the identification of content origin and combating misinformation. The method prioritizes detectability, quality preservation, robustness, and efficiency. Its integration with Hugging Face simplifies implementation, allowing users to watermark their language models and detect watermarks in generated text. The use of watermarking keys ensures privacy and controlled access to watermark detection.