How Google’s Watermarking Technology Identifies AI-Generated Content

Author(s): Lamprini Papargyri

Originally published on Towards AI.

In October 2024, Google DeepMind’s SynthID tool for watermarking AI-generated text was released as open-source, marking a significant step forward in AI transparency. This tool emerged in response to growing concerns about distinguishing AI-generated content, as tools like OpenAI’s ChatGPT and Google’s Gemini now produce text, images, and even audio that are increasingly difficult to differentiate from human-made content. With policymakers and civil society demanding reliable identification of AI content, SynthID represents an important development in addressing issues around AI-driven misinformation and authenticity.

Notably, the European Digital Education Hub (EDEH) and its “Explainable AI” squad have played a crucial role in advancing AI transparency in educational settings. Explainable AI (XAI) refers to AI systems that clearly reveal how decisions and recommendations are made, rather than functioning as a “black box” with hidden processes. Through collaboration with tech companies and organizations, they aim to promote digital literacy and enhance transparency across Europe’s educational and public sectors, fostering ethical AI practices and building trust in both educational and digital environments.

Evaluating AI Detection Tools: Key Technical and Policy Criteria

The rapid advancement of generative AI has created an urgent need for tools that can reliably detect AI-generated content. The effectiveness of any detection tool hinges on a set of essential technical and policy criteria:

• Accuracy: A detection tool should reliably distinguish between human-made and AI-generated content, with minimal false positives and negatives. For transparence and explainability purposes, the tool should provide nuanced responses (e.g., a probability score) rather than a simple binary answer.
• Robustness Against Evasion: Detection methods should withstand tampering or manipulation, as motivated actors might attempt to alter AI content to make it appear human-made, such as through paraphrasing or translation.
• Quality Preservation: Detection techniques should avoid diminishing the quality of AI-generated content. Tools that intentionally degrade quality to make content detectable may deter adoption by developers focused on user experience.
• Universality and Privacy: Ideally, a detection tool should be universal, meaning it can apply to any AI model without requiring active cooperation from the developer. Privacy is equally important; any detection method should respect user data privacy.

Main Aspects of Watermarking

Watermarking involves embedding identifiable markers in content to indicate its origin, a method long used in digital media like photos and audio. With AI, watermarking has gained traction as a viable way to mark content for later identification, addressing authenticity concerns. Here are some key watermarking techniques and how they fare in theory and practice:

Statistical Watermarking: Embeds statistically unusual patterns in text or other content to create a subtle, machine-readable signature.

• Advantages: Allows for subtle identification without compromising readability and works well with light modifications.
• Limitations: Sensitive to extensive changes (e.g., paraphrasing, translation), which can remove or weaken the watermark.

Visible and Invisible Watermarks: Visible watermarks, such as logos or labels, are immediately recognizable but can disrupt user experience. Invisible watermarks embed patterns within content that are undetectable by users but can be identified by specialized detection tools.

• Advantages: Invisible watermarks avoid altering the content’s appearance, providing a seamless user experience.
• Limitations: Advanced users may be able to remove or alter these markers, especially if they understand the watermarking method.

Google’s SynthID uses a statistical watermarking approach to subtly alter token probabilities during text generation, leaving an invisible, machine-readable signature. SynthID’s invisible watermark preserves content quality while marking AI-generated material

Overview of AI Detection Approaches

1. Retrieval-Based Approach: This method involves creating and maintaining a database of all generated content so that new text can be checked against it for matches.

• Advantages: Effective for detecting exact matches and is reliable for specific high-value use cases.
• Disadvantages: Requires massive storage and continuous updates, raising scalability and privacy concerns. Retrieval-based systems can be impractical at large scales.

2. Post-Hoc Detection: This technique applies machine learning classifiers to text after it is generated, assessing characteristics typical of AI-written versus human-written material. It relies on analyzing patterns in syntax, word choice, and structure.

• Advantages: Post-hoc detection doesn’t interfere in text creation and is flexible across different AI models.
• Disadvantages: Computationally demanding, with inconsistent performance on out-of-domain or highly edited content. Detection accuracy can decrease significantly when content undergoes substantial changes.

3. Text Watermarking: SynthID falls into this category, which embeds markers directly within the generated text at the time of creation. Text watermarking has several subcategories:

3.1 Generative Watermarking: Adjusts token probabilities during text generation to introduce an invisible “signature” without altering the text’s quality.

• Advantages: Maintains readability and is robust against minor edits; minimal impact on text quality.
• Disadvantages: Vulnerable to substantial edits, like extensive rephrasing or translations, which may remove the watermark.

3.2 Edit-Based Watermarking: Alters text after it’s generated by adding specific characters or symbols.

• Advantages: Easily detectable and quick to implement.
• Disadvantages: Visibly changes the text, potentially affecting readability and user experience.

3.3 Data-Driven Watermarking: Embeds watermarks in the training data so that certain sequences or phrases appear only when prompted.

• Advantages: Effective for deterring unauthorized use when integrated from the training stage.
• Disadvantages: Limited to specific prompts, with visible markers that may compromise subtlety.

SynthID uses generative watermarking to subtly embed markers during text generation, ensuring an undetectable signature while preserving the text’s quality. This approach strikes a balance between detection and usability, marking a significant advancement in watermarking for AI.

How SynthID Works

SynthID’s watermarking technology employs two neural networks to embed and detect an invisible watermark. For text, this mechanism works by subtly modifying token probabilities during text generation. Large language models (LLMs) generate text one token at a time, assigning each token a probability based on context. SynthID’s first network makes small adjustments to these probabilities, creating a watermark signature that remains invisible and maintains the text’s readability and fluency.

For images, the first neural network modifies a few pixels in the original image to embed an undetectable pattern. The second network then scans for this pattern in both text and images, allowing it to inform users whether it detects a watermark, suspects one, or finds none.

The watermark detection process compares the probability distributions of watermarked and unwatermarked text, identifying the signature left by the watermark. Through large-scale testing, Google DeepMind confirmed SynthID’s effectiveness: in the Gemini app, where over 20 million users unknowingly rated watermarked and unwatermarked text, the feedback showed no noticeable quality difference between the two. This suggests that SynthID’s watermarking process is effective without compromising the text’s fluency or usability.

Strengths and Limitations of SynthID and Watermarking

SynthID’s invisible watermarking approach provides a powerful tool for marking AI-generated content, yet it faces challenges, particularly as part of a comprehensive solution for AI transparency. Key strengths and limitations include:

• SynthID’s watermark is resilient with minor changes, such as slight paraphrasing or cropping, making it robust for lightly modified content.
• SynthID struggles with highly predictable outputs, such as factual statements (e.g., “The capital of France is Paris”) or code, where the watermark cannot be embedded without affecting accuracy.
• While effective against casual modifications, SynthID’s watermark could be compromised by users with knowledge of its workings, particularly in cases where sophisticated adversaries aim to remove or obscure the watermark.

Given these limitations, SynthID works best when paired with other detection methods. Combining it with retrieval-based or post-hoc methods could enhance overall detection accuracy and resilience, especially in high-stakes applications like education or misinformation detection.

Policy and Governance Considerations for Watermarking

SynthID’s deployment as an open-source tool is part of a larger trend toward establishing AI transparency standards. Policymakers are exploring ways to promote accountability, including watermarking requirements in laws and international agreements. Effective governance of AI watermarking requires attention to several key considerations:

∙ As watermarking research advances, standardized techniques will help align different stakeholders and make AI transparency measures more consistent.

∙ A centralized organization could manage a registry of watermarking protocols, simplifying detection by providing a standardized platform for users to verify content provenance.

∙ Policymakers must ensure watermarking methods respect user privacy and data security. This includes defining what information can be embedded in watermarks and regulating data handling by third-party detection services.

A balanced, layered approach that combines multiple detection methods may be the most practical strategy for addressing the complex challenges posed by generative AI content.

Conclusion: SynthID’s Role in Building AI Transparency

SynthID is another step forward in AI transparency, but watermarking alone cannot guarantee full accountability for AI-generated content. As AI becomes increasingly skilled at producing realistic text, images, and media, a multi-layered approach is essential for content verification. SynthID provides a starting point, giving users a means of identifying AI-generated material and discouraging misuse. However, it should ideally be part of a larger ecosystem of checks and balances to ensure robust AI accountability.

For true content authenticity, additional safeguards should be explored. Fact-checking, for instance, can help verify information accuracy, while standardized content verification frameworks would ensure consistent detection across platforms and tools. Additionally, regulatory measures could help ensure that AI-generated content is labeled and traceable, empowering users to assess the credibility and origin of the information they encounter.

In this evolving landscape, SynthID can serve as a tool for AI transparency by offering users a reliable method of distinguishing between human and AI-generated content. As watermarking and complementary approaches become widely adopted, we may see the emergence of a more transparent and accountable digital ecosystem that encourages responsible AI practices. By equipping users with tools to verify the authenticity of digital content, SynthID and similar technologies can contribute to a safer, more trustworthy online environment.

Interested to learn more about SynthID? Read here the article.

Join thousands of data leaders on the AI newsletter. Join over 80,000 subscribers and keep up to date with the latest developments in AI. From research to projects and ideas. If you are building an AI startup, an AI-related product, or a service, we invite you to consider becoming a sponsor.

Published via Towards AI