Researchers Tested AI Watermarks—and Broke All of Them

Soheil Feizi considers himself an optimistic individual. However the College of Maryland laptop science professor is blunt when he sums up the present state of watermarking AI photos. “We don’t have any dependable watermarking at this level,” he says. “We broke all of them.”

For one of many two sorts of AI watermarking he examined for a brand new examine—“low perturbation” watermarks, that are invisible to the bare eye—he’s much more direct: “There’s no hope.”

Feizi and his coauthors checked out how simple it’s for unhealthy actors to evade watermarking makes an attempt. (He calls it “washing out” the watermark.) Along with demonstrating how attackers may take away watermarks, the examine reveals the way it’s doable so as to add watermarks to human-generated photos, triggering false positives. Launched on-line this week, the preprint paper has but to be peer-reviewed, however Feizi has been a number one determine in AI detection, so it’s value listening to, even at this early stage.

It’s well timed analysis. Watermarking has emerged as one of many extra promising methods to determine AI-generated photos and textual content. Simply as bodily watermarks are embedded on paper cash and stamps to show authenticity, digital watermarks are supposed to hint the origins of photos and textual content on-line, serving to individuals spot deepfaked movies and bot-authored books. With the US presidential elections on the horizon in 2024, considerations over manipulated media are excessive—and a few individuals are already getting fooled. Former US president Donald Trump, as an example, shared a faux video of Anderson Cooper on his Fact Social platform; Cooper’s voice had been AI-cloned.

This summer time, OpenAI, Alphabet, Meta, Amazon, and several other different main AI gamers pledged to develop watermarking expertise to fight misinformation. In late August, Google’s DeepMind launched a beta model of its new watermarking device, SynthID. The hope is that these instruments will flag AI content material because it’s being generated, in the identical means that bodily watermarking authenticates {dollars} as they’re being printed.

It’s a stable, easy technique, however it may not be a successful one. This examine will not be the one work pointing to watermarking’s main shortcomings. “It’s effectively established that watermarking may be weak to assault,” says Hany Farid, a professor on the UC Berkeley College of Info.

This August, researchers on the College of California, Santa Barbara and Carnegie Mellon coauthored one other paper outlining related findings, after conducting their very own experimental assaults. “All invisible watermarks are weak,” it reads. This latest examine goes even additional. Whereas some researchers have held out hope that seen (“excessive perturbation”) watermarks could be developed to face up to assaults, Feizi and his colleagues say that even this extra promising sort may be manipulated.

The issues in watermarking haven’t dissuaded tech giants from providing it up as an answer, however individuals working inside the AI detection house are cautious. “Watermarking at first appears like a noble and promising answer, however its real-world functions fail from the onset when they are often simply faked, eliminated, or ignored,” says Ben Colman, the CEO of AI-detection startup Actuality Defender.