Google open sources SynthID AI watermarking toolkit
Google has open sourced SynthID, its AI watermarking toolkit that embeds code in AI generated content - invisible to the human eye, but detectable via an algorithm.
Developed by Google DeepMind, SynthID can embed the watermark in AI-generated images, audio, text, and video, and is intended to enable increasingly sophisticated AI content to be identified. The team of researchers behind the project have published a paper in the science journal Nature giving a complete technical description of the SynthID-Text algorithm, as well as analyses of how different configuration values affect performance.
Enhanced Detectability
“To enable watermarking at scale, we develop an algorithm integrating watermarking with speculative sampling, an efficiency technique frequently used in production systems,” they explained. “Evaluations across multiple large language models (LLMs) empirically show that SynthID-Text provides improved detectability over comparable methods, and standard benchmarks and human side-by-side ratings indicate no change in LLM capabilities.”
Application and Configuration
SynthID was first introduced in May 2024 as part of Google’s Gemini AI model. The SynthID-Text watermark is applied to the generation pipeline after Top-K and Top-P output, “using a pseudorandom g-function to encode watermarking information in a way that helps you determine if the text was generated by your model, without significantly affecting text quality”.
“Watermarks are configured to parameterize the g-function and how it is applied during generation. Each watermarking configuration you use should be stored securely and privately, otherwise your watermark may be trivially replicable by others.” Two parameters must be defined in every watermarking configuration, and it can be further configured based on the user’s performance needs.
Watermark Detection
“Watermark detection is probabilistic. A Bayesian detector is provided with Hugging Face Transformers and on GitHub. This detector can output three possible detection states – watermarked, not watermarked, or uncertain – and the behavior can be customized by setting two threshold values to achieve a specific false positive and false negative rate,” the researchers explain.
Watermarking is intended to help copyright owners behind AI-generated content to be able to have their work identified and recognized, as well as cutting down on the rising volume of increasingly convincing fakes. Cynics, though, have suggested that nefarious actors will either not embed a watermark in their fake creations, or will simply develop tools capable of removing watermarks to hide their tracks.
