Google DeepMind open sources its AI text watermarking tool

The big picture: A range of tools exist for watermarking images, which contain ample information — pixels with different hues and shades — that can be adjusted in ways that can be identified later.

• But there aren't a lot of ways to change a text without altering its meaning.

How it works: When prompted with a question or task, large language models (LLMs) generate an answer by predicting what word or phrase — or "token" — is most likely to appear next in a sequence of text.

• Google DeepMind's new SynthID-Text tool marks text as it is generated by a LLM (as opposed to changing the text after it is produced, which is how image watermarking works).
• The watermark influences the model's choice among equally likely options for words in a particular way that acts as a key.
• That key can then be used to detect whether a text has been watermarked.

Zoom in: The goal is for a watermarking tool to have three properties: it shouldn't change the meaning or quality of the content; it should work with precision and accuracy; and it should be able to operate at a large scale without a high computational cost, says Pushmeet Kohli, VP of research at Google DeepMind and a co-author of the new paper published in Nature on Wednesday.

• "It's no use if you have a very sophisticated method, but it's not able to be used at the scale of how AI models are being used all over the world and producing a lot of content," Kohli told Axios.
• SynthID-Text was integrated with Google's Gemini chatbots earlier this year in what the company believes is "the first deployment of a generative text watermark at scale," the research team writes.

What they found: The DeepMind researchers analyzed about 20 million Gemini chatbot responses that were either watermarked with SynthID or unwatermarked. The quality of the responses was based on user rating them with a thumbs-up or thumbs-down.

• The team reports users didn't notice a difference in the quality or usefulness of the text between the two types of responses.

Yes, but: The researchers acknowledge the tool has several limitations.

• They say it works best on longer responses and more open-ended prompts (for example, asking the AI model to write a short story) versus those asking for factual information, where there are fewer opportunities to modify the model's choices without affecting the accuracy of the response.
• The watermark was robust when the text was slightly changed or paraphrased but less reliable when an AI-generated text was rewritten or translated to another language.
• Kohli also notes that while the tool has "very high accuracy ... it's not 100% foolproof."

Between the lines: A spate of AI text detection tools are now available but are generally inaccurate — and some have led to students being falsely accused of cheating on essays.

• Watermarking can be more reliable but its value is limited by how widely used it is, and there will presumably always be some AI providers offering unwatermarked output.
• "Obviously it's much easier to detect generated content if the engineers at Google and OpenAI are on your side and trying to help you make this detectable," says John Thickstun, an associate professor of computer science at Cornell who works on text watermarking methods.
• But "these statistical watermarks aren't just saying yes or no, they're saying there's some probability that this text is watermarked," he says, adding that requires teachers and others using them "to think about the probabilities in a sophisticated way."

What to watch: Watermarks could be valuable to regulators, Thickstun says.

• There's currently no way for government regulators to know what percentage of content on Facebook, X or other platforms is generated by AI, he says.
• "If you could get the top five LLM and image generation providers to watermark their stuff, suddenly this becomes a much more easy answer question to answer," he says.

What's next: DeepMind is making the SynthID-Text tool available to AI model developers so they "can incorporate it in their own pipeline ... and introduce their own private key" to identify their AI-generated content, Kohli says.

• Last year, Google, OpenAI, Meta and others voluntarily committed to developing tools for detecting AI-generated text.
• OpenAI is reportedly also developing a text watermarking technique, but it hasn't been publicly released.