AI ‘Watermarking’ Tools Emerging to Tag Machine-Made Content

Businesses and researchers are developing mechanisms to identify the origins of text and images online as internet users face the increasingly difficult task of distinguishing between what’s made by a human and what’s generated by artificial intelligence.

Tools such as chatbots and image creators have exploded in popularity, with users eager to experiment. Viral misinformation is a concern due to the ease of generating convincing content like recent, widely shared images of Pope Francis sporting a faux white puffer coat or a fake cloud of black smoke near the Pentagon. Academic cheating is another worry, spurring some schools and teachers to block chatbot use in the classroom.

“With the explosion of generative AI and the recognition that detection is limited, we need to think about ways to bake symbols of authenticity or origin into the content itself,” said Claire Leibowicz, head of the AI and media integrity program at the Partnership on AI. The responsible AI nonprofit is funded by philanthropies and companies including Meta Platforms Inc., Microsoft Corp., and Alphabet Inc.'s Google.

These companies and other top industry players like OpenAI have pledged to deploy technical measures such as digital “watermarking” or credentialing schemes to help with detection of generated content. But the effectiveness of this approach depends on getting more than just the biggest AI businesses on board with assigning labels and attaching them to content. Securing broad buy-in presents a major challenge.

Such a system is likely to require coordination through standards-setting bodies and collaboration with trusted verifiers. Content distribution channels such as Meta’s image-centric social network Instagram also would have to agree to recognize and utilize signals for differentiating AI content.

Meta is involved in a Partnership on AI effort focused on how to responsibly develop, create, and share synthetic media.

“The general conundrum is how do we not only support people understanding what’s false or fake or manipulated,” Leibowicz said, “but also reaffirming truthful content.”

Some media and tech companies are already working together on a Content Authenticity Initiative that was founded in 2019 by Adobe Inc. in partnership with other organizations. Adobe, the maker of photo-editing software Photoshop, now offers a generative AI-powered image creation platform called Firefly.

Members of the authenticity initiative include the BBC, Microsoft, Stability AI, and Truepic, which makes software that records details like when, where, and how a photo or video was captured by a mobile device. Their goal is to boost trust by adding a verifiable layer of transparency to content using secure metadata, allowing viewers to identify AI-generated images and trace both where they came from and how they were edited along the way.

“These measures help to ensure that users exercise appropriate care when interacting with this content,” a spokesperson for Stability AI said in an email.

Digital Signatures

Stability AI’s Stable Diffusion image generator embeds what’s known as watermarking technology into the code of its images.

Traditionally, watermarking currency or official documents to discourage counterfeiting involves physically printing identifying symbols or patterns on the items. The concept has long been applied in photography to protect artistic ownership by tagging a photo with a brand or the artist’s name. Movie studios also hide a stamp in film files to help track leaked copies.

The digital version of watermarking content generally involves embedding a signal that’s invisible to the human eye but detectable by a computer, allowing AI content generators to leave a signature on their creations.

“AI signs something saying ‘I’ve made this,’” said Ari Lightman, a professor of digital media and marketing at Carnegie Mellon University.

Several generative AI industry leaders have committed to using watermarking-type measures as part of a voluntary effort organized by the White House in July. Their pledges are geared toward audio or visual content, as opposed to text, according to an outline of the effort.

“We’ll soon be integrating watermarking, metadata, and other innovative techniques into our latest generative models,” Kent Walker, Google’s president of global affairs, wrote in a July blog post related to the White House announcement.

Google also plans to add an “about this image” tool to Google Search to give context about where an image first appeared online, Walker said.

Microsoft also has announced that new “media provenance capabilities” are coming to Bing Image Creator, which generates images from text inputs, and to Microsoft Designer, which makes visuals for uses such as social media posts and invitations. Its provenance technology marks and signs AI-generated content with metadata about its origin, according to a May company blog post.

Privacy Tension

The use of credentialing systems poses a privacy dilemma: How can credentials make clear what tools are responsible for capturing or creating a piece of content without necessarily revealing the identity of an individual user behind it?

The content credentials Adobe and some other organizations are deploying show information such as the creator’s name, date of capture or creation, and what tools were used in its creation.

These credentials were designed “with privacy in mind,” according to Andy Parsons, senior director of the Content Authenticity Initiative at Adobe.

“There is no requirement to provide personally identifying information, allowing creators to control the amount of information attached to content,” Parsons said in an emailed statement.

“For example, photojournalists covering sensitive topics or working in dangerous areas need not capture their names or the location where a photo was taken, while still attaching other valuable information, like date and the fact that the photo is from a camera, to support critical context and authenticity,” he said.

Text Detectors

Text is an especially tricky medium for differentiating between human-made and machine-made content. AI language models typically are trained to come as close to the average person’s writing as possible, though experts say generated text has a certain style that often tips off readers to a bot’s role.

Educators are turning to tools such as plagiarism detector Turnitin to help decipher whether a student may have used an AI-powered language model to help write an assignment. But sophisticated models—or savvy students—may be able to fool the current generation of cheating software, according to Liam Dugan, a doctoral student at the University of Pennsylvania whose research focuses on large language models and how humans interact with them.

“High schoolers know the way to get around an AI-detector is to change some words in an essay,” Dugan said. “It’s really challenging to figure this out and not train for one context, but for everything.”

OpenAI trained a classifier to distinguish between text written by a human and text written by AIs from a variety of providers. But as of July 20, the product was no longer available due to its low rate of accuracy, the company said in a blog post.

“We are working to incorporate feedback and are currently researching more effective provenance techniques for text, and have made a commitment to develop and deploy mechanisms that enable users to understand if audio or visual content is AI-generated,” OpenAI’s post says.

Lawrence Livermore National Laboratory, a federally funded research and development center in California, is seeking industry partners to help commercialize a system to distinguish between human-generated text and AI-generated text. The lab has filed for patent protection over its approach, which relies on digital signatures that can be attached to text as metadata and verified by third parties.

“Using digital signature schemes could provide a more trustworthy layer of security for distinguishing between human- and AI-written text,” said Delaram Kahrobaei, a math and computer science professor at the City University of New York, Queens College. Still, such signatures could be forged if they’re not secure enough, she said.

Scott Aaronson is on leave from his computer science post at the University of Texas at Austin to work at OpenAI on theoretical foundations of AI safety. He said he worries about countermeasures that could crop up if watermarking becomes more commonplace. Cheaters could try to get around it by translating AI-generated text into a different language, for example, he said.

“So there might be a cat-and-mouse game,” Aaronson said.

—With assistance by Caleb Harshberger