Google DeepMind详解AI水印技术：从数字内容到生物分子

Welcome back to Google Deep Mind the podcast. I'm Professor Hannah Fry. Picture [music] the scene. You are scrolling through your socials and you see some remarkable footage. The [music] up close slow motion eruption of a volcano or a tornado raging through a village or perhaps some footage of [music] a protest. I think many of us ask the same question. Is that real? Was this made by a human [music] or a machine? Well, as AI gets better at generating texts and images and audio and video, that [music] is becoming one of the most challenging questions of our time.

Except that now the answer just got a lot more complicated. [music] We are entering a world where AI can design biological molecules and structures that have never existed in [music] nature before, some of which could be designed to cause harm. So, how do you stop something dangerous [music] before it gets made? Well, the answer, it turns out, might be hidden in plain sight, embedded invisibly into the very [music] thing you're looking at or the very molecule you're about to synthesize.

A watermark, not the blocky logo you see on a stock photo, something far more subtle, [music] something mathematical. And today I am joined by two people who are working on this from different angles. Pushmi [music] Kohley is VP of science at Google deep mind and one of the architects of synth ID the watermarking system now being adopted across the AI [music] industry and Jeremy Radcliffe is a biocurity researcher whose team has applied that same technology [music] to biology welcome to the podcast both of you Jeremy let's start with you watermarking anything that AI spits out I mean it sounds like a very good idea but just just break it down for me why is this helpful

so for biology sort of the motivation from being able to watermarking is so that we can have provenence and say specifically where did this sequence come from and really what we're trying to differentiate is between sequences that come from things in nature versus sequences that come as products of AI systems. So specifically the the type of risk that we're thinking about in terms of AI systems is sort of an AI generated sequence that can have properties that we know to be problematic but we might not be able to identify from the sequence itself that it has these problematic properties.

And what what makes a good watermark? Because I think when people consider the phrase, they sort of think of I don't know like banknotes or like passports. Is there like rules for what counts as a good watermark?

I think for us in particular, human imperceptibility is one. So making it very difficult for someone to be able to tell what portion of data has been watermarked

because otherwise it would be really easy to erase.

Yeah. Having high detectability, so having some system that can go through and actually identify the watermark with high confidence and then also good generalizability. to being able to have at least a watermarking method that can work across a bunch of different systems rather than having to make bespoke ones for every single data type.

What do you think push me? I mean, does that apply beyond biology and more broadly?

Yeah, I think the main uh reason why we started the whole watermarking project at deep mind almost 8 years ago now was to give a sense of uh provenence uh to what users are seeing. If you look at different modalities, whether it's text, whether it's images, whether it's videos, it was hard to imagine 10 years back that we would today be talking about systems that can create images, videos, audio, text, and proteins or enzymes that are indistinguishable from what a human or what exists in nature.

And it it's an important sort of element for users to to give users this idea that you can really uh believe what you are seeing. So what do we need from a watermark? We need three properties. One, it should not degrade the quality otherwise basically the whole point is lost. People will not use it. The second element is robustness against attack or against transformations. If people want to remove it, it's hard to remove in the sense that even if you make changes to the signal, it will persist.

And then the third requirement it's that it should be easy to use, right? It should not uh it should be easy to integrate in the signal and it's easy to detect

from the signal. So those are the three sort of properties of imperceptibility, robustness and scalability that we have designed all our watermarking systems uh for w with the whole idea that users have more control and have a better view of what they are seeing or what they are sort of using or designing and so on. feels like this subject of automarking has been quite a big deal this summer

but at the same time we're a few years into generative AI being accessible to the public what what's taken so long push me why is it only now that this has become so widespread when image editing software started becoming very sophisticated people were uh sort of uh very concerned about this issue of is this a real image or is has the has this been tampered with and There was a lot of work and specialized systems which could really sort of analyze an image and think and see the tiny differences that uh exist in a tampered image and can say oh yeah this was a fake image or this has been tampered with and so on.

But as generative AI became more sophisticated, those tiny differences went away.

Mhm.

And then that naturally sort of resulted in the question is this game over in the sense that uh humans will not have the ability uh to detect whether something is AI generated and this is where watermarking sort of came in. We said the way to sort of make sure that humans always have the ability to understand the origin of where some signal came from is by injecting a signal within it having a bias so it doesn't go away.

Even if the models are perfect

and they have the ability to sort of generate images which are indistinguishable from what a camera would observe or what a text that a human would write. We specifically sort of put in some imperceptible things that can allow users to later detect that this was or this originated from my AI model.

And when you say we here, Push, I mean, you really do mean we in the literal sense, right? It was you it was you guys that came up with a solution for this one that was was scalable.

Yes. So we we our team has been working on this for almost 8 years. We we started with images because people were concerned about uh these images being used for fake news, misinformation and and so on. And uh so there was uh that motivation to solve that problem. At the same time uh although the problem is extremely challenging because of the properties we just mentioned of uh robustness and imperceptibility and efficiency and scalability uh still an image is a very large amount of data.

A 1 megapixel image has sort of uh 1 million sort of numbers or like three million numbers depending on the on how it's encoded and so on to hide information right and without changing the content. So we developed um watermarking systems for images first. Later on we had to look at the challenge of how do you do this for other modalities like text which are not as highdimensional as images

where actually it's a very small amount of uh uh signal right in if you

it's not a million numbers in a sentence is there. Yeah, exactly. It's a few words. You can't change those sort of few words and you have to be very cautious in terms of not changing the meaning

of of the content. And so the approaches that we developed for watermarking text were quite different and distinct from what we use for watermarking highdimensional uh signals like images and videos and and audio even. But this idea of watermarking which you guys pioneered has now been brought into law. It's essential that any generative content within the EU has to have some sort of watermarking.

I