Google open sources SynthID AI watermarking toolkit

Watermarks aren’t visible but can be detected via an algorithm

Google has open sourced SynthID, its AI watermarking toolkit that embeds code in AI generated content - invisible to the human eye, but detectable via an algorithm.

Developed by Google DeepMind, SynthID can embed the watermark in AI-generated images, audio, text and video, and is intended to enable increasingly sophisticated AI content to be identified.

The team of researchers behind the project have published a paper in the science journal Nature giving a complete technical description of the SynthID-Text algorithm, as well as analyses of how different configuration values affect performance.

“To enable watermarking at scale, we develop an algorithm integrating watermarking with speculative sampling, an efficiency technique frequently used in production systems,” they explained.

“Evaluations across multiple large language models (LLMs) empirically show that SynthID-Text provides improved detectability over comparable methods, and standard benchmarks and human side-by-side ratings indicate no change in LLM capabilities.”

SynthID was first introduced in May 2024 as part of Google’s Gemini AI model.

The SynthID-Text watermark is applied to the generation pipeline after Top-K and Top-P output, “using a pseudorandom g-function to encode watermarking information in a way that helps you determine if the text was generated by your model, without significantly affecting text quality”.

It continues: “Watermarks are configured to parameterise the g-function and how it is applied during generation. Each watermarking configuration you use should be stored securely and privately, otherwise your watermark may be trivially replicable by others.”

Two parameters must be defined in every watermarking configuration, and it can be further configured based on the user’s performance needs. No additional training is required to generate text with a SynthID watermark.

“Watermark detection is probabilistic. A Bayesian detector is provided with Hugging Face Transformers and on GitHub. This detector can output three possible detection states – watermarked, not watermarked, or uncertain – and the behaviour can be customised by setting two threshold values to achieve a specific false positive and false negative rate,” the researchers explain.

Watermarking is intended to help copyright owners behind AI-generated content to be able to have their work identified and recognised, as well as cutting down on the rising volume of inceasingly convincing fakes.

Cynics, though, have suggested that nefarious actors will either not embed a watermark in their fake creations, or will simply develop tools capable of removing watermarks to hide their tracks.