Google tool makes AI-generated writing easy to discover

Google uses artificial intelligence watermarking to automatically identify text generated by the company's Gemini chatbot, making it easier to distinguish between AI-generated content and posts written by humans. This watermarking system could help prevent AI chatbots from being abused for misinformation and disinformation – not to mention fraud in schools and businesses.

Now the tech company is making an open-source version of its technique available so that other generative AI developers can similarly watermark the output of their own large language models, says Pushmeet Kohli of Google DeepMind, the company's AI research team which combines former Google Brain and DeepMind laboratories. “While SynthID is not a panacea for identifying AI-generated content, it is an important building block for developing more reliable AI identification tools,” he says.

Independent researchers expressed similar optimism. “While no known watermarking method is foolproof, I really believe this can help detect some of the misinformation, academic fraud, and more generated by AI,” says Scott Aaronson of the University of Texas at Austin, who previously worked at OpenAI worked on AI security. “I hope other major language model companies, including OpenAI and Anthropic, will follow DeepMind’s lead in this regard.”

In May this year, Google DeepMind announced that it had implemented its SynthID method for watermarking AI-generated text and video from Google's Gemini and Veo AI services. The company has now published an article in the magazine Nature shows how SynthID generally outperforms similar AI watermarking techniques for text. The comparison involved assessing how easily responses from different watermarked AI models could be recognized.

In Google DeepMind's AI watermarking approach, as the model generates a text sequence, a “tournament sampling” algorithm subtly prompts it to select specific word “tokens,” creating a statistical signature that can be recognized by the associated software. In this process, possible word tokens are randomly paired in a tournament-like bracket, with the winner of each pair determined using a watermark function that achieves the highest score. The winners progress through successive tournament rounds until only one remains – a “multi-layered approach” that “increases the complexity of any possible attempts to reverse engineer or remove the watermark,” says Furong Huang of the University of Maryland.

A “determined opponent” with enormous computing power could still remove such AI watermarks, says Hanlin Zhang of Harvard University. However, he described SynthID's approach as making sense given the need for scalable watermarks in AI services.

Google DeepMind researchers tested two versions of SynthID that represent a compromise between better detectability of the watermark signature and distortion of the text normally generated by an AI model. They showed that the non-distorting version of the AI ​​watermark still worked without noticeably affecting the quality of 20 million text responses generated by Gemini during a live experiment.

But the researchers also acknowledged that watermarking works best with longer chatbot responses that can be answered in different ways – such as by generating an essay or an email – and said that there are no answers to math yet – or coding problems were tested.

Both the Google DeepMind team and others described the need for additional protections against the misuse of AI chatbots – with Huang also recommending stronger regulation. “A legal requirement for watermarking would address both practicality and user acceptance challenges and ensure safer use of large language models,” she says.