A new article has emerged detailing a method to circumvent AI watermarks, including advanced statistical bias-based systems like Google's SynthID, through the use of pseudorandom generators. The author of the article suggests this technique could bypass even theoretically optimal watermarking solutions designed to identify AI-generated content.
The core of the proposed method involves what is described as "dribbling the AI watermark directly in-prompt." While specific technical details of the implementation are still being disseminated, the underlying concept appears to leverage the inherent flexibility and generative capabilities of large language models (LLMs) to obscure or remove the subtle statistical patterns that constitute an AI watermark. Watermarking systems like SynthID embed imperceptible signals into generated content, making it identifiable as AI-created. These signals are often based on statistical biases introduced during the generation process.
The author's premise is that by strategically introducing pseudorandom elements or modifying the output in a targeted way, an attacker could disrupt these statistical biases without significantly altering the human-perceptible content. This would effectively make the AI-generated text indistinguishable from human-written text to the watermark detection algorithm, even if the content itself originated from an AI model.
The article explicitly mentions Google's SynthID, a tool designed to watermark and identify AI-generated images, and implies the principles could extend to text-based AI watermarks. OpenAI is also cited as a company likely to implement or already having implemented similar watermarking technologies, suggesting the relevance of this circumvention method across major AI developers.
The author's motivation for sharing this method stems from a broader skepticism regarding watermarking as the definitive solution for identifying AI-generated content. They argue that while watermarking aims to provide transparency, methods to bypass such systems will inevitably emerge, leading to an ongoing arms race between watermarkers and circumvention techniques. This perspective highlights the complex challenges in establishing reliable authenticity for AI-generated output.