4 ms·

Would this not be trivially defeatable by something like a single pass of img2img with a very low denoise?

by enlyth 3y ago

goldenkey 3y ago
Microstates vs macrostates. Doesn't it depend on the basis for the encoding and how many bits it is? Watermark, we usually think of something in the pixel plane, but a watermark can be in the frequency spectrum, and other steganographic (clever) resilient basises.
- bob1029 3y ago
  Simply running a cycle of "ok" quality jpeg compression can completely devastate information encoded at higher frequencies. Quantization & subsampling do a hell of a job at getting "unwanted" information gone. If a human cannot perceive the watermark, then processes that aggressively approach this threshold of perception will potentially succeed at removing it.
  - daniel_reetz 3y ago
    At this point the watermark can be meaningful content like "every time there's a bird there is also a cirrus cloud", or "blades of grass lean slightly further to the left than a natural distribution". Because our main interest is this meaningful content, it will be harder to scrub from the image.
    - washadjeffmad 3y ago
      That would be indistinguishable from a model that was also trained on that output, wouldn't it? It seems much more likely that it's their solution to detect and filter AI images from being used in their training corpus - kind of a latent "robots.txt".
  - JyrkiAlakuijala 3y ago
    Different tools have different levels of ability to remove invisible data, e.g. jpegli vs. libjpeg-turbo
TheOtherHobbes 3y ago
Depends on the watermark. The current watermark uses a DCT to add a bit of undetectable noise around the edges. It survives resizing but tends to fail after rotation or cropping. A robust rotationally invariant repeating-but-not-obviously micro watermark would be quite a neat trick.
- esperent 3y ago
  An orthogonally rotational invariant watermark would cover 90%+ of real world image transforms - think flips, mirrors, and 90 degree rotations - and would probably be much easier to create.
rcxdude 3y ago
Watermarks can be made to be pretty robust, though having an open source detection routine will make it much easier to remove (if nothing else, if you can differentiate the detection algorithm then you can basically just optimise it away). The kind of watermarking that is e.g. used for 'traitor tracking' tends to rely on at least a symmetric key being secret, if not the techniques used as a whole (which can include more specific changes to the content that are carefully varied between different receivers of the watermarked information, like slightly different cuts in a film, for example).

Would this not be trivially defeatable by something like a single pass of img2img with a very low denoise?

by enlyth 3y ago

Would this not be trivially defeatable by something like a single pass of img2img with a very low denoise?

Microstates vs macrostates. Doesn't it depend on the basis for the encoding and how many bits it is? Watermark, we usually think of something in the pixel plane, but a watermark can be in the frequency spectrum, and other steganographic (clever) resilient basises.

bob1029 3y ago
Simply running a cycle of "ok" quality jpeg compression can completely devastate information encoded at higher frequencies. Quantization & subsampling do a hell of a job at getting "unwanted" information gone. If a human cannot perceive the watermark, then processes that aggressively approach this threshold of perception will potentially succeed at removing it.
- daniel_reetz 3y ago
  At this point the watermark can be meaningful content like "every time there's a bird there is also a cirrus cloud", or "blades of grass lean slightly further to the left than a natural distribution". Because our main interest is this meaningful content, it will be harder to scrub from the image.
  - washadjeffmad 3y ago
    That would be indistinguishable from a model that was also trained on that output, wouldn't it? It seems much more likely that it's their solution to detect and filter AI images from being used in their training corpus - kind of a latent "robots.txt".
- JyrkiAlakuijala 3y ago
  Different tools have different levels of ability to remove invisible data, e.g. jpegli vs. libjpeg-turbo

TheOtherHobbes 3y ago

Depends on the watermark. The current watermark uses a DCT to add a bit of undetectable noise around the edges. It survives resizing but tends to fail after rotation or cropping. A robust rotationally invariant repeating-but-not-obviously micro watermark would be quite a neat trick.

esperent 3y ago
An orthogonally rotational invariant watermark would cover 90%+ of real world image transforms - think flips, mirrors, and 90 degree rotations - and would probably be much easier to create.

rcxdude 3y ago

Watermarks can be made to be pretty robust, though having an open source detection routine will make it much easier to remove (if nothing else, if you can differentiate the detection algorithm then you can basically just optimise it away). The kind of watermarking that is e.g. used for 'traitor tracking' tends to rely on at least a symmetric key being secret, if not the techniques used as a whole (which can include more specific changes to the content that are carefully varied between different receivers of the watermarked information, like slightly different cuts in a film, for example).