3 ms·
The actual claim of this paper is that any watermark can be erased, which it justifies by proving the existence of an Erase function that removes the watermark
by xianshou 3y ago
The actual claim of this paper is that any watermark can be erased, which it justifies by proving the existence of an Erase function that removes the watermark without degrading quality. Therefore, since any watermark can be erased, let's use the simplest one that's visually identical.
This is true, of course, but also vacuous. The problem is that there is no sense of the computational complexity or difficulty of implementing the Erase function. The proof holds even if the watermark can only be removed in O(e^n) or some similarly absurd time span. A good watermark, like a good encryption scheme or a good password, is one that can be verified quickly but must be reversed slowly.
The paper's stance is no different from saying "since any watermark can be reversed, none of them matter, and we should just use THIS WAS WRITTEN BY CHATGPT".
Which is why you should never assume that a paper makes sense merely because it is technically correct.
- mattnewton 3y ago> That's no different from saying "since any watermark can be reversed, none of them matter, and we should just use THIS WAS WRITTEN BY CHATGPT". I’m not sure we shouldn’t do this; at least people wouldn’t put false stock in watermark detection methods. As it is now, what a watermark not being detected says is that this wasn’t copy-pasted directly from an LLM, but what lay people will understand is that “this was not produced by an LLM.” That’s a dangerous muddying of the waters in my opinion.
- wongarsu 3y agoYou can make watermarks that survive manual transcription. But then you have to get a lot more clever than replacing whitespace with different whitespace, and instead encode information in parts a human would preserve. Word choice, spelling choices, punctuation, etc. provide a lot of space to encode a signal. Basically anything used by traditional authorship detection/stylometry.
- JohnFen 3y agoA few lifetimes back, when I was in high school, I developed a text stegonography program that encoded this way. If relied entirely on minor changes to grammar that didn't make the text ungrammatical. That code is long lost, and I was a kid, so never characterized it in any meaningful way. But it was interesting and seemed to work. The downside was that you had to have a fairly lengthy text to encode anything but very short messages.
- mattnewton 3y agoI mean, if the detection method is open for people tp use they can perturb it until it isn’t detected anymore and if it isn’t open how do we know it isn’t full of false positives.