Could anybody explain how this isn't easily circumvented by using a competitor's model?
Also, if everything in the future has some touch of AI inside, for example cameras using AI to slightly improve the perceived picture quality, then "made with AI" won't be a categorization that anybody lifts an eyebrow about.
> Could anybody explain how this isn't easily circumvented by using a competitor's model?
If the problem is "kids are using AI to cheat on their schoolwork and it's bad PR / politicians want us to do something" then competitors' models aren't your problem.
On the other hand, if the problem is "social media is flooded with undetectable, super-realistic bots pushing zany, divisive political opinions, we need to save the free world from our own creation" then yes, your competitors' models very much are part of the problem too.
By lobbying regulators to force your competitors to add watermarks too.
I wonder if this will survive distillation. I vaguely recall that most open models answer “ I am chat gpt” when asked who they are, as they’re heavily trained on openai outputs. If the version of chatgpt used to generate the training data had a watermark, a sufficiently powerful function approximator would just learn the watermark.
Are you expecting a distilled model to be sufficiently powerful to capture the watermark? I wouldn’t.
Additionally, I don’t think the watermark has to be deterministic.
If you see the mark, you'd know at least that you aren't dealing with a purely mechanic rendering of whatever-it-is.
> Could anybody explain how this isn't easily circumvented by using a competitor's model?
Almost all the big hosted AI providers are publicly working on watermarking for at least media (text is more of a mixed bag); ultimately, its probably a regulatory play—the big providers expect that the combination of legitimate concerns and their own active fearmongering, combined with them demonstrating watermarking, will result in mandates for commercial AI generation services to include watermarking. This may even be part of the regulatory play to restrict availability and non-research use of open models.
Yes but isn't the cat out of the box already? Don't we have sufficiently strong local models that can be finetuned in various ways to rewrite text/alternate images and thus destroy possible watermarks.
Sure in some cases a model might do some astounding things that always shine through, but I guess the jury still out on these questions.