From deepfakes to DNA: the science of watermarking AI

Hannah Fry (0:00)

Welcome back to Google DeepMind the podcast. I'm Professor Hannah Fry.

Picture the scene. You are scrolling through your socials, and you see some remarkable footage, the up close slow motion eruption of a volcano, or a tornado raging through a village, or perhaps some footage of a protest. I think many of us ask the same question, is that real? Was this made by a human or a machine? Well, as AI gets better at generating texts and images and audio and video, that is becoming one of the most challenging questions of our time. Except that now, the answer just got a lot more complicated. We are entering a world where AI can design biological molecules and structures that have never existed in nature before, some of which could be designed to cause harm.

So how do you stop something dangerous before it gets made? Well, the answer, it turns out, might be hidden in plain sight, embedded invisibly into the very thing you're looking at, or the very molecule you're about to synthesize. A watermark, not the blocky logo you see on a stock photo, something far more subtle, something mathematical. And today, I am joined by two people who are working on this from different angles. Pushmeet Kohli is VP of Science at Google DeepMind, and one of the architects of SynthID, the watermarking system now being adopted across the AI industry.

And Jeremy Radcliffe is a biosecurity researcher whose team has applied that same technology to biology. Welcome to the podcast, both of you. Jeremy, let's start with you. Watermarking anything that AI spits out, I mean, it sounds like a very good idea, but just break it down for me. Why is this helpful?

Jeremy Radcliffe (1:38)

So for biology, sort of the motivation for being able to watermarking is so that we can have provenance and say specifically, where did this sequence come from? And really what we're trying to differentiate is between sequences that come from things in nature versus sequences that come as products of AI systems. So specifically, the type of risk that we're thinking about in terms of AI systems is sort of an AI-generated sequence that can have properties that we know to be problematic, but we might not be able to identify from the sequence itself that it has these problematic properties.

Hannah Fry (2:07)

And what makes a good watermark? Because I think when people consider the phrase, they sort of think of, I don't know, like banknotes or like passports, is there like rules for what counts as a good watermark?

Jeremy Radcliffe (2:18)

I think for us, in particular, human imperceptibility is one, so making it very difficult for someone to be able to tell what portion of data has been watermarked.

Hannah Fry (2:26)

Because otherwise it would be really easy to erase.

Jeremy Radcliffe (2:28)

Yeah, having high detectability, so having some system that can go through and actually identify the watermark with high confidence, but then also good generalizability, so being able to have at least a watermarking method that can work across a bunch of different systems rather than having to make bespoke ones for every single data type.

Hannah Fry (2:43)

What do you think, Bhishma? I mean, does that apply beyond biology and more broadly?

Pushmeet Kohli (2:47)

Yeah, I think the main reason why we started the whole watermarking project at DeepMind almost eight years ago now was to give a sense of provenance to what users are seeing. If you look at different modalities, whether it's text, whether it's images, whether it's videos, it was hard to imagine ten years back that we would today be talking about systems that can create images, videos, audio, text, and proteins or enzymes that are indistinguishable from what a human or what exists in nature.

And it's an important element for users to give users this idea that you can really believe what you are seeing. So, what do we need from a watermark? We need three properties. One, it should not degrade the quality, otherwise basically the whole point is lost, people will not use it. The second element is robustness against attack or against transformations. If people want to remove it, it's hard to remove, in the sense that even if you make changes to the signal, it will persist. And then the third requirement is that it should be easy to use.

It should be easy to integrate in the signal, and it's easy to detect from the signal. So those are the three sort of properties of imperceptibility, robustness, and scalability that we have designed all our watermarking systems for, with the whole idea that users have more control and have a better view of what they are seeing, or what they are sort of using, or designing and so on.