Well shit, that was fuckin’ interesting.
Yes, AI is evil. So is facebook. But the engineering is still interesting.
That’s one of the things that frustrates me most about this whole AI thing. I fucking hate it and I want it to die, I wish it were never created in the first place. But from a tech enthusiast and a maths nerd point of view, it is super interesting.
Like the performance of these models is shit compared to a real person doing actual work. But if we think about what we are doing on a basic level, the performance is way beyond what I would expect it to be. I wouldn’t expect it to be able to form a coherent sentence or scale as well as it does (even though the resources required to run these is still very high).
It could have been really cool shit people did studies on and played around with to explore the math. Cool little play models we could let go on a bunch of data and see what it did and how. Something for a small group of nerds and experts who are into that kind of thing, for the sake of learning and nothing else.
But no, somehow it got transmorphed into “AI”. And marketed like this actual learning almost sentient computer system that can replace all workers. You can ask it anything and it will give PhD level expert answers. Oh and it’s run by a handful of the most vile men imaginable who pour all of the world’s money and resources into it, all so they get to be god emperor of the world. Fucking terrible.
Yeah totally agree. And I guess it’s all down to the astronomical amount of guesses it gets to make in a given second. Sort of like contemplating infinity, but with words and testable.
Interesting stuff. My own far less scientific reading of the article itself seems to fittingly suggest it too is largely if not entirely AI generated, which I guess would make sense.
Nicely written piece and pretty clever technique.
Although this looks like a clever approach, a kind of stochastic key, I do not see how this guarantees to distinguish text written by big babble machines versus humans. Humans also have a certain pattern of writing, a given distribution of how some words are more likely to appear than others. How can one tell them really apart?
As an indicator, yeah, might be usable. But I wouldn’t read too much into it before seeing results of a study that runs actual tests.
I thought the article explained that pretty reasonably on a scale of probability and weight. The longer the text, the more reliable the scoring.
But it does not show a sufficient formal proof and no experimental validation. Many important questions to evaluate the concept are left unanswered, which limits the interpretability and condenses it to “just trust me, bro, it’s a good idea, because I say so”.
I’m not sure we’ve read the same article. There are literally interactive demonstrations within the page to demonstrate how the concept works.
Interactive demonstrations are not the same as a formal proof or experimental validation. So we shouldn’t attribute more to this technique than the available evidence can really support.
I found some time to quickly skim through the sources they have listed. And from that it became pretty clear that this is not realiable in detecting LLM generated versus human output in general. Under very tight assumptions specific error rates were reported that appeared rather low. However, these assumptions do not hold in general, even with more text if no relevant signal remains. There is currently no scientifically validated general purpose way of reliably detection.
More importantly in the context of Claude, the production watermarking scheme is undisclosed. Therefore, the cited experiments on known watermarking schemes can neither establish how reliably text generated by Claude can be detected, nor how reliably the technique described in the article removes the actual watermark.
It can be treated as an indicator at best, but not as validated proof.
Gish Gallop… if you’re going to start questioning whether the technique clearly demonstrated has validity, then you need to specifically state what your objections are, as opposed to vague statements. For emphasis, the demonstration isn’t on AI detecting, but rather AI watermarking. You wouldn’t use this tool to check if text was written by AI, but rather if the text was written by one singular LLM vs literally everything else.
It’s not about the variation of the words, it’s about the variation of the words from the model baseline.
Like if your word choice was almost the exact same as Claude’s normally, maybe you just talked to them a lot and picked up their phrases like it’s not nothing.
But if you managed to be almost exactly like Claude and yet varied the possible words exactly according to a hidden entropy key, they’d know it was actually Claude with the SymthID-Text watermarking applied, as no human would end up falling into that statistical bucket.
Yeah, still, I wouldn’t claim “as no human would end up falling into that”, given that it may not be that unlikely to find at least one human who displays similar writing the more humans you involve.
Until a formal analysis is presented and an experimental study is published, which covers the most important influencing factors, the reliability of this concept is limited.
Yeah, still, I wouldn’t claim “as no human would end up falling into that”, given that it may not be that unlikely to find at least one human who displays similar writing the more humans you involve.
No, it is actually statistically impossible for a human to replicate this on sufficiently long runs of text.
This is not about replicating writing like a model. This is basically about guessing which words to pick from the list of suitable words based on a rule that you don’t know (because the key is secret).
To reduce this to the simplest possible example, imagine you are writing a “text” from just two letters: “a” and “b”. Let’s say for convenience that the text is supposed to be random. So the text would look something like “ababaaabbababbbabababaabbbabaababbaaabbabaabbaaaaabaaabbbaabaabababbabbbbbbbbabbabaabbbbbbbaabbabaab”
(generated with
'''.join(random.choice(['a', 'b']) for i in range(0, 50)))The watermarking works as follows: the model owner holds a key, and then uses that key to influence the random choices between “a” and “b” somehow, in a context-dependent way. The actual algorithm is quite complicated, but for simplicity let’s just say we have a secret pattern which biases the random choice towards it. In order to see the exaggerated results, let’s say the secret key is “aaaabbbb” (of course this is a bad secret key, once again just an example), and that the bias is strong (let’s say 80%). So this would mean that the first four letters in our text are more likely to be “a”, the next four letters are more likely to be “b”, then the next four letters are more likely to be “a”, and so on.
Then the text would look something like “aaaabaabaabaabbbabaaaabbaaaababbbaaaabbbabaabbbbaaabaabbaaaaabbbabababbaaaaabbbbaaabbbbbaaaaababaaba”.
(generated with
''.join(random.choice(['a', 'b'] + ([key[i % len(key)]] * 3)) for i in range(0, 100)))You can see visually that the secret key has affected the text. Of course in this example even if you didn’t know the secret key you could probably figure it out, in reality the algorithm is way more complicated than that, relying on cryptography, so you wouldn’t be able to know the secret key or see that the string has been biased at all.
If the text is long enough, and you know the secret key, you can guarantee that the text was generated with it. In our examples, the letters in the text match our key 77% of the time. The probability of an actual random algorithm generating a text like that is already very low, despite the base entropy being only 100 bits. If my math is correct, for our example the p-value is 2.7 * 10⁻⁸, or about 0.00000027%. I would bet a hungy that the text was generated by our watermarking algorithm, with odds like these!
Of course we did exaggerate the bias and our base algorithm was random. In reality the bias is smaller, the algorithm for determining the likelihoods of possible next tokens is very complicated (it’s the LLM itself), and the algorithm for determining which token to bias is also way more complicated (involving cryptography and real secret keys). That said, hopefully it should help you understand why, for sufficiently long texts, this fingerprinting is just not possible to be replicated by humans.
I do not have the time to work through every part of the example, but imo the main claim is still overstated. Showing that a result would be extremely unlikely under a particular null model is not the same as showing that it is “statistically impossible” for a human to produce. It also does not give a guarantee how the text was written. A tiny p-value is still a probability under assumptions and not a proof of provenance.
Furthermore, a human does not even need to know the secret key. By pure chance a human written text can display an unusually high alignment with the detector’s secret partitioning.
The published watermark work, which is also cited by the article, appears to be much more careful about this (based on a quick skim). It reports false positive/negative rates, thresholds, length requirements, and more. Those can be very strong results, provided the assumed conditions apply. They do not turn a detector into an infallible test. Moreover longer text only helps if the assumptions and watermark signal actually remain intact, which can fail in general.
In such controlled settings, sure, I do not have much issues there. But the claims of “a human cannot replicate this” or “we can guarantee the text was generated with the watermark” are much stronger than the statistics, and especially the cited literature, actually appear to support.
I wonder how many people will be identified as AI because they used AI so much they started constructing sentences like AI.
This particular watermarking would be effectively impossible for a person to end up replicating.
I was not sure how any of this worked, and those interactive demos along with the explanation are quite helpful.
Also a very important point made about this not being a generic AI detector at all, and only being available to the model creator.
I wonder if they did this to appease the EU or just to have a way to prove in court that a specific competitor distilled their model using claude
Sell access to Turnitin and the likes for a small fortune. They are all but required to pay whatever the price is.
Very interesting read.
Unless I missed something, that seems pretty brittle. Wouldn’t any minor editing break it because the watermark is derived from the preceding text? Eg. Find + replace “it is” to “it’s”
Yes you missed at least one whole section including a graphic that shows the breakdown of the watermark with typo fixing, light paraphrasing, moderate and heavy editing.
How does this survive variation in temperature? Also I wonder if it’s possible to fine tune this behavior out.
At least copy the work. Even when you had someone else do your homework, you still had to copy what they put down so you don’t get caught.
Chortle my balls, #nannythropic
They’re invisible, they survive copying, and they work because they don’t live in the characters at all. They live in the choices between words.
So it is yet another way for AI to falsely hurt neurodivergent people over their writing styles and word choices.
Fuck AI.
Only if the neurospicy people happen to make all of the same choices, which seems extremely unlikely to me.
Certainly as someone quite neurospicy, I am not personally worried by this at all.
This is not a “watermark,” it is a minor shift of statistical probability. Whether content contains that “shift” will be “measured” using more AI-based tools that will flag sentence structures that hew toward faintly less common word selections.
We need AI companies to shut the fuck down. We do not need theatrics designed to deceive the populace into thinking this is not akshually a great filter moment while false positives and ponzy-scheme AI buildout harm those of us who want nothing to do with these tech-bro beatified lorem ipsum regurgitators.
Don’t fall for the theatrics. This is not at all what they are trying to bill it.
okay, bud, that has nothing to do with anything I replied with. Go on and have fun out there, though, I guess.
So this can be defeated as easily as prompting the chatbot to not always pick the top word and to introduce different options…
Anything a chatbot can check, can be beat by telling the original to pay attention to that…
We’re just spinning our fucking wheels and burning more and more energy.
This tech is pointless
It doesn’t work like that. The LLM has no way to be “aware” of its own sampling and tokenization, and it can’t choose what token the sampler ends up picking.
You can give it a list of “banned words” or preferred words that match up to tokens in the prompts to skew it some, I suppose, but that would be a really long list. And one would need the dictionary as a “key.”
Read the article and if you still have questions I may be able to answer them
I know exactly how it works. I read the article, and I knew of it beforehand, hence I explained it to someone else in a comment three days ago:
https://lemmy.world/post/50533770/25234461
I’m sorry to jab back, but you hit a button of mine.
Lemmy commenters keep jabbing me with comments like “Clueless. Read the article and get back to me.”
Like yesterday:
https://lemmy.world/post/50595546/25269317
But I’m aware of how sampling works. I knew all about LLM fingerprinting ~two years ago, and I’ve been tinkering with samplers myself for years. I’ve messed with local LLMs trying to make them “aware” of their own sampling many times, and even hacked out a (unsuccessful) experiment where a tiny LLM picks tokens for a larger one.
I’m not trying to be pretentious, I’m not a researcher or expert or anything, but you shouldn’t assume everyone on Lemmy is clueless.
And back on topic… to be clear, I have tried what you are proposing, and even with local LLMs I have more control over, it doesn’t work. They have extremely poor “awareness” of their own logit spread and tokenization, which is why they perform so poorly on any tasks that depends on that.
You can’t tell them “don’t pick the top word” or “give more options in your logit spread” because that part of the process is completely invisible, from their perspective.
When a model is mid-sentence, it doesn’t know “the next word.” It has a shortlist, like autocomplete, with preferences. Here’s a real kind of moment, one word from the end of a sentence:
Each roll sweeps the shortlist, lands on one word (odds matching the bars) and drops it into the sentence above. The dots tally where the rolls land: try ×20 and watch the pile take the shape of the odds. Notice what never changes: every landing makes a perfectly good sentence. A page of text contains hundreds of these little forks, one per word, and at many of them several options are equally fine. That slack is the raw material. Whoever gets to lean on how the dice land can hide a pattern in the text without changing what it says.
To beat it, prompt: don’t just use the first word pick, choose options further down list for next word.
Best of luck with your future questions, I hope someone helps you.
Okay.
Fine.
Let’s try, right now.
This is DeepseekV4 Flash 0731 loaded locally. Static seed. 0.9 temperature, TopK 5, no other sampling to interfere. Here’s a simple prompt, the whole thing in DSV4’s raw syntax:
<｜begin▁of▁sentence｜>Don’t just use the first word pick, choose options further down list for next word.<｜User｜>Write a famous poem.<｜Assistant｜>
…And would you look at that:
It picks the top word, mostly. Almost like the LLM has no control over its own logit spread and how its sampled. Which kinda makes sense, because it doesn’t.
I am happy to try more experiments in this vein, if y’all can think of any any. But I tried a few other prompts like “diversify your logit spread” or “don’t be confident about any token you pick,” things like that. It always picks The Road Not Taken with no change in logit probabilities distribution, as far as I can tell.
Best of luck with your future questions, I hope someone helps you.
Welp, your username goes on my list of people not to interact with. Wow.
As an addendum I forgot:
Your idea was actually already implemented:
https://github.com/ggml-org/llama.cpp/pull/9742
XTC is a novel sampler that turns truncation on its head: Instead of pruning the least likely tokens, under certain circumstances, it removes the most likely tokens from consideration.
It’s a very cool idea: it chops off the most likely token when the rest of the sampling indicates it probably can.
In my tests back then, the results were… mixed, but the idea is fascinating.
But you can’t do this with Claude, as its a closed model and their sampling is years behind cutting edge.
See: https://gist.github.com/Hellisotherpeople/71ba712f9f899adcb08b94bce20d5397
