Post #4507170

Anthropic is now watermarking the outputs of its AI. For once this is some AI news that doesn’t completely piss me off, and it’s amusing to see all the uninformed boosters get in a tizzy about this. I actually understand at a reasonable level how this watermarking works. A year ago, I watched Scott Aaronson give a talk about it, and from what I know he was somewhat involved in developing the theory behind it while working for OpenAI. But at the time my thought was, “He is naive if he thinks these companies would ever implement this out of the goodness of their hearts.” And I was right; Anthropic is only doing watermarking now thanks to the EU AI Act, even though the theory has long been developed. Watermarking doesn’t mean adding an extra watermark that can be easily removed. It instead directly affects the output of the chatbot itself. Fundamentally, an LLM is still a most-likely-next-word-predictor. More precisely, an LLM produces a probability distribution of what the next word can be. For example, “my pet is a …” could give a distribution of 60% dog, 30% cat, and 10% axolotl. Normally, an LLM would randomly choose the next word based on this distribution, and this is one reason why LLMs are nondeterministic (there’s another parameter called “temperature” that affects this, but no need to get into that). With watermarking, instead of a truly random choice, the randomness instead comes from a cryptographic pseudorandom generator seeded with a secret key from the AI company. If you don’t know the secret key, then you can’t really tell that watermarking was used. But if you do know the secret key, then the idea is you can tell when the text was generated by the LLM because you know exactly what word should be next. It would be a freak coincidence if some non-AI text just happened to choose the correct next word every time. Thus, you can provide a service to tell if some text was generated by the LLM. (This technically makes the LLM “deterministic”, in a completely useless sense.) Now, I think this is a step in the right direction, but it has its limits. The biggest problem is that you don’t want people to just move to a different LLM without watermarking, and that’s exhibit #832593 why government regulation is important. Another issue is that sometimes there is very little randomness in what the next word should be (“The first president of the USA is George …”). Finally, watermarking can be defeated by editing the output, although you would have to break up most of the blocks of consecutive words. I have a feeling most AI users are not the type to put in extra effort after copy-pasting the output directly from the chat window. I suppose it will discourage some of the “use cases” of LLMs, such as drowning the world with spam Slopstack essays. Ah, who am I kidding? Everyone could already tell it’s AI generated, they don’t care!