SynthID Text Integration in Transformers v4.46.0

Google DeepMind and Hugging Face have launched SynthID Text in Transformers v4.46.0. This technology enables the application of watermarks to AI-generated text using a logits processor during generation and the subsequent detection of those watermarks using a trained classifier.

How SynthID Text Works

SynthID Text encodes a watermark into AI-generated text to identify if content was produced by a specific Large Language Model (LLM) without altering the model's underlying function or degrading generation quality.

The system utilizes a pseudo-random function, known as a g-function, to augment the generation process. This creates a watermark that remains imperceptible to human readers but is detectable by a trained model. The implementation is provided as a generation utility compatible with any LLM via the model.generate() API, requiring no modifications to the model itself.

Watermark Configuration

Watermarks are managed through a dataclass (SynthIDTextWatermarkingConfig) that parameterizes the g-function and its application during tournament sampling. Because these configurations allow for the replication of watermarks, they must be stored securely and privately.

Every watermarking configuration requires two primary parameters:

  • keys: A list of integers used to compute g-function scores across the model's vocabulary. A range of 20 to 30 unique, randomly generated numbers is recommended to maintain a balance between detectability and generation quality.
  • ngram_len: A parameter that balances robustness and detectability. Higher values increase detectability but make the watermark more brittle to changes. The recommended default is 5, with a minimum requirement of 2.

Applying the Watermark

Applying a watermark requires adding a SynthIDTextWatermarkingConfig object to the watermarking_config parameter within the model.generate() call.

Example implementation:

from transformers import (
    AutoModelForCausalLM,
    AutoTokenizer,
    SynthIDTextWatermarkingConfig,
)

# Standard model and tokenizer initialization
tokenizer = AutoTokenizer.from_pretrained('repo/id')
model = AutoModelForCausalLM.from_pretrained('repo/id')

# SynthID Text configuration
watermarking_config = SynthIDTextWatermarkingConfig(
    keys=[654, 400, 836, 123, 340, 443, 597, 160, 57, ...],
    ngram_len=5,
)

# Generation with watermarking
tokenized_prompts = tokenizer(["your prompts here"])
output_sequences = model.generate(
    **tokenized_prompts,
    watermarking_config=watermarking_config,
    do_sample=True,
)
watermarked_text = tokenizer.batch_decode(output_sequences)

Detecting Watermarked Text

Because watermarks are designed to be imperceptible to humans, a trained classifier is required for detection. Each watermarking configuration must have a corresponding detector trained to recognize its specific mark.

The recommended detector training process involves:

  1. Defining a watermarking configuration.
  2. Collecting a training set of at least 10,000 examples, split between watermarked and non-watermarked text, and further divided into training and test sets.
  3. Generating non-watermarked outputs using the model.
  4. Generating watermarked outputs using the model.
  5. Training the watermark detection classifier.
  6. Productionizing the model with the associated configuration and detector.

Transformers provides a BayesianDetectorModel class for this purpose. Models sharing the same tokenizer can share a watermarking configuration and detector, provided the detector's training set includes examples from all participating models.

Limitations and Robustness

SynthID Text watermarks are robust against mild paraphrasing, modifying a few words, or cropping sections of text. However, the following limitations exist:

  • Factual Responses: Watermarking is less effective on factual content because there are fewer opportunities to augment generation without compromising accuracy.
  • Heavy Editing: Detector confidence scores decrease significantly if the AI-generated text is thoroughly rewritten or translated into another language.
  • Adversarial Use: The system is not designed to stop motivated adversaries from causing harm, but it increases the difficulty of using AI-generated content for malicious purposes.

Sources