Hacker News Reader

Comment by smashed | Hacker News Reader

I think that's the part the article glosses over, probably because it's such an evidence to the author.

The only way this works is to use the same exact model and weights right? So that you can replay the text generation as it would have been originally done, and compare output?

And then what, if there is no match do you need to retry with all other known models that could have been used?

Or are models sufficiently similar that they are interchangeable for this type of watermark?

And what if a competing or open source model was used? I can't see how the watermark would work.

And if you have access to a non-watermarked output? How can you prove they are not simply using another key? How can you be sure the text is not watermarked? From the explanations, you can't.

View on HN

Yes, you need the model weights and the key.

Both will be proprietary for a closed model, which means the owner will have a monopoly on detecting their own model(s). (They may or may not offer API access, but if they do it will be a closed box.)

Because detection essentially means running the model again, the monopolist will probably charge their usual token rates for detection, which doubles their revenue. If they don't they'll be spending a lot more on compute with little/no extra revenue.

What's more likely to happen is that open models won't have the tech, they'll be used in paraphrase mode to strip watermarks.

But in fact most people will just skip the closed models and use open models by default.

The irony is that the EU legislation is primarily about video deepfakes and AI pseudo-journalism. Fiction, parody, satire, and other creative expressions are explicitly excluded from labelling requirements.

However you slice it, text watermarking is likely to end up being irrelevant.

(Music went through a similar process with MP3s and other audio formats. They were watermarked for a while, until everyone realised watermarked audio is almost entirely useless - although some companies did make a lot of money before the industry got there.)

You can access Google's SynthID tool only via Gemini. Which supports your first point!

I think this is trivial to implement for open weights models? The main issue is each open weight provider could choose their own randomisation key and so actually matching the synthID would be finding a needle in a haystack! Intractable at scale and a chore for even one chunk of text.

Reply on news.ycombinator.com