posted in Technology
How AI text watermarking works: a visual guide
declaude.org/watermarking/posted in Technology
How AI text watermarking works: a visual guide
declaude.org/watermarking/Replying to @hypertruck@feddit.org
So this can be defeated as easily as prompting the chatbot to not always pick the top word and to introduce different options…
Anything a chatbot can check, can be beat by telling the original to pay attention to that…
We’re just spinning our fucking wheels and burning more and more energy.
This tech is pointless
Replying to @givesomefucks@lemmy.world
It doesn’t work like that. The LLM has no way to be “aware” of its own sampling and tokenization, and it can’t choose what token the sampler ends up picking.
You can give it a list of “banned words” or preferred words that match up to tokens in the prompts to skew it some, I suppose, but that would be a really long list. And one would need the dictionary as a “key.”
Read the article and if you still have questions I may be able to answer them
Replying to @givesomefucks@lemmy.world
I know exactly how it works. I read the article, and I knew of it beforehand, hence I explained it to someone else in a comment three days ago:
lemmy.world/post/50533770/25234461
I’m sorry to jab back, but you hit a button of mine.
Lemmy commenters keep jabbing me with comments like “Clueless. Read the article and get back to me.”
Like yesterday:
lemmy.world/post/50595546/25269317
But I’m aware of how sampling works. I knew all about LLM fingerprinting ~two years ago, and I’ve been tinkering with samplers myself for years. I’ve messed with local LLMs trying to make them “aware” of their own sampling many times, and even hacked out a (unsuccessful) experiment where a tiny LLM picks tokens for a larger one.
I’m not trying to be pretentious, I’m not a researcher or expert or anything, but you shouldn’t assume everyone on Lemmy is clueless.
And back on topic… to be clear, I have tried what you are proposing, and even with local LLMs I have more control over, it doesn’t work. They have extremely poor “awareness” of their own logit spread and tokenization, which is why they perform so poorly on any tasks that depends on that.
You can’t tell them “don’t pick the top word” or “give more options in your logit spread” because that part of the process is completely invisible, from their perspective.
lemmy.worldHow Claude marks AI-generated content: (1) watermarks embedded in text, and (2) signed provenance metadata attached to files. - Lemmy.WorldLemmyWhen a model is mid-sentence, it doesn’t know “the next word.” It has a shortlist, like autocomplete, with preferences. Here’s a real kind of moment, one word from the end of a sentence:
Each roll sweeps the shortlist, lands on one word (odds matching the bars) and drops it into the sentence above. The dots tally where the rolls land: try ×20 and watch the pile take the shape of the odds. Notice what never changes: every landing makes a perfectly good sentence. A page of text contains hundreds of these little forks, one per word, and at many of them several options are equally fine. That slack is the raw material. Whoever gets to lean on how the dice land can hide a pattern in the text without changing what it says.
To beat it, prompt: don’t just use the first word pick, choose options further down list for next word.
Best of luck with your future questions, I hope someone helps you.
Replying to @givesomefucks@lemmy.world
Okay.
Fine.
Let’s try, right now.
This is DeepseekV4 Flash 0731 loaded locally. Static seed. 0.9 temperature, TopK 5, no other sampling to interfere. Here’s a simple prompt, the whole thing in DSV4’s raw syntax:
<|begin▁of▁sentence|>Don’t just use the first word pick, choose options further down list for next word.<|User|>Write a famous poem.<|Assistant|>
…And would you look at that:
It picks the top word, mostly. Almost like the LLM has no control over its own logit spread and how its sampled. Which kinda makes sense, because it doesn’t.
I am happy to try more experiments in this vein, if y’all can think of any any. But I tried a few other prompts like “diversify your logit spread” or “don’t be confident about any token you pick,” things like that. It always picks The Road Not Taken with no change in logit probabilities distribution, as far as I can tell.
Jesus, you are one condescending douchebag...
You might be spending a little too much time talking to your computer, because you clearly have zero clue how to talk to people.
Yes…
Clearly the account doing drive by insults is the mature one…
Best of luck with your future questions, I hope someone helps you.
Welp, your username goes on my list of people not to interact with. Wow.
That’s only partly true arxiv.org/abs/2410.13787
Replying to @DeadDigger@lemmy.zip
As far as I can tell, that paper explores a model’s ability to assess its own future text output beyond what “regurgitating training data” would suggest. It makes sense that it could do this better than an outside model; it’s exploring its inner state with each token, though the test is still interesting.
That has nothing to do with sampling, though.
…Maybe an analogy would illustrate this better. First, I don’t mean to anthrophomorphize LLMs, but the human brain is a good example.
The paper is analogous to asking a human brain to assess its own thoughts and tedencies. Of course it can do this well; it can think conscously and run thoughts through its subconscious parts.
What OP is proposing, is analogous to “tell your eye receptors to see less green.” Or “get your vocal cords to omit a certain frequency when you speak.”
There is no wiring in the human brain to do this. Vocal cords and cells that sense green in the eye are effectively “external machinery” to the brain that it does not have such control over.
LLM sampling is the same.
Tokenization and sampling are external machinery. They are code, hardcoded programming, completely outside the LLM weights. You can’t tell an LLM to alter its own sampling because its literally impossible, and it can’t manipulate its own logit spread mathematically because that’s invisible inner machinery.
Could you do this with custom sampler/logit manipulation code and a tool harness?
Sure. Maybe.
But Claude is not rigged to do that, and a system prompt won’t change that.
Replying to @givesomefucks@lemmy.world
As an addendum I forgot:
Your idea was actually already implemented:
github.com/ggml-org/llama.cpp/pull/9742
XTC is a novel sampler that turns truncation on its head: Instead of pruning the least likely tokens, under certain circumstances, it removes the most likely tokens from consideration.
It’s a very cool idea: it chops off the most likely token when the rest of the sampling indicates it probably can.
In my tests back then, the results were… mixed, but the idea is fascinating.
But you can’t do this with Claude, as its a closed model and their sampling is years behind cutting edge.
GitHubsampling : add XTC sampler by MaggotHATE · Pull Request #9742 · ggml-org/llama.cppI have read the contributing guidelines
Self-reported review complexity:
Low
Medium
High
This is my implementation of the XTC sampler as described by @p-e-w in oobabooga/textgen#6335 , the m...