Big AI Won’t Stop Election Deepfakes With Watermarks

In May, a fake image of an explosion near the Pentagon went viral on Twitter. It was soon followed by images seeming to show explosions near the White House as well. Experts in mis- and disinformation quickly flagged that the images seemed to have been generated by artificial intelligence, but not before the stock market had started to dip.

It was only the latest example of how fake content can have troubling real-world effects. The boom in generative artificial intelligence has meant that tools to create fake images and videos, and pump out huge amounts of convincing text, are now freely available. Misinformation experts say we are entering a new age where distinguishing what is real from what isn’t will become increasingly difficult.

Last week the major AI companies, including OpenAI, Google, Microsoft, and Amazon, promised the US government that they would try to mitigate the harms that could be caused by their technologies. But it’s unlikely to stem the coming tide of AI-generated content and the confusion that it could bring.

The White House says the companies’ “voluntary commitment” includes “developing robust technical mechanisms to ensure that users know when content is AI generated, such as a watermarking system,” as part of the effort to prevent AI from being used for “fraud and deception.”

But experts who spoke to WIRED say the commitments are half measures. “There’s not going to be a really simple yes or no on whether something is AI-generated or not, even with watermarks,” says Sam Gregory, program director at the nonprofit Witness, which helps people use technology to promote human rights.

Watermarking is commonly used by picture agencies and newswires to prevent images from being used without permission—and payment.

But when it comes to the variety of content that AI can generate, and the many models that already exist, things get more complicated. As of yet, there is no standard for watermarking, meaning that each company is using a different method. Dall-E, for instance, uses a visible watermark (and a quick Google search will find you many tutorials on how to remove it), whereas other services might default to metadata, or pixel-level watermarks that are not visible to users. While some of these methods might be hard to undo, others, like visual watermarks, can sometimes become ineffective when an image is resized.

“There’s going to be ways in which you can corrupt the watermarks,” Gregory says.

The White House’s statement specifically mentions using watermarks for AI-generated audio and visual content, but not for text.

There are ways to watermark text generated by tools like OpenAI’s ChatGPT, by manipulating the way that words are distributed, making a certain word or set of words appear more frequently. These would be detectable by a machine but not necessarily a human user.

That means that watermarks would need to be interpreted by a machine and then flagged to a viewer or reader. That’s made more complex by mixed media content—like the audio, image, video, and text elements that can appear in a single TikTok video. For instance, someone might put real audio over an image or video that’s been manipulated. In this case, platforms would need to figure out how to label that a component—but not all—of the clip had been AI-generated.