Watermarking and provenance: Exercises — Hinglish deep dive

6.4.12 · D4 · AI-ML › AI Safety & Alignment › Watermarking and provenance

Yeh page Watermarking and provenance ka self-test ladder hai. Har problem apna level clearly batata hai — L1 Recognition (kya tum ye words jaante ho?) se lekar L5 Mastery (kya tum kuch naya bana sakte ho?) tak. Pehle har ek ko paper pe solve karo, phir collapsible solution kholo.

Shuru karne se pehle, ek symbol jo hum har jagah use karte hain:

White bell woh hai jo unwatermarked text karta hai ( $N /2$ pe centred). Amber bell watermarked text hai (daayein shift hua). $z$ -score measure karta hai, bell-widths mein, ki ek sample white centre se kitna door hai.

Level 1 — Recognition

Problem 1.1

Har term ko uske ek-line kaam se match karo: (a) watermark, (b) provenance, (c) green list, (d) $δ$ (watermark strength).

Recall Solution

(a) watermark — ek chhupaaya hua, detectable signal jo content ke andar hi buna hota hai (copy/paste mein survive karta hai; metadata ki tarah yeh alag tag nahi hota).
(b) provenance — poori history/chain-of-custody: kisne banaya, kab, kis tool se, kaunse edits ke saath.
(c) green list — vocabulary ka woh subset jis taraf model ko kisi position pe nudge kiya jaata hai.
(d) $δ$ — woh number jo har green token ke logit (pre-softmax score) mein add hota hai; bada $δ$ = zyada strong, zyada detectable, lekin lower-quality text.

Problem 1.2

Sahi hai ya galat: "Watermark aur C2PA metadata tag ek hi cheez hain kyunki dono prove karte hain ki content kahan se aayi."

Recall Solution

Galat. Dono provenance ko target karte hain, lekin watermark content ke andar embedded hota hai (choose kiye gaye words, perturbed pixels) isliye yeh tab bhi survive karta hai jab file copy ya re-save ho. C2PA metadata ek attached signed manifest hai jise re-upload karke strip kiya ja sakta hai. C2PA signature kaise banta hai yeh dekhne ke liye Cryptographic signatures dekho.

Problem 1.3

"No watermark" assumption ke andar, hum kitne fraction tokens ke green hone ki expect karte hain, aur exactly kyun?

Recall Solution

Exactly $1/2$ . Hash vocabulary ko roughly equal size ke do sets mein split karta hai, aur bina kisi bias ke model un tokens ko us split se independent choose karta hai — toh har token $\frac{1}{2}$ probability se green hota hai, jaise ek fair coin. Isliye $μ = N /2$ white bell ke centre mein hota hai.

Level 2 — Application

Problem 2.1

Ek model $N = 200$ tokens emit karta hai; $n_{green} = 130$ . $z$ compute karo.

Recall Solution

$z = \frac{2 ( 130 ) - 200}{200} = \frac{60}{14.142} \approx 4.243$ $z \approx 4.24$ . Usual threshold $z_{th} = 4$ se upar hai, toh watermark detected (false-positive rate $< 0.003$ ).

Problem 2.2

Wahi $N = 200$ , lekin yeh ek human essay hai jisme $n_{green} = 104$ hai. $z$ compute karo aur decide karo.

Recall Solution

$z = \frac{2 ( 104 ) - 200}{200} = \frac{8}{14.142} \approx 0.566$ $z \approx 0.57$ . Bahut chota — normal random wobble ke andar. No watermark detected. 200 mein se 104 green milna pure chance se bilkul ordinary hai.

Problem 2.3

Ek green token ke logit mein $δ = 2$ add karna. Renormalisation se pehle uska softmax weight $e^{logit}$ roughly kitne factor se badhta hai?

Recall Solution

Softmax weight $e^{logit}$ hai. $δ$ add karne se yeh $e^{δ}$ se multiply hota hai: $e^{logit + δ} = e^{logit} \cdot e^{δ} .$ $δ = 2$ ke liye: $e^{2} \approx 7.389$ . Toh har green token ka raw weight denominator $Z$ ke renormalise karne se pehle roughly 7.4× boost ho jaata hai.

Problem 2.4

$N = 200$ mein se kitne green tokens $n_{green}$ chahiye taaki just $z = 4$ mile?

Recall Solution

Solve karo $z = \frac{2 n _{green} - 200}{200} = 4$ : $2 n_{green} - 200 = 4200 = 56.569 ⟹ n_{green} = \frac{256.569}{2} = 128.28.$ Toh tumhe 129 green tokens chahiye (round up, kyunki $128$ se $z < 4$ milta hai).

Level 3 — Analysis

Problem 3.1

Ek watermarked 300-token text ka $z = 6$ hai. Ek paraphraser use rewrite karta hai, $N^{'} = 240$ tokens bachte hain. Maano ki surviving tokens mein green fraction original jaisi hi rehti hai. Original green count, surviving green count, aur naya $z^{'}$ nikalo.

Recall Solution

Original green count $z = 6$ , $N = 300$ se: $6 = \frac{2 n - 300}{300} ⟹ 2 n - 300 = 6300 = 103.92 ⟹ n = 201.96 \approx 202.$ Green fraction $= 202/300 = 0.6733$ . Surviving green (240 tokens pe same fraction): $0.6733 \times 240 = 161.6 \approx 162$ . Naya $z^{'}$ : $z^{'} = \frac{2 ( 162 ) - 240}{240} = \frac{84}{15.492} \approx 5.42.$ Watermark abhi bhi strongly detected hai ( $z^{'} \approx 5.4$ ). Kam tokens $z$ ko shrink karte hain (denominator ka $N$ numerator se slow badhta hai agar fraction same rahe), lekin yahaan signal itna strong hai ki survive kar jaata hai.

Problem 3.2

Green-list construction use karke explain karo ki paraphrasing asliyat mein Problem 3.1 ke simplified assumption se zyada kyun hurt karta hai.

Recall Solution

Position $t$ pe green list previous token(s) se seed hoti hai: $h_{t} = HASH (w_{t - 1}, key)$ . Jab paraphraser $w_{t - 1}$ change karta hai, toh position $t$ pe green list bhi change ho jaati hai — toh ek token jo tumne rakha tha woh bhi ab ek alag list ke against score hoga aur sirf chance se green hoga (50%). Ek edit isliye sirf us token ko nahi balki uske neighbour ki classification ko bhi corrupt kar deta hai. Real paraphrase attacks surviving green fraction ko 0.5 ki taraf wapas push karte hain, "unchanged" nahi, jo Problem 3.1 ka assumption optimistic banata hai. Yeh coupling wahi fragility hai jo Adversarial examples exploit karte hain.

Problem 3.3

Do texts dono ka $z = 4$ hai. Text A ka $N = 100$ hai, Text B ka $N = 400$ hai. Kis ka green fraction zyada hai, aur yeh watermark strength ki zaroorat ke baare mein kya kehta hai?

Recall Solution

Dono ke liye $n$ solve karo:

A: $2 n - 100 = 4100 = 40 \Rightarrow n = 70$ , fraction $= 0.70$ .
B: $2 n - 400 = 4400 = 80 \Rightarrow n = 240$ , fraction $= 0.60$ . Text A ka fraction zyada hai (0.70 vs 0.60). Interpretation: short texts ko same confidence ke liye bahut stronger per-token bias chahiye, kyunki $z \propto N$ — long texts weak evidence free mein accumulate karte hain, short texts ko $δ$ pe hard lean karna padta hai.

Level 4 — Synthesis

Problem 4.1

Design choice: tumhe tweets (avg 40 tokens) watermark karni hain. Tumhara $δ$ kaisi green fraction $p$ guarantee kare, taaki ek typical tweet $z \geq 4$ tak pahunche? Maano $n_{green} = pN$ exactly hai.

Recall Solution

$z = \frac{2 pN - N}{N} = (2 p - 1) N .$ $N = 40$ ke saath $= 4$ set karo: $(2 p - 1) 40 = 4 ⟹ 2 p - 1 = \frac{4}{6.325} = 0.6325 ⟹ p = 0.816.$ Tumhe roughly 82% tokens green chahiye har tweet mein — yeh ek aggressive bias hai, matlab bada $δ$ aur noticeable quality loss. Synthesis insight: bahut short content ko watermark karna quality/detectability tradeoff ko brutal bana deta hai; aksar better hota hai ki ek account ke kai tweets aggregate karo (effective $N$ badhao) instead of ek tweet pe $δ$ ko hammer karo.

Problem 4.2

Ek C2PA manifest $h = SHA256 (content)$ sign karta hai. Ek attacker ek pixel change karta hai. Walkthrough karo ki kya toot ta hai aur kyun verification FALSE return karta hai, aur yeh watermarking aur signing kyun complementary hain isse jodo.

Recall Solution

Verifier $h^{'} = SHA256 (new content)$ recompute karta hai. Ek single-pixel change $h^{'} \neq = h$ bana deta hai (SHA256 avalanche-sensitive hai: ek bit flip karne se ~aadha output flip ho jaata hai).
Stored signature $s = Sign_{private} (h)$ sirf original $h$ ke against validate hoti hai. Toh $Verify_{public} (h^{'}, s) = FALSE$ .
Complementarity: signature koi bhi tampering detect karta hai lekin trivially strip ho sakta hai (manifest delete karo). Watermark pixels ke andar rehta hai aur stripping survive karta hai, lekin sirf prove karta hai "AI ne banaya," nahi ki "exactly yeh file, unedited." Saath mein: signature = integrity + identity jab present ho; watermark = survivable origin signal. Dekho Cryptographic signatures aur Content moderation ki platforms dono kaise stack karte hain.

Level 5 — Mastery

Problem 5.1

Adaptive attacker. Ek attacker jaanta hai ki green list previous token se seed hoti hai lekin secret key nahi jaanta. Woh randomly fraction $r$ tokens ko synonyms se replace karta hai. Surviving green fraction ko model karo $p_{eff} = (1 - r) p_{0} + r \cdot \frac{1}{2}$ ke roop mein, jahan $p_{0} = 0.68$ original green fraction hai. $N = 250$ original tokens ke liye (kept count $= (1 - r) N$ , length change ignore karo), largest $r$ nikalo jis tak detection ( $z \geq 4$ ) abhi bhi hold kare.

Recall Solution

Surviving tokens: $N_{s} = (1 - r) \cdot 250$ . Green fraction $p_{eff} = (1 - r) (0.68) + 0.5 r = 0.68 - 0.18 r$ . $z = (2 p_{eff} - 1) N_{s} = (2 (0.68 - 0.18 r) - 1) 250 (1 - r) = (0.36 - 0.36 r) 250 (1 - r) .$ Factor karo: $z = 0.36 (1 - r) 250 1 - r = 0.36 250 (1 - r)^{3/2}$ . $0.36 250 = 5.692$ ke saath: $z = 5.692 (1 - r)^{3/2} \geq 4 ⟹ (1 - r)^{3/2} \geq 0.7027 ⟹ 1 - r \geq 0.702 7^{2/3} = 0.7898.$ $r \leq 0.2102.$ Attacker detection fail karne se pehle ≈21% tak tokens rewrite kar sakta hai. Steep $(1 - r)^{3/2}$ decay (linear nahi!) key mastery point hai: har edit dono — fraction aur sample size — ko hurt karta hai, toh robustness intuition se zyada tezi se collapse hoti hai. Yeh bilkul wahi arms-race framing hai jo AI regulation mein hai.

Problem 5.2

Full synthesis. Do sentences mein argue karo ki watermarking akela provenance guarantee nahi kar sakta, kam se kam strength/quality tradeoff aur signatures ki strippability ka reference do.

Recall Solution

Watermarks paraphrase/compression mein decay karte hain aur, short ya creative text ke liye, itna bada $δ$ demand karte hain ki quality suffer kare detection reliable hone se pehle (Problems 4.1, 5.1), toh koi bhi determined attacker $z$ ko threshold ke neeche drive kar sakta hai. Cryptographic signatures (Problem 4.2) integrity prove karte hain lekin removable hain, aur open-source models watermarking simply skip karte hain — toh real provenance ke liye ek layered system chahiye: embedded watermark + signed manifest + platform policy + Content moderation, koi bhi ek mechanism akela kaam nahi karega.

Recall Self-test recap

Poori detection story ek line hai ::: $z = (2 p - 1) N$ — effect size $(2 p - 1)$ times evidence volume $N$ . Signatures aur watermarks complementary kyun hain ::: signatures integrity prove karte hain lekin strip ho jaate hain; watermarks stripping survive karte hain lekin sirf AI-origin prove karte hain, exact-file integrity nahi. Short content ko watermark karna mushkil kyun hai ::: $z \propto N$ , toh chota $N$ bada $δ$ force karta hai aur text quality kharab ho jaati hai.