6.4.12 · D5 · HinglishAI Safety & Alignment
Question bank — Watermarking and provenance
6.4.12 · D5· AI-ML › AI Safety & Alignment › Watermarking and provenance
Vocabulary ki ek choti si reminder, taaki neeche koi term undefined na aaye:
Recall Woh words jo is page pe assume kiye gaye hain
Ek watermark ek hidden statistical pattern hai jo content mein woven hota hai jab woh generate ho raha hota hai. Provenance recorded history hai (kaun/kab/kaun se tools). Ek logit woh raw score hai jo model ek token ko probability mein convert karne se pehle deta hai; kuch logits mein ka bias add karna model ko un tokens ki taraf tilt karta hai. Green list woh set hai jisme secretly promoted tokens hote hain ek given position par; z-score count karta hai ki green-token count "random coin-flip" baseline se kitne standard deviations upar hai.
Agar inme se koi shaky lage, toh derivations parent note mein hain — pehle wahan jaao aur wapas aao.
True ya false — justify karo
Ek watermark file ki metadata mein store hota hai.
False. Metadata (jaise C2PA tags) content ke saath rakha hota hai aur strip kiya ja sakta hai; ek watermark token choices ya pixels mein woven hota hai, isliye woh copying aur re-saving ke baad bhi bachta hai. Yahi distinction woh poori wajah hai ki dono mechanisms exist karte hain. Metadata side ke liye Cryptographic signatures dekho.
Do log ek hi model se ek hi question poochhte hain toh unhe identical watermarks milte hain.
False. Har position par green list previous tokens aur ek secret key se seed hoti hai, isliye jaise hi do outputs ek word se diverge hote hain, har downstream green list bhi diverge ho jaati hai — signal content-dependent hai, koi fixed stamp nahi hai.
Ek lamba watermarked text chhote se zyada easily detect hota hai.
True. Z-score ki tarah badhta hai ek fixed green-fraction ke liye, toh zyada tokens matlab random baseline se zyada standard deviations ka separation. Das watermarked tokens practically undetectable hain; ek hazaar unmistakable hain.
Agar detector high z-score report kare, toh text definitely AI-generated hai.
False. High z ka matlab hai ki pattern statistically chance se bahut unlikely hai, impossible nahi. ka false positive rate phir bhi ~300 innocent documents mein ek baar fire karta hai, isliye "bahut strong evidence" matlab "proof" nahi — isliye AI regulation detectors ko ek input maanta hai, verdict nahi.
badhana watermark ko hamesha strictly better banata hai.
False. Zyada model ko green tokens zyada often choose karne ke liye force karta hai, jo detection ko sharpen karta hai lekin word choice ko distort karta hai — perplexity badhti hai aur humans awkward phrasing notice karte hain. Yeh ek trade-off hai, free win nahi.
wala watermark phir bhi ek faint detectable trace chodta hai.
False. ke saath green tokens ko koi boost nahi milta, toh har position genuine 50/50 coin flip hai — expected green count exactly hai aur z zero ke aas-paas rehta hai. Koi bias nahi matlab koi signal nahi.
C2PA aur green-list watermarking ek hi problem solve karte hain.
False, aur alag karne laayak hai. C2PA ek signature ke zariye provenance assert karta hai jo content change hone par break ho jaati hai; green-list watermarking ek intrinsic signal hide karta hai jo edits survive karta hai lekin author ka naam nahi le sakta. Ek tamper-evident label hai, doosra invisible ink hai.
Error dhundho
"Humne ek secret key use ki, isliye woh attacker jo humara text padhta hai woh bhi nahi bata sakta ki yeh watermarked hai."
Error yeh hai: text padhna threat nahi hai — key verification ko protect karti hai, lekin statistical bias khud un attackers se estimate ki ja sakti hai jo model ko enough queries karte hain. Key ki secrecy detector ki forgery rokti hai, yeh signal ko information-theoretically invisible nahi banati (dekho Information theory).
"Paraphrasing 40% words badal deti hai, isliye exactly 40% watermark signal lost ho jaata hai."
Error yeh hai: loss proportional se zyada bura hai. Kyunki har green list previous token par depend karti hai, ek word badalna next position par green list ko bhi poison kar deta hai — tum changed tokens kho dete ho aur unke baad wale corrupt ho jaate hain.
"Detector ko watermark check karne ke liye original model ke weights chahiye."
Error yeh hai: usse secret key aur hashing rule chahiye, weights nahi. Detection sirf previous tokens se har position ki green list re-derive karta hai aur hits count karta hai — yeh ek sasta, model-free scan hai.
"Image watermarks aur text watermarks dono output mein small Gaussian noise add karte hain."
Error yeh hai: text discrete hai — tum ek word ka fraction add nahi kar sakte. Text watermarking tokens ke beech choice ko bias karta hai; sirf continuous media (images, audio) literal additive noise absorb kar sakte hain. Dono ko confuse karna classic beginner slip hai.
"Hamara watermark robust hai kyunki detector JPEG compression ke against train kiya gaya hai."
Error yeh hai: JPEG ke against robustness ka matlab paraphrase ya targeted removal attack ke against robustness nahi hai. Known transformations ke against defend karna ek adaptive adversary ke against defend karna nahi hai — dekho Adversarial examples.
"Agar photo mein C2PA signature nahi hai, toh woh fake honi chahiye."
Error yeh hai: signature ka absence sirf yeh matlab hai ki tool ne use sign nahi kiya — zyaatar legitimate cameras aur purani images mein koi nahi hota. Missing provenance trust reduce karne ki wajah hai, forgery conclude karne ki nahi.
Why questions
Green list ko previous token se kyun seed karte hain, sirf token position se kyun nahi?
Kyunki provenance ko insertion ya deletion jaise edits survive karne chahiye. Position-based seeding ek token add hote hi desynchronise ho jaati; content-based seeding har position ki list ko uske actual local context se tied rakhti hai. Yeh pattern ko context-dependent aur strip karne ke liye mushkil bhi banata hai.
Detection statistic z-score kyun hai, sirf "green tokens count karo" kyun nahi?
Kyunki, say, 125 ka raw count aur expected spread jaane bina meaningless hai. Z-score surplus ko standard deviation se normalise karta hai, isse ek scale-free "yeh kitna surprising hai?" number mein badalta hai jo text lengths ke across comparable hota hai.
Parent note kyun kehta hai ki watermarks "seatbelts ki tarah hain, brakes ki tarah nahi"?
Kyunki woh AI content exist hone ke baad detect aur respond karne mein help karte hain, lekin iske creation ko prevent karne ke liye kuch nahi karte — ek open-source model ya determined attacker inhe entirely sidestep kar leta hai. Yeh ek defence stack ka ek layer hai jo Content moderation aur policy ko bhi include karta hai.
Ek cryptographic signature authorship kyun prove kar sakta hai jabki watermark generally nahi kar sakta?
Signature ek private key se bana hota hai jo sirf author ke paas hoti hai, isliye valid signature content ko us key se tie karta hai. Green-list watermark sirf "ek watermarked model ne yeh banaya" prove karta hai, kaun person ne use run kiya nahi — issmein Cryptographic signatures jaisi identity binding nahi hoti.
Watermarking casual chat se zyada poetry ko zyada kyun hurt karta hai?
Poetry precise, kabhi-kabhi rare word choices par jeeti hai; green-list tokens force karna usable vocabulary ko wahan shrink kar deta hai jahan yeh sabse zyada matter karta hai. Casual chat mein kaafi interchangeable phrasings hain, isliye bias quality ko barely dent karta hai. Ek hi , bahut alag damage.
Watermarking Model fingerprinting se alag kyun hai?
Ek watermark deliberately output mein plant kiya jaata hai baad mein detect hone ke liye; ek fingerprint ek model ke behaviour ka unintentional statistical quirk hai jo model ko identify karta hai tab bhi jab kisi ne kuch mark karne ki koshish nahi ki. Ek woh signature hai jo tum likhte ho; doosra woh scent hai jo tum help karke chhod dete ho.
Edge cases
Ek purely human-written text ka z-score kya hoga jo luck se bahut saare "green" words use karta hai?
Yeh 0 ke aas-paas fluctuate karta hai, kabhi-kabhi upar spike karta hai. Woh spike exactly false-positive risk hai — detector ek lucky human aur ek weak watermark mein distinguish nahi kar sakta, isliye threshold high set ki jaati hai (z ≈ 4).
Agar text sirf 5 tokens lamba ho toh detection ka kya hoga?
Detection collapse kar jaati hai. ke saath standard deviation possible surplus ke relative badi hai, isliye all-green text bhi barely z ≈ 2 clear karta hai — statistically inconclusive. Watermarks ko bolne ke liye length chahiye.
Ek user ek hi prompt 50 baar regenerate karta hai aur kuch average nahi karta — sirf sabse less awkward output pick karta hai. Kya watermark survive karta hai?
Haan, har individual output phir bhi watermarked hai; watermarked drafts mein se cherry-picking bias erase nahi karta, bas ek fluent wala select karta hai. Tokens ke across averaging use break kar deti, lekin tum discrete text average nahi kar sakte.
Agar attacker har kuch tokens ke baad ek random green-neutral word insert kare?
Yeh ek cheap desync attack hai: har insertion us context ko shift kar deti hai jo next green list seed karta hai, following tokens ke signal ko corrupt karta hai. Robust schemes ek longer, zyada forgiving context window par hashing karke iska counter karte hain.
Content watermarked bhi hai aur C2PA-signed bhi, phir koi image crop karta hai. Kya survive karta hai?
C2PA signature break ho jaati hai (uska hash ab altered pixels se match nahi karta), jabki ek robustly-trained pixel watermark crop survive kar sakta hai. Yahi exactly wajah hai ki dono mechanisms ko stack kiya jaata hai substitutes ki jagah nahi treat kiya jaata.
Kya ek watermark detector us content par kaam kar sakta hai jo model ne generate nahi kiya lekin uski style mimic karta hai?
Nahi — mimicry surface style copy karta hai, secret green-list bias nahi, isliye mimic ka z-score zero ke paas rehta hai. Yeh ek feature hai: watermark detection planted pattern ke liye test karta hai, "kya yeh AI-ish lagta hai" ke liye nahi, jo AI-generated content detection ka kaam hai.
Agar detection public ho (koi bhi run kar sake), toh removal trivial kyun nahi hai?
Public detection ko secret key chahiye, aur us key ke saath bhi, removal ka matlab hai enough tokens badalna taaki z threshold se neeche aa jaaye — jo text degrade karta hai aur exact green lists jaanna require karta hai. Detectability aur removability alag difficulties hain.