How Watermarks Track AI Generated Content - Computerphile Transcript, AI Summary & Key Points

00:00 Are you someone, Sean, who writes everything with AI? >> Absolutely not. >> Okay. If you were, it's about to get much easier to detect that you haven't been doing your own work. >> Ah, okay. >> Um, the EU has passed laws that AI companies are going to have to start watermarking their own output so that it can be detected later. Anthropic have just released an article that says they're going to do it and how they're going to do it.

00:27 Google's already doing it. All the companies are going to. But they're not limiting this to the EU. They're going to be doing it across the world because essentially it's easier logistically to do that. And there are some other benefits of watermarking text. This isn't just about catching plagiarism, right? In fact, it's actually kind of a small part of it.

00:43 But it's going to be really interesting because you won't see any difference in the output. And so I thought it'd be quite interesting to talk about how that is. How how can you have a system where there's a kind of secret buried inside the output of this large language model? Whether it's code, whether it's a poem, whether it's some factual information that can be with almost 100% confidence detected later.

01:10 So I saw a paper a while ago and we did a video on this. I think we called it cheap GPT. >> Cheat GT. >> I really liked that work because it was a really clever idea. It just had a few limitations. And what's been happening over the last few couple of years is for other papers have come out which slowly build on this to the point where actually now there is potentially a viable system and certainly a system that people are going to start implementing.

01:31 Um there are pros and cons right and I'm not here to talk about whether or not we should be watermarking AI text. Um let's just talk about how you do it and what potential impact it might have >> because I think the thing is any watermark in theory can be removed. Right. >> Yeah. And and and the other interesting thing is you won't be able to check whether your your the output has been watermarked except to ask the company right for various reasons essentially it involves a secret which only they know.

01:59 >> I was going to say that sounds a bit gatekeepery is that it >> you would think that but actually that's not the reason is because it's the only way the security works. If you knew the way the watermark was calculated it would be much easier to remove. So the only way it stands up even to some editing is for there to be some secrets involved. Right.

02:14 The EU has clearly read these papers because the EU has mandated that the detection mechanism right which involves a secret as well has to also be open. So you have to be able to say to Google or Anthropic is this written by Gemini or by Claude and they will give you a confidence and an answer back. The fact that you don't know technically what some of the stuff they did was in it maybe doesn't matter too much.

02:38 Let's look at my classic sentence that apparently is the only bit of English I know. So the cat sat on the mat, right? So, the cat sat on thee. Now, what's the next word in this sentence? We've we've been over this. >> What could it possibly be? >> Yeah, I think even a 2-year-old in the UK knows what this is. The way that watermarking works, the idea of it right at sort of it its base level is to change what word might be picked here.

03:02 Large language models work by predicting the next word. So, what should happen when you run this text into a large language model is it says there is a 70% chance of the next word being Matt. there is a 30% chance of it being chair or something like this. Right? In this case, it may be 100% Matt, but it's neither it's neither here nor there. The idea is that you don't always pick Matt or chair or some other word.

03:23 You change the choice ever so slightly to give away some information later to the detection algorithm. Right? So the idea is that to us it should look exactly like a reasonable sentence and then later you'd be like well if you were if you were watermarking this you wouldn't have picked chair you would have picked sofa right and we just went well the cat sat on the sofa that's not that's fine right it's a fine piece of text but actually that was detected later >> yeah and in this instance that this is a terrible example

03:56 >> this is this is an absolute terrible example as of all my examples because math is so overwhelmingly likely that you can't really watermark it if you change that word. >> It'd be obvious. >> You'd be obvious, right? But that's one of the interesting things we can talk about in a bit. The original papers on this essentially procedurally split the next word into this kind of red and green partition, 50% red, 50% green, and try to pick red words.

04:18 What the red words were would change every every every word or every token. And the idea was that you'd then go back in hindsight and say, "Was it red? Was it red? Was it red?" And if you had more reds than greens, that starts to provide evidence that someone was trying to do this. The problem with that approach and the reason that we've sort of evolved it over the last couple of years is that it's it it influences the output in some way, right?

04:43 Matt might be a green word, which is a nonwatermarked word. And so we're trying to not predict the word Matt, but everything about this is saying, come on, it's it's it's Matt, right? And so this is, you know, a contrived example, but you can imagine a situation where you've asked for a very specific answer. There is really no way to get around just answering a question.

05:05 So what you want is you want a method that influences this as much as possible when it doesn't matter what you pick and doesn't when you don't. And in some sense you want the likelihood of these words given the context which is the bit before the likelihood to be unchanged. Right? If the if the language model says there's a 70% chance of Matt and a 30% chance of chair or let's say a 20% chance of te chair and a 10% chance of sofa.

05:34 If you run this a thousand times you should get those exact numbers out right even though you're watermarking it which is very very clever. And they do this through this cool sort of medieval style tournament where the different words are fighting out to see who gets to win and be the output token, right? Which is maybe a slightly more cool sounding way than they actually phrase it in the paper, but we'll go with it.

05:55 So the first question is in in the original paper or in the original papers, this red and green list was calculated over the previous sum number of tokens, right? And the reason you would do this is that if you were calculating what what word to produce here or how to bias the word here based on the entire text, any tiny change to that text later would completely remove the watermark.

06:12 So you want the watermark to be interesting but only based on the the most recent word >> sort of localized almost. >> Yes. So actually what happens is the context that we call it which is how we calculate how to influence the next word is based only on the previous four tokens and you could change that but four is what they use in the paper. Four is what I've used in my implementation and what you do is you use this to produce random numbers for every potential token that might come out.

06:39 So the first thing to do is to think about what tokens might come out. So let's continue our example. So we have Matt, right? And that's a 70% chance, right? I'm going to add a few more because otherwise it's going to get pretty boring. Uh so what were the other ones? Chair. >> Chair and sofa. Maybe you've got I don't know bath or something like that.

06:56 >> Yeah. I'm going to say like 15% 10% and that leaves us 5% left, right? I don't know. Now you might sample many more and they might go down to very low probabilities, but they technically are possible. This is the direct output of a large language model. For those people that have forgotten, this is what a large language model does. It just says 70% 15% 10% and then you pick one and then you run the process again.

07:19 Now what we want to do is we want to embed a secret in our choice here in such a way that if you embed this secret over and over again you still get 70 15 10 5. So if we did the thing where we said right that's a red word that's a red word but you will you'll basically never pick these right which is which is distortionary is the word. It distorts the output distribution and you could imagine that what might have been quite a good output starts to degenerate into something that's a little bit iffy, right?

07:48 At le you know the whole point of a large language model is you have these output likelihoods. You should be using them, right? That's that's where their strength flies. So, what are we going to do? What we're going to do is we're going to have a large tournament of of participants and I'm trying to work out a way to have like large sword analogies and things, but I think it's not going to work.

08:06 So, we're going to >> I've got these go like these little guys on horseback in my head, but they're not. >> And I think it's important that you animate this, but the idea is you select the brackets for your tournament based on these likelihoods. So, let's say we're going to pick eight participants, right? I'm going to have eight boxes, right? Uh so, I'm going to do it this way.

08:25 So, let's say I mean what I've also done is um I'm going to have to write them very small. No, no. Okay. So, let's say 70% of it's math. So let's say matt matt matt matt something like that right you know that's only about half actually so let's do another mat right then maybe sofa and maybe half and maybe chair right it's not important now the first thing to note that we can come back to later is that if Matt had a 100% likelihood of being chosen all of these will be Matt the winner of a tournament would by definition

09:02 be Matt which would allow you to preserve the fact that it was the only choice. So this is why it works. Now what we're going to do is we're going to generate scores for each of these based on our watermarking secret. So we have a secret code, right? Let's say it's a secret key. And we're going to take the context, we're going to take the token and we're going to take the round of a tournament.

09:25 So this is round one and we're going to put them into a hash function which we talked about before. It produces pseudo round of knots and ones. We're going to take one of those knots and ones and we're going to score Matt's chair sofa half. Right. So, I'm going to ask you to be my hash function. So, for round one, what score does Matt get? One or zero?

09:47 >> Uh, one. >> Okay. So, Matt gets a one. So, I'm going to put a one in here. Right. Sofa. >> Uh, zero. >> Zero. Uh, chair >> one. >> Okay. Half >> one again. >> All right. Good. You've gone heavy on the ones. you're a biased output. No, that's fine. Um, so this is deterministic, right? This is how hash functions work. So these are statistically random, but they're not actually random.

10:10 They're based on the fact that you were at this position in the tournament. The word was Matt and this was the context. So this will also be different if you've extended a sentence or you've written the cat laid on the right and then you might go well that changes everything, right? So or or nothing. Um, okay. Now the tournament selection process is very very simple.

10:33 These ones are giant swords. These um zeros are broken swords. Right? I I got the analogy in there. We're there. >> Right. One wins. Okay. So let's do a let's do a fourerson tournament. These are the four people who get through. Matt versus Matt. One versus one. They both have a sword. It's 50/50. It's Matt, right? Chair versus Matt. Both won. 50/50.

10:56 Let's to make it more interesting. say chair, right? But it is literally random. >> Matt versus half one. What you going for? >> Let's go Matt again. >> Okay, Matt again. Sofa versus Matt. Zero versus one. Matt wins. And you can see that we've selected the winners completely at random because these ones and are generated by a random function, a pseudo random function.

11:19 So the distribution of words in our next round are kind of the distribution of words we had before. And you can see we're sort of keeping that distribution. That's the idea. So I am going somewhere with this. By the way, if you're thinking, why have you done this tournament? Well, it's just cuz I wanted to talk about medieval knights. So now this is round two.

11:35 So we have a different scoring function. >> Okay. >> All right. So what does Matt get in this new scoring function? Not or one? >> Uh, not. >> Okay. So Matt gets zero. What does chair get? >> One. >> Okay. So now we have two remaining. These are the really elites. Round knights at the round table kind of. Is anyone tired of this analogy yet? Um, so Matt versus chair, zero versus one, chair wins, right?

12:01 So chair, Matt versus Matt, zero versus zero, it's 50/50. If they have the same score, it's 50/50. It's Matt. So Matt scored a zero against chairs one, but it's still in the tournament. And so now, let's say for the sake of, you know, maybe Chair gets a zero and Matt gets a one and the winner is Matt. So that is the token that's output into this into this position here, which is broadly what the LLM said to do.

12:30 >> But you can see that there would have been some way given these random zeros and ones to to come up with a different mechanism. This is very very clever, right? I really like this. >> It's not absolutely obvious. I haven't written three on that. That bothers me. Um it's not obvious why this would work, right? So let's look at a few examples. If you can try examples, just just work them through and you can see how it might work.

12:53 >> So if Matt was 100% likelihood, all of these will be Matt. It wouldn't matter what not or ones it got. All of these would be Matt. All of this would be Matt. This would be Matt, right? And so it it works. If you've got an equal chance of everything, your board are going to have equal numbers of these. They're getting zeros and ones at random. One of them is going to win kind of at random, right?

13:12 So you can see this actually mathematically does not disrupt this. uh as long as this is sufficiently large, you don't really disrupt the number of tokens you can pick, right? Which is quite a nice thing. Why does it work for detection? When you come to detect this, right? Think about the red and green example. What we were doing is we were going back, we were revisiting the context and we were saying in hindsight, was this word a red or a green?

13:36 What we're going to do is we're going to say in hindsight, did this word get ones or zeros in its tournament? Right? So, let's go back later. We've now predicted the word Matt. And what we're going to do is we're going to look at this word. We're going to look at its context and we're going to recomputee its tournament scores. Right? We don't have at the time of detection, we don't have any of the other words that were considered.

13:57 You'd have to rerun the large language model to do this. So all we're doing late when we detect, we've got the secret key. So we can generate the same hash function that we had before, right? So we say, right, for tournament one this context, what in hindsight was the the the score zero or one that Matt got? And it was one. So Matt in hindsight got a one, then it got a zero, then it got a one.

14:19 What's the average of those? Was about 2/3. These ones and zeros are random. >> So suppose this was a random word. You weren't picking any any you weren't doing this, right? You just picked the word Matt because it was it you weren't watermarking or you picked the word sofa. The average number of knots and ones you would get over many tokens would be a half, right?

14:39 Half of them are going to be one, half of them going to be zero. You're not making a decision based on these. They're just what comes out in the wash. >> And so the way that you detect whether this is generated by AI text is if there's a bias towards one. >> The higher the number towards >> the higher the number towards one, the stronger the evidence that you were doing some kind of process that prioritized once.

15:01 If you were just picking a I mean, let's look at another. You've just got some paragraph of text. You look at the next token. Maybe you've got 30 layers in your tournament instead of three or four. And you calculate the number of ones, the average number of ones and zeros across that the levels of a token. For almost all tokens, it's going to be a half.

15:22 They neither won nor lost the the tournament. They just produce scores at random. It's just a random number generator that averages to a half. >> But for the one that won, on average, you're going to be picking ones more often. I mean, if you look at this one, it actually it didn't really work very well because in this one, the fact that it was a one didn't contribute to whether it won or not.

15:40 In this one, it didn't. In this one didn't, but this one it did. So, there's a signal there. In this one, the fact it got zero didn't contribute, but this one it did. The fact it got one, you see? So, you're not going to see a value of one because some of the time it drew, some of the time it wasn't selected, some of the time, you know, um, some of the time there was only one character you could choose.

16:00 But on average, you're going to get a little bit higher numbers of ones, a little bit more one than you are zero. We're saying that over a thousand tokens if you were just producing tokens, right? and you weren't looking at the scores, you weren't doing any kind of decision-m process. If you went back and you did this context thing and you went 1 0 1 1 0 0 n 0 0 n 0 0 n 0 0 n 0 0 n 0 0 n 0 0 n 0 0 n 0 0 1 one1 you would get a half an average of a half plus or minus some small amount of error because this random

16:31 function right a small little normal distribution um but if you were doing this tournament you would get a bit more than a half let's say 0.55 or something like this depending on the length and it becomes overwhelmingly likely the higher that number is and the more tokens you have that you're looking at something real rather than you're looking at noise.

16:54 >> And if somebody wanted to kind of rewrite, I don't know, they've used AI to make a start on an essay, let's say, but then they go through and they change some of the words and all the I mean, isn't that wouldn't that fix it all and and you know, be sorted >> a bit, right? And and our topic have said this and it is certainly the case. So, first of all, the EU is not mandating watermarking on on passages of text less than 200 tokens for because it's unreliable.

17:16 I've noticed that the statistical significance, shall we say, of the amount of ones versus the amount of zeros becomes pretty obvious at three or 400 tokens. If you start to delete half the tokens, I mean, for example, let's look at this sentence here. We're trying to influence this word because this is the one that's watermarked. In fact, they're all watermarked based on the previous words.

17:36 So, all we need to do is change any of these. If we change this word, the cat sat under the mat, which doesn't really make sense, right? um then this hash will be different. These ones and and zeros will completely randomize and this will now be half right the average. So to to evade this you would have to change one in every three or four tokens on a roll >> which is a lot of words >> which is a lot of words and it might start not to make sense.

18:03 It's not about making it I think it's not about saying you could not evade this right it's about saying that it would be a lot of effort to do so. So for example, automated websites that are just paring AI onto the website directly with no human in the loop will be very easily detected because no one's looking at them and changing them. Right? I mean I've I've calculated if you I I I produced two essays.

18:24 I took the first half of one that was watermarked and the second half of the other that wasn't and I got a weaker but still a strong signal because one half of it had the watermark in and one half didn't. Right? So you move things around, you change paragraphs, you change words, you rewrite it. The watermark gets weaker, but actually it's surprisingly difficult to remove over a lot of tokens because of how many words you have to choose.

18:46 And you will end up maybe making the sentence worse if you start saying, I've just got to change a word here, but the sentence is is what it is, right? >> Will this potentially lead to kind of almost black market AI systems that don't watermark? >> That's the other thing, right? So the EU has mandated this for the major providers. there's no there's no going there's not going to be any kind of implementation necessarily applied to open source models that you're running yourself right so I had to implement this myself

19:09 because the alarm installation that I have doesn't do this right and so at least as far as I know if it does then I've really wasted my time so yes you're right people could use local models and other AI to do this I think this is about again it's about a numbers game it's about saying you know in the average general case for someone using AI not really thinking about it then yes we can probably pick up that it was written by a certain model.

19:33 Now the secret that's used to produce this hash is just a secret key and propit will have several of these probably right Google will have some open will have some you don't know them if you don't have the secret key you can't reproduce this hash so your hash will be random you will get a half so you can't detect the watermark which is why you're going to need to ask these companies to do it for you so they will make a public API that you can pull with a document that says is this watermarked or not and and they'll

20:04 give you back these like likelihoods or what have you or p values hopefully that say 99% chance that it is. Let's have a look. So I actually implemented this I implemented a pretty faithful comparison of the original paper plus or minus a few bits uh because I could be bothered. Um but it works really really well and I was I mean I mean it was quite impressive how well it worked.

20:25 Let's have a look. So very briefly what I've done here is I've written some Python code that wraps around. So, Alarma serves the large language model. Um, I'm using Quen 3 to do this because it's small and it runs on my computer. >> Is that a model? Quen, >> it's a Quen is a model. Yes, QuenFree is a model and it does pretty decent for for its size, a pretty decent job of answering basic questions that you might want.

20:47 So, we and what I'm doing is instead of having the model output a token, I'm having the model output the top 20 tokens and their likelihoods. And then I'm running my own tournament essentially and I'm doing the exact rules we had before. So it generates the hash code, the secret hash code. >> It chooses whether they get a zero or one for a given round and then it runs these little micro matches between the two pairs, the different pairs, >> and slowly whittleles them down.

21:10 You see? And then that's that's a whole process. Then during detection, all that happens is I go back and I revisit what those Gcores were. They're called Gcores in the um in the original paper. And if the G scores trend towards one, there's something going on. If a d if a G scores sit as a half, it was random. So let's try it now. Let's pretend we're trying to answer our coursework without doing any work, right?

21:34 Which you should not do. And this is why because you're going to get found out right now because So let's say please write a 500word essay on the main themes and messages within the play McBth. >> You got a little typo on themes on the end of theymes. >> Oh yeah, themesy. Um, it would still work because >> I know, but would you not do one in a slightly less quality because of the context?

22:01 >> Yeah. Yeah. Uh, okay. Max token 600. That'll be about 500 words. Let's make the max tokens a,000 just in case it decides to go a bit verbose, right? And we're going to run this. So, at the moment, this is not watermarking. This is just for every mo every token that comes out, it just picks with the likelihoods given by the large language model. I can't personally tell you whether this is a good essay about McBth.

22:21 My guess is it's the most generic of essays about McBth. >> Yeah. >> Right. >> Might hit some of the points and but >> right so no watermark has been saved and it's been saved in no watermark.ext and we can come back to that later. So let's now run the same thing but this time with watermark we're going to add the watermark. So now we're just putting our tournament in and we're injecting that process into um into the generation.

22:40 And you can see it looks broadly exactly the same because the the the likelihood of any given token at any given position is about the same. And so it it hasn't really had any any real effect on the output quality. Certainly you wouldn't notice you wouldn't go this looks to me like someone's fiddling around with the output. >> Okay. Now, one thing that's interesting about this is if you look at the if you look at this here, this watermarking summary, there were 600 tournaments run, right?

23:10 600 tokens and 437 of them were what we would call reasonable choices between multiple potential tokens. So over a hundred of them there was no choice at all because if you output in a in a in a paragraph about McBth if you output the token MAC you probably want to be following it with Beth, right? Otherwise you're doing it wrong. And so there will have been times where there was only one token.

23:36 The tournament essentially served no purpose at all. Um, and that's why the average token entropy is 0.6, which is not bad, right? But that would change if you were doing a different question. >> So, what's the entropy there? What does that mean? >> The entropy is a representation of how much information is stored in the choices. And so, in this sense, as it trends towards one and goes higher, that means there's lots of choice.

23:55 Whereas, if it goes towards zero, it means essentially in every single case, you just had one token output. It was completely deterministic. There's no watermark. >> So, so, so for instance, it might tend to zero if you said count from zero to a,000. Yes, exactly. And and or you were outputting something very very structured like JSON or code, right, which we can talk about.

24:14 So let's detect this. So Python uh detect.py model uh quen 3 latest uh text. And that text is going to be I think it's input actually not text. I should remember what I did. Um and it's going let's do the nonwatermarked one first, which is I think was it called no watermark? No watermark.ext. So that should hopefully once it's initialized itself tell me what the results of a tournament look like in terms of G's, right?

24:44 Bearing in mind it doesn't have any of the other tokens that we used in the tournament. It doesn't need them. It wants to know what the tournament winners historic GC scores were. >> Here we go. So the mean Gcore across all of the tournament rounds for all of the tokens, I have about 10 rounds in my tournament. The the original paper had about 30 rounds.

25:01 Um is 0.4964 4964, which essentially is almost exactly 0.5 >> and there's no evidence of a watermark in here at all, >> right? Because essentially, if I was just writing an essay about McBth, that's the score I'd get is, right? Let's try the the with watermark one >> sequence shortened. I have no idea what it's doing here. There's not a lot of work involved.

25:26 There we go. Right. So now it has a mean Gcore of 0.51 which is three standard deviations above what we would expect. Right? So and the p value is 0.01 which is saying it's a high enough value over enough tokens. Right? Because we have 18,000 of them which is slightly shorter essay actually. It it phoned it in. What we're saying is if I was just naively at no writing with no watermark, >> I would expect 1 2 3.

25:58 I would expect to I'm counting decimal points. I would expect to produce a mean Gcore of this number about one in a thousand times. Right? >> So it's unlikely to >> it's unlikely. We're not saying this person definitely used AI. We're saying it looks suspiciously like they did. Presumably that's not as conclusive as perhaps it could be but like you say there might be very specific words or something about McBth.

26:21 >> This in a way this is not a good example because >> this is the cat's on the map. So let's let's for example if we go back here and we say let's say something like story instead of a play about McBth right which has basically specific words you know lots of people have written uh 500 word essays about McBth right please write a short story about a >> um potato >> potato in a supermarket that'll do right now that's a kind of open-ended question we might expect a slightly higher entropy it depends how short it goes

26:52 I'm sure you're All very excited to read its output. >> Oh, in a dimly lit aisle of a bustling supermarket. Oh, a lonely potato sat. Do you know this is just >> I'm feeling bad for this potato now already. I mean, >> make this feature. >> All right, now um now this is a much shorter this is a much shorter essay, right? Essay story, but the entropy is much much higher.

27:12 So now if we detect but we now detect story.ext, the hope is it will produce a lower p value because it's more confident because it the the average is trending upwards. That's the idea. Oh yes. So um 0.0 0 0. Okay. It's average is ever so slightly higher but notably higher. >> And it's shorter. >> And it's shorter. And so its p value is quite strong and it it's pretty confident.

27:38 >> Okay. So I mean you know we're talking stories, we're talking essays. Yeah. >> AI is used all the all the time for code generation. So how does this affect that? Because surely with code there's all sorts of things that kind of have to be there with the structure. >> Yeah. You think about if you think about code essentially this watermarking process is still possible.

27:54 It's just much harder to do to get that statistical confidence because most code is is not deterministic but it's very structured. You know after you've written the open of a for loop and a brackets you write in I and then you have to put a semicolon otherwise your code won't run. There can't be any other token. So you can't influence that token. You can influence comments.

28:15 You can influence variable names. you can slightly influence the order of your imports and things like this. It's going to be watermarkable if that's a real adjective. Um but not not so much. So I mean let's show an example. So for example, if I say um watermark save and I'm going to say code example, please write a Python program to manage a to-do list via the command line.

28:47 saving and loading from a file to-do to-do.ext. Um, I mean, I don't know whether that's sufficient information for it to do it, but let's try. Let's try. Um, sure. >> Well, first of all, it's going to watermark that comment. So, you can see it's written this, you know, slightly arbitrary piece of Python code, and you can see that out of the 831 tokens that were output, only 265 of them were now considered valid choices.

29:14 the entropy is much much lower, much harder to watermark. If we detect it, it may find a watermark. It may not. And it will be much easier to remove because it's mostly going to be in the comments and things like this. Right? I'm not giving tips for people who are trying to write their code with, "Oh, it's got it right. It's still found it, but you can see it's weaker.

29:34 It's got a higher p value. It's only 0.575." And if we, for example, if I bring up an editor, suppose I go in here and I edit out all of this sort of stuff. This all looks fine. Got some. Yeah, I mean, I don't hate all this, right? This is fine. Let's get rid of this how to use nonsense. There we go. Let me know if you'd like to add features. That's not going to run.

29:56 So, here's the actual code. Save that. This is going to be much, much weaker now because a lot of the meaningful watermarking was done outside of the actual code itself. >> There we go. See, so now the average is is above a half, but not far above a half. Only 1.4 standard deviations above a half. So yes, it will work on code, but it will work on code at scale, right?

30:19 A very very large file, lots and lots of files, this kind of stuff. Um, I wouldn't be optimistic about being able to obviously detect it, right? Essays, it works really, really well, right? The more open-ended the text, the better it works. >> I mean, there's there's there's got to be some fun ways around this. Yes, there are a few um this is not foolproof because if you mess with this context, you mess with these numbers and then the whole thing falls apart.

30:43 One um famous example which I think is really cool is you ask um the large language one to write your essay or write your output but between every word you ask it to put in an emoji and then at the end just delete all the emojis. All the context has changed completely not watermarked. Right? Now there are some downsides to this. First of all, you've got to spend time deleting emojis.

31:04 maybe just write the essay, right? You know, um and the other thing is it depends on if you're using only the four um elements of the context, then sure, that works. But what if they're doing every alternate one or something some other strategy you don't know about? It's it's not completely obvious how to remove this watermark. But in general, if you're determined to, of course, you can, right?

31:25 But at that point, you're kind of rewriting the whole text anyway, and now it's not written by AI. And maybe that's 1,500 tokens, right? Maybe I'm being a bit harsh, but let's say it's a big big code change. My code is not good. Let's just recap. So the initial query that went to the model was these two, right? like this.