LLMs respond differently to harmful prompts when AI watermarking is used
In response to a new European Union law, AI platforms are implementing new schemes for watermarking the content they generate.
SynthID can cause models to follow harmful instructions they would otherwise refuse.
New research shows that SynthID-Text can change not just word selection but also the tools a model invokes and the chances it will adhere to or disregard safety guardrails it has been trained to follow. The threat can become greater in the face of an adversarial prompt, in which an attacker attempts to cause a model to carry out a harmful action, such as revealing a password or other sensitive information. Instructions that normally wouldn’t be followed will, in some cases, be performed once the watermarking is deployed. The finding underscores the need for developers to thoroughly test how their LLMs and agents behave when watermarking is in place.
“As compared to the same models without watermarking, it is definitely going to change their behavior, especially when we place it under adversarial conditions, or we make these models call tools when they’re powering an agent,” Andrea Siposova, an AI security researcher at Lasso Security, told Ars. “Watermarking is made to not be perceptible to a reader, but we know that when we are changing anything about what the model is generating, it is going to cause some tradeoffs, it’s going to show up somewhere.”
Watermarking works by embedding a signal that allows output to be identified as AI generated, something known as provenance. SynthID takes the normal sampling process and adds a random seed generator, sampling algorithm, and scoring function to it. Instead of the process using an arbitrary random number generator for next-word selection, the watermarking uses a secret key. While the word selection is still random, people with knowledge of the key can check the sequence of words to determine the likelihood that the key was used.
A key feature of SynthID is something known as tournament sampling . Similar to a sports game, SynthID evaluates large numbers of next-word token candidates. It uses a secret key to assign them probability scores. A pair of tokens competes in a round. The one with the higher hidden score wins and advances to the next round. The process continues until a final winning token is determined. More about tournament sampling can be found here and here .
