A proposed digital watermark to prevent artificial intelligence (AI) models from altering real photographs can be thwarted simply by saving the image as a JPEG file, say researchers, suggesting that managing the rise of photorealistic deepfakes will be harder than initially thought.
While AIs can generate images from text prompts alone, such as those of the Pope wearing a puffer jacket that recently went viral, they can also be used to modify existing photos, creating realistic pictures of events that never happened. A proposed solution to this is a , created by at the Massachusetts Institute of Technology and his colleagues, which adds tiny amounts of visual noise to images that is imperceptible to humans but lowers the quality of output when AI models are asked to edit them, making them less photorealistic and sometimes causing incongruous areas of grey space.
µž³Ü³ŁĢż at the University of Maryland at College Park and his colleagues have found that this noise can be removed by converting the image to a JPEG. This commonly used format is designed to reduce the file size of images, at the cost of a slight reduction in quality, and effectively strips out the noise added by Photoguard.
Advertisement
Sandoval-Segura says that the Photoguard teamās paper explicitly said that it was an early exploration of a solution, and not necessarily a polished tool with watermarks that were impervious to attack. But the ease with which it was broken is surprising, he says.
āThe way that they modified it can be basically removed,ā he says. āWhat weāre saying is this JPEG compression has removed enough that it no longer accomplishes the goal it originally set out to do.ā
Non-visual noise has also been proposed as a way of marking the output of AI, rather than preventing the modification of existing photos, but Sandoval-Segura believes that all watermark approaches will eventually be neutralised with enough editing, so a different solution will be needed. He is sceptical that it will come before AI models are able to make images that are indistinguishable from real photographs, even under intense scrutiny.
āI think Iām confident that the realistic images will come before any detection method,ā he says. āThis is a tough problem. I donāt have a solution.ā
āThese improved attacks could be easily integrated into our framework without changing its overall structure to make our immunisation robust to JPEG compression,ā says Salman. While defending against image editing in general is impossible, he says, it is still worth trying to prevent AI image editing. āBy making this process more challenging, we aim to reduce the prevalence of generated fake images.ā
arXiv
