A proposed digital watermark to prevent artificial intelligence (AI) models from altering real photographs can be thwarted simply by saving the image as a JPEG file, say researchers, suggesting that managing the rise of photorealistic deepfakes will be harder than initially thought.
While AIs can generate images from text prompts alone, such as those of the Pope wearing a puffer jacket that recently went viral, they can also be used to modify existing photos, creating realistic pictures of events that never happened. A proposed solution to this is a , created by at the Massachusetts Institute of Technology and his colleagues, which adds tiny amounts of visual noise to images that is imperceptible to humans but lowers the quality of output when AI models are asked to edit them, making them less photorealistic and sometimes causing incongruous areas of grey space.
叠耻迟听 at the University of Maryland at College Park and his colleagues have found that this noise can be removed by converting the image to a JPEG. This commonly used format is designed to reduce the file size of images, at the cost of a slight reduction in quality, and effectively strips out the noise added by Photoguard.
Advertisement
Sandoval-Segura says that the Photoguard team鈥檚 paper explicitly said that it was an early exploration of a solution, and not necessarily a polished tool with watermarks that were impervious to attack. But the ease with which it was broken is surprising, he says.
鈥淭he way that they modified it can be basically removed,鈥� he says. 鈥淲hat we鈥檙e saying is this JPEG compression has removed enough that it no longer accomplishes the goal it originally set out to do.鈥�
Non-visual noise has also been proposed as a way of marking the output of AI, rather than preventing the modification of existing photos, but Sandoval-Segura believes that all watermark approaches will eventually be neutralised with enough editing, so a different solution will be needed. He is sceptical that it will come before AI models are able to make images that are indistinguishable from real photographs, even under intense scrutiny.
鈥淚 think I鈥檓 confident that the realistic images will come before any detection method,鈥� he says. 鈥淭his is a tough problem. I don鈥檛 have a solution.鈥�
鈥淭hese improved attacks could be easily integrated into our framework without changing its overall structure to make our immunisation robust to JPEG compression,鈥� says Salman. While defending against image editing in general is impossible, he says, it is still worth trying to prevent AI image editing. 鈥淏y making this process more challenging, we aim to reduce the prevalence of generated fake images.鈥�
arXiv
