Google DeepMind SynthID and the principles of digital watermarking

How do you check whether an image was created by AI? ###SynthID Google DeepMind has launched a tool called SynthID that allows you to add watermarking to images and check whether it is an AI image. This tool is currently in limited release to Vertex AI customers using Imagen. (The company says it plans to integrate SynthID into other products and expand its use to third-party users.)

• Vertex AI is a tool for creating images from text and is an AI and machine learning development and distribution platform provided by Google Cloud. This watermark does not affect image compression loss and is a digital watermark that is not visible to the naked eye on the image. This means that even after image changes such as filters and color changes, you can check whether the initial image creation was done by AI. So how was this watermark created and applied to the image so that it is invisible but identifiable?

Principles of digital watermarking

SynthID's watermarks are added directly to the pixels of an image, making them invisible to the human eye while still detectable by professional AI identification algorithms. Using two AI models, one is used to add a discreet watermark and the other is used to identify it. Specific details about the principles of the SynthID AI model are not detailed because it is still in beta version and is a security issue. Instead, I looked into it because I thought I could check what methods could be used through the principles of OpenStego. First, Steganography refers to hiding messages in content such as images and videos. This is a method that changes part of the image to a deep learning model, makes it almost similar to the original image, and hides the changed encoding information in the image. Here, changing the image refers to changing some pixels, adjusting color values, etc. OpenStego is a Steganography tool that supports all image formats and has no image attribute or visual changes. You can choose your preferred algorithm and password to suit your security requirements. In fact, OpenStego is based on DCT (Discrete Cosine Transform) for image watermark processing.

DctLSBPlugin

And DWT (Discrete Wavelet Transform)-based

DWTDugadPlugin

,

DWTKimPlugin

,

DWTXiePlugin

It consists of a plug-in-based architecture. Each algorithm here uses Peter Meerwald's code, and you can check it out at the image site where each algorithm written by him has been applied. Let me briefly summarize the concepts of DCT and DWT :)

DCT and DWT

DCT is mainly used for frequency domain representation and data loss compression, while DWT is used for multi-resolution representation and data loss minimization. DCT breaks an image into small pieces and uses color information to create numbers, while DWT breaks an image into small pieces and uses detail information to create an image. Color information here refers to things like hue, saturation, and brightness within a piece, and detail refers to the high-frequency components of the image: small details in the image, edges (sharp changes within the image), texture (non-uniform patterns), and noise. Now, let's take a look at the process of inserting a watermark into an image using the DWTXiePlugin above. (

DWTXiePlugin

embedData

(Exploring the method)

public byte[] embedData(byte[] msg, String msgFileName, byte[] cover, String coverFileName, String stegoFileName) throws OpenStegoException {
// ...
// Cover file is mandatory
if (cover == null) {
throw new OpenStegoException(null, NAMESPACE, DWTXieErrors.ERR_NO_COVER_FILE);
} else {
image = ImageUtil.byteArrayToImage(cover, coverFileName);
}
// ...
// Wavelet transform
dwt = new DWT(cols, rows, sig.filterID, sig.embeddingLevel, sig.waveletFilterMethod);
dwtTree = dwt.forwardDWT(luminance);
p = dwtTree;
// Consider each resolution level
while (p.getLevel() < sig.embeddingLevel) {
// Descend one level
p = p.getCoarse();
}
// Repeat binary watermark by sliding a 3-pixel window of approximation image
for (int row = 0; row < p.getImage().getHeight(); row++) {
for (int col = 0; col < p.getImage().getWidth() - 3; col += 3) {
// Get all three approximation pixels in window
pixel1 = new Pixel(0, DWTUtil.getPixel(p.getImage(), col, row));
pixel2 = new Pixel(1, DWTUtil.getPixel(p.getImage(), col + 1, row));
pixel3 = new Pixel(2, DWTUtil.getPixel(p.getImage(), col + 2, row));
// Bring selected pixels in ascending order
if (pixel1.value > pixel2.value) {
swapPix(pixel1, pixel2);
}
if (pixel2.value > pixel3.value) {
swapPix(pixel2, pixel3);
}
if (pixel1.value > pixel2.value) {
swapPix(pixel1, pixel2);
}
// Apply watermarking transformation (modify median pixel)
temp = wmTransform(sig.embeddingStrength, pixel1.value, pixel2.value, pixel3.value,
getWatermarkBit(sig.watermark, n % (sig.watermarkLength * 8)));
// Write modified pixel
DWTUtil.setPixel(p.getImage(), col + pixel2.pos, row, temp);
n++;
}
}
// ...
return ImageUtil.imageToByteArray(image, stegoFileName, this);
}

To summarize the code: Decompose the cover image into various resolution levels with DWT. We then take the three approximated pixel values ​​from each pixel group and sort them. To apply a watermark transformation to modify intermediate pixels and write the modified values to the image.

DWTUtil.setPixel

Call . Finally, the image with the watermark applied is created, converted to a byte array, and returned. If we look at the meaning in more detail, DWT decomposes an image into different levels of approximation images and detailed component images as follows: Hiding a watermark in an image may affect the high-frequency components of the image, which may compromise image quality. So we usually select a group of pixels from the approximated image. A pixel group refers to three consecutive pixels. Among them, the pixel with the lowest brightness is found and modified according to the bits of the watermark data. The reason for selecting a group of pixels and modifying the lowest pixel is to better hide the watermark without changing the details of the image. This makes the watermark create subtle changes in the image, but difficult for the human eye to detect.

AI image digital watermark and the future

With the development of AI content, distinction and regulation of AI content are gradually becoming important, starting with the voluntary agreement on user safety measures by seven companies, including Google, Ama, and OpenAI. Technologies such as SynthID make it possible to distinguish deepfake images that contain incorrect information or imitate real people through digital watermarks that are invisible to the human eye. There is a coexistence of positive views that see this as meaningful progress for copyright, and skeptical views that there are still limits to the long-term effectiveness of this technology.