Large Language Models (LLMs) are all the rage right now. One of the most popular ones is ChatGPT, released by OpenAI. Even though it is incredibly powerful, it also raises ethical issues when used for cheating in exams, writing research papers without citations, etc. In this post, I look at two methods to detect text generated by AI. One of the ways to detect if the text was generated by ChatGPT is by using its own outputs! The second embeds a watermark right in the text.
Using ChatGPT to detect ChatGPT
Hypothesis
DetectGPT is an AI model proposed by Eric Mitchell et. al. which proposes to use the observation that a passage generated by a model and modified with minor perturbations (edits), tends to have lower log probability than the original passage. However, if the same process is applied to a human-generated passage, the log probability can be lower or higher.
If the process is applied n times (where n is large), and the log probability is consistently lower than the original passage, we can be sure that the passage was generated by an AI model.
Model and Working
As shown in the model image above, the text is perturbed by creating N variations and each variation is fed into GPT-3 to get the probability scores. The log probability of the N sample can then be used to make a prediction about the source of the model. The perturbations are generated using T5, which is a text-to-text transformer built by OpenAI.
Here is an illustration from the paper which shows the visual representation of the log probability always being lower for an AI-generated text and higher or lower for human-generated text.
In addition to this, this model is zero-shot, meaning it does not require human-written and model-generated samples for training. The accuracy of this model is pretty high even with 25% of text being perturbed. The authors mention that the perturbations are semantically similar and produce lower log probability hence are indicative of a bias by the model towards a particular structure. As opposed to this, humans follow arbitrary structures which vary from instance to instance.
This bias works kind of like a watermark that is implicitly added by ChatGPT to its texts, and here’s where our second method comes in.
Hiding the proof in plain sight
The paper ‘A Watermark for Large Language Models’ by John Kirchenbauer et. al. proposes a watermarking method for ChatGPT.
Intuition
LLMs work by generating a sequence of tokens when generating text. Meaning, given a sentence, it chooses the next token from a set of words. If a bias is added so that some words are more likely to be chosen than others, without changing the meaning, a detector can then be used to see how many of the “chosen words” appear in a text.
Working
Consider the sentence ‘I enjoy eating ________’. There are many choices for the next word to complete this sentence. What the watermarking model suggests is as follows:
Pick the most recent token to seed a random number generator. (Done by producing the hash of the token)
Then using the random number, split the possible words into a list of whitelisted words and blacklisted words such that both lists are equal in length.
Then only use the whitelisted words and not the blacklisted words when generating text
For detection, check the number of whitelisted words in the text. The more numerous they are, the more likely it is that the text was generated by an AI. (Beyond a value probably with probability 1)
This method needs access to the model while generating text, but not for detection. A program with access to the hash function and random number generator can reproduce the blacklist i.e. words that will not appear in the text if generated by an AI. For every blacklisted token the probability of it being chosen by a human is 1/2 and not being chosen is also 1/2. Given a text with N tokens, the probability that a writer guessed all of them is (1/2)^N, which becomes extremely unlikely for large values of N.
Another important caveat is the distinction between low-entropy tokens and high-entropy tokens.
The tokens that have more good alternatives are high-entropy
The tokens that have fewer good alternatives are low-entropy
Consider the phrase ‘My favourite cricket player is Sachin _______’. Here probably the only plausible choice is ‘Tendulkar’. However, if our algorithm blacklists this word, then the accuracy of the model will suffer. Hence it is suggested that low-entropy words should be left alone while high-entropy words should be targeted. This makes intuitive sense because, for a large corpus, low-entropy tokens will heavily outnumber high-entropy tokens.
A few days ago, OpenAI has released their own detector to check whether a given text is generated by AI.
Conclusion
As LLMs become more powerful, capable and ubiquitous, the challenges associated with them will also grow exponentially. Perfecting techniques such as zero-shot detection and watermarking can help to curb misuse while maximizing the benefits of these models.
Resources:
Fun Tweet :)
That’s it for this issue. I hope you found this article interesting. Until next time!
Connect Here: