Watermark-based Attribution of AI-Generated Content

TL;DR

This paper introduces a systematic approach for user-level attribution of AI-generated content using unique watermarks, combining theoretical analysis and empirical validation to optimize detection performance and robustness.

Contribution

It presents the first comprehensive study on watermark-based user attribution for AI content, including theoretical bounds and an optimized watermark selection strategy.

Findings

Attribution remains accurate under common post-processing techniques.

Watermark-based attribution is robust against limited-query black-box attacks.

Theoretical bounds guide optimal watermark selection for improved attribution.

Abstract

Several companies have deployed watermark-based detection to identify AI-generated content. However, attribution--the ability to trace back to the user of a generative AI (GenAI) service who created a given AI-generated content--remains largely unexplored despite its growing importance. In this work, we aim to bridge this gap by conducting the first systematic study on watermark-based, user-level attribution of AI-generated content. Our key idea is to assign a unique watermark to each user of the GenAI service and embed this watermark into the AI-generated content created by that user. Attribution is then performed by identifying the user whose watermark best matches the one extracted from the given content. This approach, however, faces a key challenge: How should watermarks be selected for users to maximize attribution performance? To address the challenge, we first theoretically derive lower bounds on detection and attribution performance through rigorous probabilistic analysis for any given set of user watermarks. Then, we select watermarks for users to maximize these lower bounds, thereby optimizing detection and attribution performance. Our theoretical and empirical results show that watermark-based attribution inherits both the accuracy and (non-)robustness properties of the underlying watermark. Specifically, attribution remains highly accurate when the watermarked AI-generated content is either not post-processed or subjected to common post-processing such as JPEG compression, as well as black-box adversarial post-processing with limited query budgets.