Think you can cheat with AI? A UF professor creates watermarks to detect AI-generated writing
Artificial intelligence is putting instructors and employers in an awkward position when it comes to accepting written work, leaving them wondering: Who wrote this? A human or AI?
But imagine a digital watermark that could remove the guesswork and actually flag AI-generated text whenever someone submits their writing. A University of Florida engineering professor is developing this technology right now.
“If I'm a student and I'm writing my homework with ChatGPT, I don't want my professor to detect that,” said Yuheng Bu, Ph.D., an assistant professor in the Department of Electrical and Computer Engineering in the Herbert Wertheim College of Engineering.
Using UF’s supercomputer HiPerGator, Bu and his team are working on an invisible watermark method for Large Language Models designed to reliably detect AI-generated content – even altered or paraphrased – while maintaining writing quality.
Navigating the AI landscape
Large Language Models, such as Google's Gemini, are AI platforms capable of generating human-like text. Writers can feed prompts into these AI models, and the models will complete their assignments using information from billions of datasets. This creates a significant problem in academic and professional settings.
To address this, Peter Scarfe, Ph.D., and other researchers from the University of Reading in the United Kingdom tested AI detection levels in classrooms last year. They created fake student profiles and wrote their assignments using basic AI-generated platforms.
“Overall, AI submissions verged on being undetectable, with 94% not being detected,” the study noted. “Our 6% detection rate likely overestimates our ability to detect real-world use of AI to cheat on exams.”
The low performance is due to the continuous advancement of Large Language Models, making AI-generated text increasingly indistinguishable from human-written content. As a result, detection becomes progressively more difficult and may eventually become impossible, Bu said.
Watermarking offers an alternative and effective solution by proactively embedding specifically designed, invisible signals into AI-generated text. These signals serve as verifiable evidence of AI generation, enabling reliable detection.
Specifically, Bu's work focuses on two key aspects: maintaining the quality of Large Language Model-generated text after watermarking, and ensuring the watermark's robustness against various modifications. The proposed adaptive method ensures the embedded watermark remains imperceptible to human readers, preserving the natural flow of writing, compared to the original Large Language Models.
Streamlining the detection process
Some tech companies are already developing watermarks for AI-generated text. Researchers at Google DeepMind, for example, created a text-detection watermark last year and deployed it to millions of chatbot users.
Asked about the difference between those watermarks and his project, Bu said UF’s method “applies watermarks to only a subset of text during generation, so we believe it achieves better text quality and greater robustness against removal attacks.”
Additionally, Bu’s work enhances the system’s strength against common text modifications in daily use, such as synonym replacement and paraphrasing, which often render AI detection tools ineffective. Even if a user completely rewrites the watermarked text, as long as the semantics remain unchanged, the watermark remains detectable with high probability. And a watermark key is applied by the platform itself.
“The entity that applies the watermark also holds the key required for detection. If text is watermarked by ChatGPT, OpenAI would possess the corresponding key needed to verify the watermark,” Bu said. “End users seeking to verify a watermark must obtain the key from the watermarking entity. Our approach employs a private key mechanism, meaning only the key holder can detect and validate the watermark.”
The primary issue now, Bu said, is how end users obtain that watermark key. In the current framework, a professor must contact the entity that embeds the watermark to obtain the key or use an application programming interface provided by the entity to detect watermarking. The question of who holds the key and, consequently, the ability to claim intellectual property, is critical in the development of Large Language Model watermarking.
“A crucial next step is to establish a comprehensive ecosystem that enforces watermarking usage and key distribution or develops more advanced techniques that do not rely on a secret key,” Bu said.
Bu has written multiple papers on AI watermarks, including "Adaptive Text Watermark for Large Language Models" (published last year) and "Theoretically Grounded Framework for LLM Watermarking: A Distribution-Adaptive Approach" for the International Conference on Machine Learning.
“Watermarks have the potential to become a crucial tool for trust and authenticity in the era of generative AI,” Bu said. “I see them seamlessly integrated into schools to verify academic materials and across digital platforms to distinguish genuine content from misinformation. My hope is that widespread adoption will streamline verification and enhance confidence in the information we rely on every day.”