Human or machine—who created this?

A picture of the Pope in a white down jacket, a term paper on a Goethe poem, or a piece of fake news related to the war in Ukraine—with ChatGPT, Midjourney, and other AI tools, an infinite amount of artificial content can be generated. However, content that has no basis in reality but is created exclusively through the use of generative AI systems poses not only opportunities but also a wide range of risks. For example, it can be used in disinformation campaigns or for fraudulent purposes.

Consequently, there are growing calls to label artificially generated content. This can be done at various stages.

Labeling AI Training Data

It is conceivable to label the data used to train monitored systems such as ChatGPT, Dall E, Midjourney, and others. The idea behind this is that a feature present in all the data will also be found in the newly generated content based on it. A distinction must be made between perceptible and non-perceptible features. The former correspond to a station logo on a television screen, while the latter correspond to masked noise (a digital watermark).

Retroactively labeling AI-generated content

Similarly, content can be labeled only after it has been created. Here, too, both perceptible and non-perceptible labels are conceivable. Alternatively, artificially generated content can be entered into publicly accessible lists. The labeling then occurs, in a figurative sense, through the content’s presence in the list.

Automatically detect and label AI-generated content

Since it cannot be guaranteed that (malicious) users will label content when using AI, the third alternative is to detect artificially generated content and label it accordingly. These are IT forensic methods. They examine content for traces of artificial origin. If they find any, the content is marked accordingly. This can be done, for example, through upload filters, i.e., when content is uploaded to social media.

Positive Lists

Another approach takes the exact opposite strategy. If it cannot be ensured that artificial content is labeled, then perhaps relevant genuine content can be identified accordingly. It is conceivable to create a list of verified genuine content, analogous to a publicly accessible list of artificial content.

Technical Challenges

The approaches to detecting AI content listed above present several technical challenges. Steps to be carried out after creation and before distribution—whether labeling or adding to a list—can only be enforced if the generative system is under the control of a benevolent entity. If attackers have access to proprietary solutions or can use and modify open-source solutions, circumvention is easily possible.

The use of lists, whether for artificial or real content, requires efficient registration and a link between the list and the content. Robust hashing methods that describe the content and digital signatures that verify authenticity are conceivable here. Robust hashing methods also enable efficient searching for content within the list.

With the latter approach—that is, the use of lists with real content—the question arises of whom to trust. Who has the privilege of entering and signing content so that it is considered authentically valid?

Potential Attacks and Security Risks

All of these approaches also entail further security risks. Markers in the content, whether perceptible or not, can be removed. They constitute digital watermarks, which have already been extensively researched. To our knowledge, no security measure against removal has yet been achieved in a scenario where many pieces of content are marked with an identical marker and the presence of the watermark can be publicly verified.

Similarly, there are known attacks that modify content without significant loss of quality in such a way that its robust hash no longer matches the original version. This allows detection in relevant lists to be circumvented.