How to watermark AI
A post about a post about Unicode
Short version: You should go read this thing I wrote a few weeks ago, but didn’t mail out for reasons outlined below.
In Just Evil Enough, Emily Ross and I talk about the art of subversiveness. To subvert (literally “to turn from below”) is to get something to work in an unintended way, or to find a clever hack. Netflix subverted the US postal service, turning it into a broadband network by sending 4.6GB DVDs via first class post. If you’re stuck in a hotel room, and need to write for a while at an adjustable desk, then using the ironing board is a clever life hack.
The thing about the best hacks is that a small change can have massive consequences. I think that generative AI will transform how humans work and communicate, but I am decidedly pro-team-humanity. I believe we should be able to know where the things that we put into our brains came from. What humans, governments, and companies choose to do with that information is up to them. We do this with food labelling, printing ingredients and calories; why not do it for AI?
While we can watermark big things (like an image or a paragraph) using steganography or cryptography, we can’t really mark individual letters. But text is the “atomic element” of the online world, and much of what we read will be generated by an AI but edited by a human, resulting in blended text.
So back in July, I started thinking how I’d apply subversive thinking to this problem. What I needed was a solution that could mark individual letters, that already existed and was supported by billions of devices, which everyone knew how to use, and that would function without the approval of intermediaries. That way if OpenAI or Anthropic “marks” a letter, then apps like Twitter, Facebook, Word, Google Slides, or Slack don’t have to do anything special.
Oh, and it had to be something the generative AI companies would want to do for their own self-interest, and have the power to do.
That’s a tall order. But it turns out there may be an answer sitting in plain sight: Unicode, the universal numbering system for every character and emoji we see online. I asked a few people I trust, who all got excited about the idea and offered to circulate it more widely.
Some suggested I submit it to ArXiV, the preprint service that’s where most big ideas in AI get shared. Meanwhile, the folks at Wired let me write an Op/Ed to explain the idea a bit:
The article got decent attention, and a few friends in the right circles helped me get it in front of the CEOs of Microsoft, Google, and OpenAI. One of the coolest things about using Unicode is that many of the biggest LLM companies—Meta, Google, and Microsoft—are also the members of the governing body that decides how Unicode is used.
Normally, when you contribute to a magazine like Wired, you’re asked not to write anything similar anywhere else. But since the goal of this was to circulate a proposal widely, they made an exception. I wrote a post here on Substack, but didn’t send it to subscribers—in case ArXiV approved the submission.
The submission went into limbo for a bit, and was ultimately refused for not containing “sufficient original or substantive scholarly research.” Ah, well.
Anyway, now that’s been settled, here is a version of what I proposed to ArXiV, which goes into more detail than the Wired post did.