从深伪到 DNA：DeepMind 把水印从图片写进了蛋白质

这一期《Google DeepMind: The Podcast》在做一件事：把「水印」这个听起来像防伪标签的概念拆开，讲清楚它怎么被写进一段文字、一张图片，以及——这是本期真正的新内容——一段蛋白质序列里。主持人是伦敦大学学院的数学家 Hannah Fry，两位嘉宾分别是 Google DeepMind 科学副总裁 Pushmeet Kohli，和负责 DeepMind 生物安全方向的研究科学家 Jeremy Ratcliff。本节目的 38 分钟里，前半段是数字内容的水印原理与边界，后半段是同一套方法被搬到合成生物学之后发生了什么。想判断「AI 溯源这件事现在到底做到哪一步」的读者，重点在 4 分 35 秒之后的水印机制，和 19 分 28 秒之后的 SynthID Bio。

Ratcliff 给的判据很直接。第一是人无法察觉——如果使用者能一眼看出哪部分数据被动过，水印就会被擦掉。第二是高可检测性，检测系统要能以较高置信度把水印认出来。第三是通用性，最好一种方法能跨多个系统工作，而不是每换一种数据类型就得重新做一套。1

Kohli 把同一件事拆成三条：水印不能降低内容质量，否则没人愿意用；要能扛住攻击和各种变换，即使有人对信号动手脚，它也还在；要易于集成、易于检测。他说 DeepMind 所有水印系统都是按「不可感知、稳健、可扩展」这三条设计的，目的只有一个——让使用者对自己看到、用到、设计的东西有更清楚的来源判断。

Fry 在节目里问了一个很多人会问的问题：生成式 AI 开放给公众已经好几年了，为什么水印到现在才铺开。

Kohli 的回答是一段技术史。更早的时候，人们判断一张图有没有被篡改，靠的是专门的取证系统去找像素级的细微破绽——那些被修过的图会留下痕迹。但生成式模型变强之后，这些痕迹消失了。他说当时业界一度面对的问题就是：这局是不是结束了，人类还有没有能力分辨一张图是不是 AI 生成的。水印是这个问题的另一条出路：与其事后找破绽，不如在生成的一刻就埋进一个偏置，让它在模型变得完美之后依然存在。

这条路先从图像走起，因为当时人们担心的是假新闻和虚假信息。一张百万像素的图片大约有一百万到三百万个数字可供藏信息，空间相对宽裕。文本就难得多：一句话只有几个词，不能改意思，能腾挪的余地很小，所以文本水印用的是完全不同的一套方法。

如今这套东西已经进入监管。欧盟《人工智能法案》第 50 条要求对 AI 生成或操纵的内容做机器可读的标记，并对深度伪造作出标注义务。2 Kohli 说，监管方希望给用户一个关于内容来源的交代，而可扩展的稳健方案里，水印被认为是一个。采用的名单也在变长：2026 年 5 月，OpenAI 宣布在其生成内容中使用 SynthID 水印并加入 C2PA 指导委员会，英伟达同期宣布采用。3

Fry 请 Kohli 用最直观的方式讲文本水印。他给的例子是：如果你问一个人「早饭吃了什么」，对方可以以「我」开头，也可以以「你」开头，这些选择同样合理——可选性就是水印的落点。

大语言模型生成文字时，对下一个词有一整套概率分布。水印的做法是：背后有一把密钥，它让某些词比另一些词更容易被选中。等文本全部生成完，如果检测方拿着同一把密钥回看，发现这些词以特定方式反复成链出现，就可以判断这段文字出自 AI。检测看的不是某个具体的词，而是这些词组合起来的模式。

这带来两个直接推论。第一，如果不同模型用不同的密钥，检测方还能分辨出这段内容出自哪一个模型。第二——也是限制——如果一句话几乎没有可选性，水印就写不进去。Kohli 举的例子是「法国的首都是哪里？答案是巴黎」，这里没有可以动手脚的地方，所以短文本无法水印。

Fry 顺势问：那学生还能不能作弊？回答并不痛快。Kohli 说整个生态确实在往水印方向走，但这不意味着检测器都会公开。原因很实际：公开的检测器就是一个可以被反复查询的黑箱，查得足够多，就可能反推出针对这套密钥配置的绕过方法。他给出的结论是，这至少不是一把万能钥匙。

图像的做法和文本不同。有一组神经网络看着原始图像，对它做极轻微的修改，把信号嵌进去；这个水印生成器会和检测器联合训练。训练过程中间还站着一个对抗者，它会尝试裁剪、旋转、缩放、加噪声，模拟真实世界里对图片的各种改动，而检测器必须在这些改动之后仍然认得出来。两边一起训练，目标是在对抗者做过任何事之后，水印依然可检测。

这套东西在现实里已经用上了。Kohli 提到加州山火期间流传的一张「神奇地没被烧掉」的房子照片，以及伊朗战争期间流出的一些画面，媒体跑了一遍 SynthID 检测，结果是 AI 生成。检测能力也嵌进了 Gemini：用户可以把图片、视频、音频丢进对话里问它是不是 Google AI 生成或修改的。4

这里有一段容易被忽略的机制：检测需要密钥共享。往内容里注水印的一方要把密钥交出来，检测方才能认。Kohli 说可以有一个中心化服务——SynthID 门户会收集合作机构交来的密钥，从而检测这些合作方生成的内容；如果某个实验室不愿意共享密钥，那就检测不了。

节目从 19 分 28 秒起转到生物学。Ratcliff 介绍的系统叫 SynthID Bio，它包含两种技术：一种给蛋白质结构加水印，也就是给定一段序列、预测出的三维结构；另一种给蛋白质序列本身加水印，也就是那串氨基酸。

两者的嵌入方式完全不同。结构水印改的是单个原子的位置——两个原子之间的距离稍微变一点，或者夹角稍微变一点，原子还是那些原子。序列水印改的是某一个氨基酸的选择，也就是说内容变了，但它的功能含义没有变。Ratcliff 举了亮氨酸和异亮氨酸这类性质接近、互换后结构不受影响的例子。

DeepMind 在 2026 年 9 月 30 日的官方发布稿里把机制写得更细：序列侧用的是经过 SynthID Bio 改造的 ProteinMPNN，结构侧则微调了 AlphaFold 3 扩散网络的一小部分权重，让预测出的三维坐标本身就带着可检测的信号，无论由谁运行这个模型。5

Ratcliff 给的理由是：把数字设计变成真实分子，需要向 DNA 合成公司下单。合成公司会核验下单者身份，再把订单内容与已知危险序列数据库比对，命中就拦截或回溯询问。风险在于，AI 可以设计出一段在序列空间里离数据库里任何东西都很远、但折叠出来却是有害蛋白的序列。他说更深一层的玩法是「剪贴」：把一段会被拦截的部分挪到别处，等进了实验室再拼回原位。

水印在这里提供的是另一类信号。它不能判断某个设计有没有害，但能说明这个设计出自一个带安全护栏的模型，而不是另一个模型或自然界的某段序列。合成公司可以据此把陌生订单分流。发布稿里，生物安全政策专家 Sarah Carter 把这套防线比作「瑞士奶酪」——多层独立措施互相补上对方的漏洞；Twist Bioscience 政策与生物安全副总裁 James Diggans 说，水印有望让筛查更有效率，把资源集中到真正需要细看的序列上。

这是本期信息量最实的一段。研究团队没有停在数字模拟上，他们真的做了一批蛋白质结合体——能选择性贴住其他蛋白的分子。

Ratcliff 说，他们用三种靶点做湿实验：VEGF-A、新冠病毒刺突蛋白的受体结合域，以及 PD-L1。带水印的设计（而且用了两种不同的水印方案）与不带水印的设计相比，命中率和结合强度几乎一致。Kohli 补了一句，这些是真实存在、真的能干活、而且永远可检测的带水印蛋白。

Ratcliff 说自己在拿到湿实验数据之前对效果有点怀疑，结果比所有人预想的都好。他同时强调这只是概念验证：要真正落地，需要模型开发方把水印整合进自己的流程，需要合成方与模型方之间交换密钥，这些协调都还在推进。因为代码会开源，开发者不必先跟 DeepMind 对接就能用。发布稿还提到，他们正在与斯坦福 Hie 实验室和 Arc Institute 合作，把 SynthID Bio 接进基因组模型 Evo 2，给 Evo 2 设计的噬菌体基因组加水印，早期细菌培养实验显示这些噬菌体保持功能。

节目里没有回避这套方法的软肋。Fry 直接问：系统越通用，规则越清楚，是不是就越容易被另一套系统反制？Kohli 承认这是真实风险，所以密钥必须保密，而且水印最好深到「想擦掉就得改掉功能、毁掉原本设计的用途」的程度。发布稿列出的下一步也类似：让水印更能抵抗刻意篡改，以及和 C2PA 那种来源元数据方案配合使用——元数据可以被剥掉，水印能绑定，两者互补。5

Kohli 对终局的说法留了余地：行业正在往统一标准走，但需要时间。Ratcliff 对生物侧的判断更具体——把水印不可察觉地嵌进序列本身，很可能是识别 AI 生成序列来源最好的一类办法之一。

Pushmeet Kohli 是 Google DeepMind 的研究副总裁，同时担任 Google Cloud 首席科学家，负责 DeepMind 的 AI for Science 方向。6 SynthID 项目由他启动，发布稿的致谢里写明「This project was initiated by Pushmeet Kohli」。

Jeremy Ratcliff 是 DeepMind 生物安全计划（Biosecurity Initiative）的研究科学家与负责人，研究方向是科学技术的流行病防范应用，此前获马歇尔奖学金。7

Hannah Fry 是英国数学家、作家与主持人，伦敦大学学院「公众理解数学」讲席教授，主持本节目。8

说明：以下转录由本期官方音频自动识别后按讲话人分段整理，每 10 分钟标注一次时间轴。Hannah Fry 为主持人，Pushmeet Kohli 与 Jeremy Ratcliff 为嘉宾；节目中的音乐与片头片尾会被识别为静音或少量噪声，快速接话处的个别句子可能标错。

Hannah Fry（00:00） Welcome back to Google DeepMind: The Podcast. I'm Professor Hannah Fry. Picture the scene. You are scrolling through your socials and you see some remarkable footage, the up close slow motion eruption of a volcano or a tornado raging through a village or perhaps some footage of a protest. I think many of us ask the same question. Is that real? Was this made by a human or a machine? Well, as AI gets better at generating texts and images and audio and video, that is becoming one of the most challenging questions of our time. Except that now, the answer just got a lot more complicated. We are entering a world where AI can design biological molecules and structures that have never existed in nature before, some of which could be designed to cause harm. So how do you stop something dangerous before it gets made? Well, the answer, it turns out, might be hidden in plain sight, embedded invisibly into the very thing you're looking at, or the very molecule you're about to synthesize. 欢迎回到《我是汉娜·弗莱教授》。想象一下这个场景：你正在浏览社交媒体，看到一些令人惊叹的镜头——火山的特写慢动作爆发，或龙卷风席卷村庄，或者是某些抗议活动的画面。我想我们很多人都会问同样的问题：这是真的吗？这是人类创造的，还是机器生成的？随着人工智能在生成文本、图像、音频和视频方面变得越来越强，这正成为我们这个时代最具挑战性的问题之一。然而现在，答案变得更加复杂。我们正进入一个人工智能可以设计前所未有的生物分子和结构的世界，其中一些甚至可能被设计用来造成伤害。那么，如何在危险的东西被制造出来之前阻止它呢？事实证明，答案可能隐藏在显而易见的地方，隐形地嵌入在你正在看的东西中，或者你即将合成的分子中。

Hannah Fry（01:01） A watermark, not the blocky logo you see on a stock photo, something far more subtle, something mathematical. And today I am joined by two people who are working on this from different angles. Pushmeet Kohli is VP of Science at Google DeepMind. Jeremy Ratcliff is a biosecurity researcher whose team has applied that same technology to biology. Welcome to the podcast, both of you. Jeremy, let's start with you. Watermarking anything that AI spits out, I mean, sounds like a very good idea, but just break it down for me. Why is this helpful? 水印，而不是你在库存照片上看到的方块状标志，而是更为微妙、具有数学性质的东西。今天，我邀请了两位从不同角度从事这项工作的嘉宾。Pushmeet Kohli 是 Google DeepMind 的科学副总裁。Jeremy Ratcliff 是一位生物安全研究员，他的团队将同样的技术应用于生物学。欢迎你们来到播客节目。Jeremy，我们先从你开始。给 AI 生成的任何内容加水印，听起来确实是个好主意，但请帮我详细解释一下。这有什么帮助呢？

Jeremy Ratcliff（01:38） So for biology, sort of the motivation for being able to watermarking is so that we can have provenance and say specifically where did this sequence come from? And really what we're trying to differentiate is between sequences that come from things in nature versus sequences that come as products of AI systems. So specifically, the type of risks that we're thinking about in terms of AI systems is sort of an AI generated sequence that can have properties that we know to be problematic. We might not be able to identify from the sequence itself that it has these problematic properties. 所以对于生物学来说，能够进行水印的动机在于，我们可以追溯来源，并具体说明这个序列来自哪里？我们真正想要区分的是来自自然界的序列与来自人工智能系统的序列之间的差异。具体来说，我们考虑的人工智能系统相关的风险类型，是一种人工智能生成的序列，这种序列可能具有我们已知会引发问题的特性。我们可能无法仅从序列本身识别出它具有这些问题特性。

Hannah Fry（02:07） And what makes a good watermark? Because I think when people consider the phrase, they sort of think of, I don't know, like banknotes or like passports. Is there like rules for what counts as a good watermark? 一个好的水印是什么样的？因为我觉得当人们考虑这个词时，他们会有点想到，我不知道，比如钞票或者护照。有没有关于什么算是好水印的规则？

Jeremy Ratcliff（02:18） I think for us in particular, human imperceptibility is one. So making it very difficult for someone to be able to tell what portion of data has been watermarked. Because otherwise it would be really easy to erase. Yeah, having high detectability, so having some system that can go through and actually identify the watermark with high confidence, and then also good generalizability. So being able to have at least a watermarking method that can work across a bunch of different systems rather than having to make bespoke ones for every single data type. 我认为对我们来说，特别是，人类难以察觉性是一个因素。也就是说，使得别人很难分辨出数据的哪一部分已经被加了水印。否则的话，很容易被擦除。是的，要有高可检测性，所以需要一种系统能够通过检查后以高置信度识别水印，同时还要有良好的泛化能力。也就是说，至少能够有一种水印方法可以在多种不同的系统中使用，而不必为每种数据类型都制作定制的水印方法。

Hannah Fry（02:43） What do you think, Pushmeet? I mean, does that apply beyond biology and more broadly? 你怎么看，Pushmeet？我是说，这是否适用于生物学之外，更广泛的领域？

Pushmeet Kohli（02:47） Yeah, I think the main reason why we started the whole watermarking project at DeepMind almost eight years ago now was to give a sense of provenance. to what users are seeing. If you look at different modalities, whether it's text, whether it's images, whether it's videos, it was hard to imagine 10 years back that we would today be talking about systems that can create images, videos, audio, text, and proteins or enzymes that are indistinguishable from what a human or what exists in nature. And it's an important sort of element for users to give users this idea that you can really believe what you are seeing. So what do we need from a watermark? We need three properties. One, it should not degrade the quality, otherwise basically the whole point is lost. People will not use it. The second element is robustness against attack or against transformations. If people want to remove it, it's hard to remove in the sense that even if you make changes to the signal, it will persist. 是的，我认为我们在 DeepMind 开始整个水印项目的主要原因，几乎可以追溯到八年前，是为了给用户看到的内容提供一种来源的感知。如果你看看不同的模态，无论是文本、图像还是视频，十年前很难想象我们今天会讨论能够生成图像、视频、音频、文本以及与人类或自然界存在的蛋白质或酶无法区分的系统。而这是给用户的重要元素之一，让用户有这样的想法：你真的可以相信自己所看到的内容。那么，我们对水印需要什么？我们需要三个特性。一，它不应该降低质量，否则基本上整个意义就失去了。人们不会使用它。第二个元素是对攻击或变换的鲁棒性。如果有人想要去掉它，这应该很难去掉，从某种意义上说，即使你对信号进行修改，它仍然会存在。

Pushmeet Kohli（04:02） And then the third requirement is that it should be easy to use. Right? It should be easy to integrate in the signal and it's easy to detect from the signal. So those are the three sort of properties of imperceptibility, robustness, and scalability that we have designed all our watermarking systems for, with the whole idea that users have more control and have a better view of what they are seeing or what they are sort of using or designing and so on. 然后第三个要求是它应该易于使用，对吧？它应该易于集成到信号中，并且容易从信号中检测出来。所以这就是我们设计所有水印系统时考虑的三种属性：不可察觉性、鲁棒性和可扩展性，整个理念是让用户拥有更多控制权，并更好地了解他们所看到的、使用的或设计的内容，等等。

Hannah Fry（04:35） It feels like this subject of watermarking has been quite a big deal this summer. But at the same time, we're a few years into generative AI being accessible to the public. What's taken so long, Pushmeet? Why is it only now that this has become so widespread? 感觉这个关于水印的话题在今年夏天变得相当热门。但与此同时，生成式人工智能已经向公众开放几年了。Pushmeet，这么久为什么才发生？为什么直到现在才变得如此普及？

Pushmeet Kohli（04:50） When image editing software started becoming very sophisticated, people were sort of very concerned about this issue of Is this a real image or has this been tampered with? And there was a lot of work and specialized systems which could really sort of analyze an image and see the tiny differences that exist in a tampered image and can say, oh yeah, this was a fake image or this has been tampered with and so on. But as generative AI became more sophisticated, those tiny differences went away. And then that naturally sort of resulted in the question, is this game over in the sense that humans will not have the ability to detect whether something is layer generated? And this is where watermarking sort of came in. We said the way to sort of make sure that humans always have the ability to understand the origin of where some signal came from is by injecting Siddharth Bhatia, Chief Executive Officer, IAI Model. 当图像编辑软件开始变得非常先进时，人们对此问题有些非常担心：这是真实的图像还是被篡改过的？当时有大量的工作和专门的系统可以真正分析图像，看到被篡改图像中存在的微小差异，并能够说，哦，是的，这是伪造图像或者被篡改过等等。但是随着生成式 AI 变得更加复杂，这些微小的差异消失了。自然地，这引出了一个问题，这是否意味着人类将无法检测某些东西是否由 AI 生成？这就是水印技术出现的地方。我们认为，确保人类始终能够理解某个信号来源的一种方法就是通过注入信号。——Siddharth Bhatia，IAI 模型首席执行官。

Hannah Fry（06:24） And when you say we here, Pushmeet, you really do mean we in the literal sense, right? It was you guys that came up with a solution for this one that was scalable. 当你说我们这里的‘我们’，Pushmeet，你真的指的是字面意义上的‘我们’，对吧？是你们这些人想出了一个可扩展的解决方案。

Pushmeet Kohli（06:33） Yes, so our team has been working on this for almost eight years. We started with images because people were concerned about these images being used for fake news, misinformation and so on. And so there was that motivation to solve that problem. At the same time, although the problem is extremely challenging because of the properties we just mentioned of robustness and imperceptibility and efficiency and scalability, still an image is a very large amount of data. A one megapixel image has sort of one million sort of numbers or like three million numbers depending on how it's encoded and so on to hide information, right? And without changing the content. So we developed watermarking systems for images first. Later on, we had to look at the challenge of how do you do this for other modalities like text, which are not as high dimensional as images, where actually it's a very small amount of signal. 是的，所以我们的团队在这个项目上已经工作了将近八年。我们从图像入手，因为人们担心这些图像会被用于假新闻、虚假信息等等。因此，解决这个问题就是我们的动机。与此同时，虽然由于我们刚才提到的稳健性、不可察觉性、效率和可扩展性等特性，这个问题极具挑战性，但图像本身仍然包含大量数据。一张一百万像素的图像大约有一百万个数字，或者根据编码方式有三百万个数字等等，用来隐藏信息，对吧？而且不改变内容。因此，我们首先开发了图像的水印系统。后来，我们不得不面对如何对其他模态进行处理的挑战，比如文本，它不像图像那样高维，实际上信号量非常少。

Hannah Fry（07:40） It's not a million numbers in a sentence, is there? 句子里不可能有一百万个数字，对吧？

Pushmeet Kohli（07:42） Yeah, exactly. It's a few words. You can't change those sort of few words and you have to be very cautious in terms of not changing the meaning. And so the approaches that we developed for watermarking text were quite different and distinct from what we use for watermarking high dimensional signals like images and videos and audio even. 是的，没错。这只是几个词。你不能更改这些少数几个词，而且在不改变意思的情况下，你必须非常小心。因此，我们为文本水印开发的方法，与我们用于高维信号（如图像、视频甚至音频）水印的方法完全不同且有明显区分。

Hannah Fry（08:05） But this idea of watermarking, which you guys pioneered, has now been brought into law. It's essential that any generative content within the EU has to have some sort of watermarking. 但是你们开创的这种水印理念，现在已经被纳入法律。在欧盟，任何生成内容都必须有某种形式的水印，这是至关重要的。

Pushmeet Kohli（08:15） I think what regulators and countries around the world have recognized that they want to give users this information as to the origins of the content that they are consuming. And one sort of key technology that is seen as a robust solution for it that can scale is Siddharth Dutta, Chief Executive Officer, SynthID, is the first company to adopt this technology. 我认为全球的监管机构和各国已经意识到，他们希望向用户提供有关他们正在消费的内容来源的信息。而被视为一种可以扩展的稳健解决方案的关键技术是 Siddharth Dutta，SynthID 首席执行官，这是第一家采用该技术的公司。

Hannah Fry（09:00） And Jeremy, in this episode, we're going to be talking about two different applications of watermarking for AI. So you've got text and video and audio and so on, and then you've also got for biological structures and sequences. Is the solution quite similar between the two? Jeremy，在这一集中，我们将讨论水印在人工智能中的两种不同应用。所以你有文本、视频和音频等等，然后你还有生物结构和序列。这两者之间的解决方案是否非常相似？

Jeremy Ratcliff（09:16） Yes, I would say they're motivated by similar principles, and we were able to adopt a lot of the work that had already been done, including using the open source Syntheti text library and just embedding that directly into another system. 是的，我会说他们受到类似原则的驱动，我们能够采用已经完成的许多工作，包括使用开源的 Syntheti 文本库，并将其直接嵌入到另一个系统中。

Hannah Fry（09:25） Right. Not just the same tricks, but sometimes the actual same code. You can sort of pick it up and drop it. 对。不只是同样的技巧，有时甚至是完全相同的代码。你可以算是拿起来就用。

Jeremy Ratcliff（09:32） At least start from the same code and then make some adaptations on top of it. 至少从相同的代码开始，然后在此基础上进行一些调整。

Hannah Fry（09:35） Okay, okay, so I think people wanna sort of understand how this works, because it sounds almost magical that you could have a single sentence and you have embedded some sort of watermark in there that's nothing to do with white space, it's nothing to do with like putting commas in, weird hiding them in the text, but that the words themselves are hiding a record of how they were generated and where they came from. So if it's okay with you, Pishmi, 好的，好的，所以我认为人们想要理解这是如何运作的，因为听起来几乎像魔法一样，你可以有一句话，并且在其中嵌入某种水印，这与空格无关，也与像放置逗号、奇怪地隐藏在文本中无关，但这些词本身隐藏着生成它们的方式以及它们来自哪里的记录。所以，如果你不介意的话，Pishmi，

Pushmeet Kohli（09:59） I thought we might just walk through how this works for text. 我想我们可以简单地演示一下这个是如何处理文本的。

Jeremy Ratcliff（10:02） I think that's probably the easiest one to understand. 我认为那可能是最容易理解的一个。

Hannah Fry（10:05） Okay, so before we get to that, there is some software out there already that you can get online that claims to be able to tell whether the text that you have is generated by AI or not. How is that different from what you guys have created? 好的，所以在我们进入那个之前，网上已经有一些软件声称能够判断你拥有的文本是否是由人工智能生成的。那和你们创建的东西有什么不同呢？

Pushmeet Kohli（10:20） Yeah, so I think the traditional approach that has been there for a long time is to train machine learning models to solve a classification problem, to distinguish between what is generated by a model versus what was captured in the natural world. And this sort of involves basically training this machine learning models over a very large amount of data. When the earlier generations of large language models and these conversational agents came about, you could sort of make out that, oh, this is a large language model, it has certain tells, it has... It's not X, it's Y. It uses the word quietly a bit too much. Yeah, exactly. But as these models have become more and more sophisticated, Thank you. 是的，所以我认为长期以来的传统方法是训练机器学习模型来解决分类问题，以区分由模型生成的内容和现实世界中捕获的内容。这基本上涉及在大量数据上训练这些机器学习模型。当早期的大型语言模型和这些对话代理出现时，你可以大致判断，哦，这是一个大型语言模型，它有某些特征，它有……它不是 X，而是 Y。它过于频繁地使用“quietly”这个词。是的，没错。但随着这些模型变得越来越复杂，谢谢你。

Hannah Fry（11:24） Okay, well let's walk through how the watermarking system works then. So let's do it sort of step by step. So first off, maybe we should start off by how large language models pick the next word 好吧，那我们来看看水印系统是如何工作的。我们一步一步地来。首先，也许我们应该从大型语言模型如何选择下一个词开始讲起。

Pushmeet Kohli（11:36） in a sentence when it's generating text. Yes, so when we are watermarking text, the idea is that these tokens or words are being generated from a large language model. And the large language model essentially has a distribution over which words it can generate. So if I ask you the question, Hannah, what did you have for breakfast today? You can start with the word I, or you could start with the word push me, the addressing me. And these are the options that you have. And if they're equally valid starting points, you have optionality. And this is where text watermarking leverages this optionality by seeing what does the key tell us? 在生成文本的句子中。是的，所以当我们对文本加水印时，想法是这些标记或单词是从大型语言模型生成的。而大型语言模型本质上对它可以生成的单词有一个分布。所以如果我问你这个问题，Hannah，你今天早餐吃了什么？你可以以单词“I”开头，也可以以“push me”开头，即地址指向我。这些是你可选择的选项。如果它们同样是有效的起点，你就有选择的自由。这就是文本水印利用这种选择自由的地方，通过查看密钥告诉我们什么？

Hannah Fry（12:24） Okay, so but that's the point, right, is that sometimes when you have an option for a word, behind the scenes, there is a secret key, which says, bias these words over others. And then when you look back at all of the text together, if you can see those words appearing over and over and over again, you can be confident that this is AI generated. 好的，所以这就是重点，对吧，有时候当你对一个词有选择时，背后会有一个秘密的密钥，它会指示偏向这些词而不是其他词。然后当你回过头来看所有的文本，如果你能看到这些词一次又一次地出现，你就可以确信这是人工智能生成的。

Pushmeet Kohli（12:48） So rather than the words, it's the patterns of those words. So those words specifically, you don't need to be repeated, but the patterns is what the detector sort of leverages. 所以，与其说是这些词，不如说是这些词的模式。所以那些具体的词，你不需要重复，但检测器利用的正是这些模式。

Hannah Fry（12:59） How they appear in sort of chains together. Exactly. Right. Yes. Okay. So you're secretly, right? 它们如何以某种链条形式出现。没错。对。是的。好吧。所以你是秘密地，对吧？

Pushmeet Kohli（13:06） So I mean, it's not that secret, you're sort of talking about it on a podcast, we're going to say. 所以我的意思是，这并不是什么秘密，你在播客上已经在某种程度上谈论它了，我们会这么说。

Hannah Fry（13:09） But you have some code running around in the background, some secret key. Yes. That you can then look at a chunk of text later and say, hang on a second, this looks like it was generated by AI. 但是你有一些代码在后台运行，一些秘密密钥。是的。然后你可以在稍后查看一段文本时说，等一下，这看起来像是由人工智能生成的。

Pushmeet Kohli（13:19） Not only this was generated by AI, but if different AI models are using different keys, we can sort of check whether this was generated by this model or this other model. 不仅这是由人工智能生成的，而且如果不同的人工智能模型使用不同的密钥，我们可以某种程度上检查这是由这个模型还是那个模型生成的。

Hannah Fry（13:31） Okay. So you can tell this is Gemini, this is whatever other model might have. If you have the key. Right, if you have the key. Okay, I see. Okay, so, but if there's a few words that it could be, then you can't use it. So does that mean that some text is un-watermarkable? 好的。所以你可以分辨这是双子座，这是其他模型可能有的东西。如果你有密钥。对，如果你有密钥。好的，我明白了。好的，所以，如果有几个词可能是它生成的，那么你就不能使用它。那是不是意味着有些文本是无法打水印的？

Pushmeet Kohli（13:50） Yes, so if you have a very small, a short text snippet, right? Like, what is the capital of France? It is Paris. So there is very little that we can change there. And so that will not be watermarked. That is a limitation of the watermarking approach in this case. 是的，所以如果你只有一个非常小的、简短的文本片段，对吧？比如，法国的首都是哪里？它是巴黎。所以这里几乎没有什么可以改变的。因此这不会被加上水印。这就是在这种情况下水印方法的一个限制。

Hannah Fry（14:12） Does all of this mean then that students can't cheat on their essays anymore, bluntly? I mean, are we now able to just detect anything that's AI generated? 那么，这是否意味着学生再也不能在论文中作弊了，直截了当地说？我的意思是，我们现在能够检测到任何由人工智能生成的内容吗？

Jeremy Ratcliff（14:22） I think the whole ecosystem as a whole is moving towards watermarking, as you've seen with some of the other labs making their announcements. But that doesn't necessarily mean that they're all going to make their detectors publicly available. And even if you've got a publicly available detector, that can be motivation for people learning how to get around it in the same way that some of these machine learning, classifying-based detection systems are using a whole bunch of examples of texts of things that have been watermarked. Were a detector publicly available, and you could just query it over and over and over again, you might be able to work back to making something that gets around that specific configuration of keys that is presented in the public detector. 我认为整个生态系统整体上正在向水印化发展，正如你在其他一些实验室的公告中看到的那样。但这并不意味着他们都会公开他们的检测器。即使你有一个公开可用的检测器，这也可能成为人们学习如何绕过它的动力，就像一些基于机器学习的分类检测系统利用大量带有水印的文本示例一样。如果有一个公开可用的检测器，而你可以反复查询它，你可能就能够反推出如何绕过公开检测器中所展示的特定密钥配置。

Hannah Fry（15:00） Got you. So we're not at sort of The Podcast. 明白了。 所以我们并不是在某种意义上的播客上。

Pushmeet Kohli（15:24） Yes, so I think in images, the approach is different from the text watermarking approach that I was mentioning. In images, what happens is we take the image, which has not been watermarked, and then there is a neural network which looks at that image and modifies it in a very subtle way. The Podcast is a production of the U.S. Department of Education. And they're both sort of trying to achieve the following. You get an image which is on watermark. The watermark generator injects a very small signal which is imperceptible. So if it is perceptible, we say that's not great. Like the users will see it and that degrades the quality of the image. Then in the middle, there is an adversarial agent which is going to try to make modifications to the image. Might try to shrink the image, zoom in, crop it, rotate it, do many kinds of transformations like add noise and so on. And then the detector has to still detect whether the original image 是的，所以我认为在图像处理中，方法不同于我之前提到的文本水印方法。在图像处理中，发生的情况是我们获取尚未加水印的图像，然后有一个神经网络会查看该图像，并以非常微妙的方式对其进行修改。这个播客是美国教育部的作品。他们都试图实现以下目标：你得到一张未加水印的图像。水印生成器会注入一个非常小的信号，这个信号几乎不可察觉。所以如果它是可察觉的，我们会说这不太好。用户会看到它，从而降低图像的质量。然后在中间，有一个对抗代理会尝试对图像进行修改。可能尝试缩小图像、放大、裁剪、旋转，做各种各样的变换，比如添加噪声等等。然后检测器仍然要检测图像是否是原始图像。

Pushmeet Kohli（16:44） that is coming through is watermarked or not. 传过来的是否带有水印。

Hannah Fry（16:46） Okay. 好的。

Pushmeet Kohli（16:47） And both of them are trained in tandem to make sure that regardless of what the adversary in the middle has done, The watermarks is still detectable. What does this mean for users then? I think the main thing is it's not just about text. It's about all these different modalities. And if you look at how people are using SynthID, like it was really amazing the last few years as SynthID has been launched, I would open my favorite We're a small news website and the reporter would say, well, here's an image that was circulating in the media about this particular house that magically was untouched in the California fires or this image that came out from the Iran war or some other sort of topic. And we have run SynthID on it and detected that this was air generated. 两者都是同时训练的，以确保无论中间的对手做了什么，水印仍然是可检测的。那么，这对用户意味着什么呢？我认为主要的一点是，这不仅仅关乎文本，而是关于所有这些不同的模态。如果你看看人们是如何使用 SynthID 的，就会发现过去几年 SynthID 推出后，这真的非常令人惊讶。我会打开我最喜欢的一个小型新闻网站，记者会说，好吧，这是在媒体上流传的一张图片，关于这座在加州大火中奇迹般未受影响的房子，或者是来自伊朗战争的某张图片，或者是其他某种话题。我们用 SynthID 对它进行了检测，并发现这是 AI 生成的。

Hannah Fry（17:47） Right. So all of a sudden, you can see the AI in places that it definitely shouldn't be. 对。所以突然之间，你可以在那些它绝不应该出现的地方看到人工智能。

Pushmeet Kohli（17:55） Yes. And SynthID being used to actually tackle misinformation in real time and at scale. 是的。而 SynthID 正被用来实际应对实时和大规模的虚假信息。

Hannah Fry（18:06） So then can anyone do what you just did there? Can anyone take an image, some text, some video, run it through SynthID and find out whether it was generated by an AI model? 那么，任何人都可以像你刚才那样做吗？任何人都可以拿一张图片、一段文字、一段视频，通过 SynthID 查看它是否是由 AI 模型生成的吗？

Pushmeet Kohli（18:16） We have made the detection ability embedded in the Gemini app, for instance. So today, if you can go to Gemini, if you ask, I'm looking at this image, tell me if it is AI generated, it can run the SynthID detector. And say, yes, this is something that was generated by a Google image model and so on. And similar sort of abilities now are available by other companies as well who have adopted our models. 例如，我们已经将检测能力嵌入到 Gemini 应用中。所以今天，如果你可以打开 Gemini，如果你问，我在看这张图片，告诉我它是否是 AI 生成的，它可以运行 SynthID 检测器。然后说，是的，这是由 Google 的图像模型生成的。类似的能力现在也可以通过其他采用我们模型的公司获得。

Hannah Fry（18:48） Can each model only detect whether it was generated by that model? Can Gemini only detect Gemini-generated content? 每个模型是否只能检测它自己生成的内容？Gemini 是否只能检测 Gemini 生成的内容？

Pushmeet Kohli（18:55） So people who are injecting the watermark into the content, they have to agree to share the key. Right? If they share the keys, then we have the ability to detect it. Right? So there can be a central service. If you go to the SynthID portal, and if you ask something is generated by is AI generated, it can look at all the keys that have been given to us by partner institutions. And we can detect the content for all those partners as well. 所以那些将水印注入内容的人，他们必须同意共享密钥，对吧？如果他们共享密钥，那么我们就有能力进行检测，对吧？所以可以有一个中央服务。如果你访问 SynthID 门户，并且你想查询某个内容是否由 AI 生成，它可以查看所有合作机构提供给我们的密钥。我们也可以为所有这些合作伙伴检测内容。

Hannah Fry（19:24） Okay, got you. But if a certain lab is like doesn't want to share their key, then you wouldn't be able to. Yeah. Okay, well, Jeremy, let's talk about biology now, because I know that you've come up with this proof of concept system called SynthID Bio, which instead of watermarking, you know, text and audio and video is for biology instead, where you are watermarking AI generated protein sequences and 3D biomolecular structures. Just tell me about those two systems. 好，明白了。但是如果某个实验室不想分享他们的密钥，那么你就无法做到。是的。好吧，Jeremy，我们现在谈谈生物学，因为我知道你已经提出了一个概念验证系统，叫做 SynthID Bio，它不是用于给文本、音频和视频打水印，而是用于生物学，你可以给 AI 生成的蛋白质序列和三维生物分子结构打水印。就给我讲讲这两个系统吧。

Jeremy Ratcliff（19:53） So the release in the upcoming publication covers synthetic biostructure, which is specifically looking at watermarking the predicted protein structures given a sequence. So it builds on top of AlphaFold 3. The second technology is synthetic biosequence, which looks at introducing watermarks into protein sequences themselves. So the strings of amino acids that are present for a sequence. 因此，即将发布的刊物中涉及合成生物结构，特别关注在给定序列的预测蛋白质结构中进行水印标记。它是在 AlphaFold 3 的基础上构建的。第二项技术是合成生物序列，它关注在蛋白质序列本身中引入水印。因此就是针对序列中存在的氨基酸序列进行处理。

Hannah Fry（20:12） So, but those two things are related, right? That you have like, I mean, each folded protein structure is a string of amino acids underneath it. 所以，但是那两件事是相关的，对吧？也就是说，我的意思是，每个折叠的蛋白质结构下面都有一串氨基酸。

Jeremy Ratcliff（20:20） Yeah, so we're basically talking about different versions, maybe of the same type of data, but actually embedding the watermark is very different for the two of them. So for the structure watermarking, We're actually changing the positions of individual atoms. And so you can think about maybe the distance between two atoms changing slightly or the angle between two atoms changing slightly. Well, for synthetic biosequence, we're actually changing the selection of an individual amino acid. So for structure, it's still the same atoms. They're just maybe in a slightly different configuration. Well, for sequence, we're actually changing the content, but maybe not the actual functional meaning of that content. 是的，所以我们基本上在讨论不同版本，也许是同一类型的数据，但实际上在它们之间嵌入水印的方式是非常不同的。对于结构水印，我们实际上是在改变单个原子的位置。所以你可以想象两原子之间的距离略微变化，或者两个原子之间的角度略微变化。而对于合成生物序列，我们实际上是在改变单个氨基酸的选择。对于结构而言，原子还是相同的，它们只是可能处于略微不同的排列中。而对于序列，我们实际上是在改变内容，但可能不改变该内容的实际功能意义。

Hannah Fry（20:52） And what's the point? Why do you want it? 那有什么意义呢？你为什么想要它？

Jeremy Ratcliff（20:56） Yeah, you know, we've thought of a couple different use cases that might be useful being able to say that you have provenance of something being AI generated, and how you might be able to detect if an order going to a DNA synthesis company is something that came from an AI system. 是的，你知道，我们想到了几个不同的使用案例，可能有用的情况是能够说明某物是由人工智能生成的，并且你可能能够检测到送到 DNA 合成公司的订单是否来自 AI 系统。

Hannah Fry（21:10） Because I think that's something that non biologists aren't really aware of, right, that you essentially have, I'm going to call them printers, but where you can send off And say, this is the sequence I want created and they'll do it for you. But I mean, what you're saying here is that it's possible to trick them into printing something hazardous. I'm using printed very loosely here. And that's essentially the problem, right? 因为我认为这是非生物学家不太了解的，对吧，你基本上有，我要称它们为打印机，但你可以发送过去，说这是我想要创建的序列，他们会帮你做。但我的意思是，你在这里说的是，有可能欺骗它们去打印一些有害的东西。我这里使用‘打印’这个词很宽松。这基本上就是问题所在，对吧？

Jeremy Ratcliff（21:31） That's the concern. Yeah, that's one of the concerns. And there's a large body of We have industry groups and academics who focus on how to make that screening regimen more robust. And that's something that we're interested in being able to contribute to. But the primary concern is, would someone be able to acquire DNA that could give them access to being able to generate something in a lab that we don't want them to be able to do? Or maybe it gets around regulation. So could someone order DNA from a company and then bring it to a laboratory and make something like an extinct pandemic, like instinct influenza, for instance? 这是关注点。是的，这是其中一个关注点。而且有大量的研究。我们有行业团体和学术界人士专注于如何使这种筛查方案更加稳健。这是我们希望能够贡献的一部分。但主要的关注点是，是否有人能够获得 DNA，从而使他们能够在实验室中生成我们不希望他们能够做的东西？或者可能规避监管。那么有人是否可以从公司订购 DNA，然后带到实验室去制作类似灭绝性流行病的东西，比如天生的流感病毒？

Hannah Fry（22:03） Okay, which I would say would be bad. 好吧，我会说那会很糟糕。

Jeremy Ratcliff（22:05） Generally, yes. 一般来说，是的。

Hannah Fry（22:06） Overall bad. Okay. And then at least then, if these companies are able to detect whether something is AI, it sort of puts an extra safeguard in place, an extra sort of stop in place before they just can continue on. 总体来说很糟。还可以。至少，如果这些公司能够检测出某些东西是否是人工智能，这就相当于设置了额外的保障措施，在他们可以继续之前多了一个额外的阻止措施。

Jeremy Ratcliff（22:19） Yeah, and something that if you detect the watermark, you have confidence that this was derived from a system that has built-in safety guard rails versus either maybe another AI model or something that comes from nature. 是的，还有一种情况是，如果你检测到水印，你会有信心认为这是来源于一个内置安全防护措施的系统，而不是可能是另一个 AI 模型或某种自然产生的东西。

Hannah Fry（22:29） Okay, and what kind of safety systems do those companies have in place at the moment to make sure that they're not making something really dangerous? 好的，那么这些公司目前有哪些安全系统，以确保他们不会制造出真正危险的东西？

Jeremy Ratcliff（22:35） So the synthesis companies, largely what they do is they take an order from an individual where they've been able to verify something about their identity. So most of them have a process in place that says, I am an academic, this is my university affiliation, I am actually who I say I am, and the specific PO box that you're sending it to is for a laboratory. I'm not just a random person in a basement that wants it. And then they take those orders and they compare the specific content of the order to a database of known hazardous things. And they check that specific submission against that database using a couple different algorithms. And if something matches, then they either just block the order and say, we can't synthesize this, or they'll go back to the original individual and try to find out what motivation they have for ordering it and whether they've got, say, requisite licensing. And the risk we have with these AI systems, as shown by some other academics, 所以这些合成公司，他们主要做的事情是接受个人的订单，而这些个人的身份已经得到了某种验证。大多数公司都有一套流程，比如说，我是学术人员，这里是我的大学隶属机构，我确实是我声称的那个人，而且你要寄送的这个邮政信箱是用于实验室的。我并不是地下室里想要私自获取的人。然后他们会拿这些订单，将订单的具体内容与已知危险物质的数据库进行比对，并使用几种不同的算法检查该订单提交内容是否与数据库匹配。如果匹配，他们要么直接拦截订单并表示我们不能合成这个物质，要么会回访最初的个人，询问其下单的动机，以及是否拥有必要的许可。正如其他一些学者所展示的，我们在使用这些 AI 系统时存在的风险，

Jeremy Ratcliff（23:25） Is that you can make something that in sequence space is very different than something that's present in that pathogen database, but might fold into the thing that is of concern. 也就是说，你可以制造出在序列空间上与病原体数据库中存在的东西非常不同的东西，但它可能折叠成那个令人关注的结构。

Hannah Fry（23:34） So the string of amino acids looks innocent, but once it's created a natural protein could be really harmful. 所以这串氨基酸看起来很无害，但一旦它形成了天然蛋白质，可能会非常有害。

Jeremy Ratcliff（23:40） Yeah, and it could have the same behavior as something that's present in the database of restricted orders. 是的，它可能会表现得和数据库中受限制订单里存在的某些东西一样。

Hannah Fry（23:45） And their current systems wouldn't be able to catch it. 而他们目前的系统无法发现它。

Jeremy Ratcliff（23:47） Definitely the concern is that, and especially as these systems get better and better, you might be able to get something even further away in sequence space that might get around some of the existing protections. 确实，令人担忧的是，尤其是随着这些系统越来越先进，你可能能够获取在序列空间中更遥远的东西，从而可能绕过一些现有的保护措施。

Hannah Fry（23:57） Something really wacky in this ribbon of amino acids that still can fold into something harmful. To basically sneak under their detection system. 在这条氨基酸链中有些非常古怪的东西，它们仍然可以折叠成有害的东西。基本上是为了偷偷绕过他们的检测系统。

Jeremy Ratcliff（24:06） Exactly. And you can cut and paste that into another sequence. So you can imagine like if maybe there's one portion of an order that would be blocked, you could cut and paste something of concern into that that's very far away from the restricted database. And then in the laboratory yourself, you just put it back into where it originally came from. 没错。你可以把它剪切并粘贴到另一个序列中。所以你可以想象一下，如果订单的某一部分会被阻止，你可以把有问题的部分剪切并粘贴到远离受限数据库的地方。然后在实验室里，你只需要把它放回最初的位置。

Hannah Fry（24:24） Okay, I see. And then the idea of what you're doing here with the watermarking is not necessarily to say you're going to be able to detect anything that's potentially harmful, but at the very least you can say this is AI generated. Be careful because when you're comparing it against your existing database, it might not look like something that's already on there. 好的，我明白了。然后，你在这里做水印的想法，不一定是说你能够检测到任何潜在有害的东西，但至少你可以说这是 AI 生成的。要小心，因为当你将它与现有数据库进行比较时，它可能看起来不像已经存在的内容。

Jeremy Ratcliff（24:42） And you can say which system it came from. And because you as a DNA synthesis company trust this AI system for reasons that go beyond the watermark, you can have confidence that this was generated through this method. 你可以说明它来自哪个系统。而且因为你作为一家 DNA 合成公司，出于超越水印的原因信任这个 AI 系统，你可以有信心这是通过这种方法生成的。

Hannah Fry（24:53） Talk me through the protein design process then here. So how do you get the watermark into the system in the same way as we described with text and images? 在这里给我讲讲蛋白质设计的过程。那么你如何像我们之前用文本和图像描述的那样，将水印输入系统呢？

Jeremy Ratcliff（25:01） Yeah, so it actually, maybe somewhat fortuitous, that the approach that ProteinMPNN, which is this structure to sequence model uses, is actually pretty analogous to the way that transformer-based models generate text. So ProteinMPNN is a third-party tool. It's not something that Google developed. It's been released out in the world for a number of years, and it's almost the opposite of AlphaFold. So rather than going from a sequence to a structure, it goes from a structure to a sequence. And that's an important part in a protein design pipeline where you are originally choosing your target based off of how you want them to interact in three-dimensional space. This is a model that just takes that representation and then creates a predicted sequence in order to fold into that specific configuration. 是的，所以实际上，这可能有点幸运，ProteinMPNN 使用的这种结构到序列的模型方法，实际上与基于 transformer 的模型生成文本的方式非常相似。ProteinMPNN 是一个第三方工具，而不是谷歌开发的。它已经公开发布了多年，它几乎与 AlphaFold 完全相反。AlphaFold 是从序列到结构，而它是从结构到序列。这在蛋白质设计流程中是一个重要环节，因为你最初是根据蛋白质在三维空间中的相互作用选择目标。这是一个模型，它只是利用该表示，然后生成一个预测序列，以便折叠成该特定结构。

Hannah Fry（25:41） Because that's an important point, right? That you might have these extremely complex folded structures, but that each protein is constructed from like a ribbon of amino acids, a string of amino acids. And that's where the analogy comes from, 因为那是一个重要的点，对吧？你可能会有这些极其复杂的折叠结构，但每个蛋白质都是由一条氨基酸带构成的，一串氨基酸。这就是这个类比的来源，

Jeremy Ratcliff（25:53） string of amino acids like a string of text. Yep. And so what you almost see is that the, When you're folding a protein, there are locations where there can be swaps between individual amino acids, maybe ones that are similar in certain properties like leucine and isoleucine are two that are quite similar. And so what we're taking advantage of within SynthID Biosequence is that you can introduce watermarks through the selections of individual amino acids that are likely to have both maintain the same structure and therefore have similar function. 像一串文字一样的氨基酸链。对的。所以你几乎可以看到的是，当你折叠蛋白质时，有些位置可以在个别氨基酸之间进行交换，可能是那些在某些性质上相似的氨基酸，比如亮氨酸和异亮氨酸就是两种相当相似的氨基酸。而我们在 SynthID Biosequence 中利用这一点，是通过选择个别氨基酸来引入水印，这些氨基酸既可能保持相同的结构，因此具有类似的功能。

Hannah Fry（26:19） But hang on, how can you be sure? I mean, you said that you can make the swap and it doesn't matter, but can you be sure that the swap doesn't matter? 但是等等，你怎么能确定呢？我的意思是，你说你可以进行交换而且无所谓，但你能确定交换真的无所谓吗？

Pushmeet Kohli（26:25） Yeah, so that's what we specifically test in the process. So the whole idea of this research was to inject the watermark and ensure that the generated sequence, amino acid sequence in this case, that the watermark is not affected by the watermark. Builds the protein, has the same function, or retains the function that we were trying to design for. And that's what is very cool about it, that we have now in existence watermarked proteins. These are real things, this is not in simulation, these are real things which do stuff, but which are watermarked and will always be detectable. 是的，所以这就是我们在过程中具体测试的内容。整个研究的思路是注入水印，并确保生成的序列——在这里是氨基酸序列——不会因水印而受到影响。构建的蛋白质具有相同的功能，或者保留我们试图设计的功能。这一点非常酷，因为我们现在已经有了带水印的蛋白质。这些是真实存在的东西，不是在模拟中，这是能够实际发挥作用的真实蛋白质，同时带有水印，并且始终可以被检测到。

Jeremy Ratcliff（27:08） And importantly, from our own laboratory experiments, they don't change the function at all. So we made protein binders. So we made the things that stick. Oh, you physically made them? Yes. We made them. We tested them in a laboratory. And some of the measurements you can get from making protein binders are things like hit rates, so of the number of designs that you send in the lab, how many of them actually bind. You can look for how well something binds. And across both those measures, things that were watermarked and watermarked under two different schemes versus protein binders that weren't watermarked had near identical hit rates, 而且，重要的是，根据我们自己的实验室实验，它们根本不会改变功能。所以我们制作了蛋白质结合物。所以我们制作了那些可以粘附的东西。哦，你们亲自制作的吗？是的，我们制作的。我们在实验室里测试了它们。通过制作蛋白质结合物，你可以获得的一些测量数据包括命中率，也就是你送入实验室的设计中，有多少实际上能结合。你可以观察它结合得有多好。在这两种测量中，无论是经过水印处理的（且使用两种不同方案）还是未经过水印处理的蛋白质结合物，其命中率几乎相同。

Hannah Fry（27:36） near identical quantitative measures of binding. Because you'd expect to lose maybe a tiny bit, right? 结合的定量测量几乎完全相同。因为你会期望可能会损失一点点，对吧？

Jeremy Ratcliff（27:43） Potentially, I mean, I guess, Admittedly, I think before we got the wet lab data, I was a little bit skeptical about how well this was going to work. And I think it blew all of our minds actually just how easy it was. But proving it in biology was like, I think, something that took us all maybe a little bit by surprise. 潜在地，我是说，我猜，坦白说，我觉得在我们得到湿实验室的数据之前，我对这个方法能否奏效有点怀疑。我认为它其实完全超出了我们的想象，就有多么简单。但在生物学上证明它，我认为可能让我们所有人都有点意外。

Hannah Fry（27:57） I know this is proof of concept at the moment. You're sort of demonstrating that it works and that it's possible. Is the idea that in the future, any lab would be able to read your watermark? 我知道这目前只是概念验证。你们有点在展示它是可行的，是可能的。未来的想法是，任何实验室都能够读取你的水印吗？

Jeremy Ratcliff（28:08） Yeah, and I think that's the eventual goal. Or maybe I wouldn't even necessarily frame it as our watermark. Maybe it's the technology other people can use. We know that there has to be a number of different players who would be part of actually operationalizing this. So model developers, people making either novel tools or systems to be able to generate new proteins. They're going to have to be sort of on board of being able to integrate watermarking within their own schemes. And because we're open sourcing the code, this is something that they can do without even necessarily needing to coordinate with us. And then the synthesis side, there'll have to be some ability to exchange keys and exchange other details about the watermarking between the model providers and the DNA synthesis company themselves. And so these are a couple of different coordinations that need to happen. From our side, we know that there is additional engineering headroom that you can move into 是的，我认为那确实是最终目标。或者，也许我甚至不一定会把它称作我们的水印。也许它是其他人可以使用的技术。我们知道，实际实现这一点需要有多个不同的参与者。所以，包括模型开发者、制作新工具或系统以生成新蛋白质的人。他们必须能够将水印集成到自己的方案中。而且因为我们开源了代码，他们可以在不必与我们协调的情况下做到这一点。同时在合成方面，也必须有能力在模型提供者和 DNA 合成公司之间交换密钥以及水印的其他细节。所以这些都是需要发生的几种不同协调。从我们的角度来看，我们知道还有额外的工程空间可以利用。

Jeremy Ratcliff（28:52） to make the watermark both detectable and potentially a little bit easier to embed. We know that from some of the ongoing work. And this is the type of... Tim Weissman, CEO, The Podcast. 使水印既可检测，又可能稍微更容易嵌入。我们从一些正在进行的工作中知道这一点。这就是……蒂姆·韦斯曼，播客公司首席执行官。

Hannah Fry（29:06） Is it the same story with the text? Would this be able to detect anything universally, or is it specific to the particular key that's used? 这和文本的情况一样吗？这能检测到任何东西吗，还是只针对使用的特定密钥？

Jeremy Ratcliff（29:16） So if someone were to take the implementation that we're making publicly available and integrate it in their system, so long as they're able to share the key as well as the length of context, that's another area that you can change how much of the preceding context matters for watermarking. So long as you can share those two values, you'd be able to detect them coming out of any system. 所以，如果有人采用我们公开提供的实现并将其集成到他们的系统中，只要他们能够共享密钥以及上下文长度，那就是另一个可以改变前置上下文对水印影响程度的领域。只要你能够共享这两个值，你就能检测它们从任何系统中出来。

Hannah Fry（29:34） Is this out there working already? What stage are you at right now? 这个已经在运行了吗？你们现在处于什么阶段？

Jeremy Ratcliff（29:38） So for us, what we've been able to do with this publication is more or less have a proof of concept that we're going to open source the technology that allows people to do the watermarking. So this is a slightly different one than the way that we can watermark content coming out of Google. Tim Cynova, Chief Executive Officer, The Podcast. The organization that people will be ordering proteins from, but at least being sort of the catalyst so that this can get implemented from the various services that are currently out in the world. That's sort of where we see our role at the moment. 所以对我们来说，通过这次出版物，我们能够做的事情差不多是有一个概念验证，即我们将开源允许人们进行水印处理的技术。这与我们给谷歌输出内容打水印的方式略有不同。Tim Cynova，《The Podcast》首席执行官，那个大家将会订购蛋白质的组织，但至少作为一种催化剂，使其能够在目前世界上各种服务中得到实现。这大致就是我们目前所看到的角色。

Hannah Fry（30:23） And what's their reaction when you talk to the people who are the ones that will be sort of printing the proteins, making the proteins for real? What's their reaction when you talk to them? 当你与那些真正负责打印蛋白质、制造蛋白质的人交谈时，他们的反应是什么？当你和他们交谈时，他们的反应是什么？

Jeremy Ratcliff（30:31） Yeah, you know, I think maybe this is just a reflection of who I am. I'm generally quite skeptical of things, like that's just sort of in my nature. They've all been so excited, maybe even more than I think we might have anticipated. Which has been, I think, really galvanizing for us as we continue to go through sort of the last few steps around what it means to take this out into the real world. So we're, I think, bullish on the amount of, at least, interest that we might be able to get. 是啊，你知道，我觉得也许这只是反映了我自己是谁。我通常对事情比较怀疑，这大概就是我的本性。他们都非常兴奋，甚至可能比我们预期的还要兴奋。这对我们来说，我认为，是一种真正的激励，因为我们在继续完成将其推向现实世界的最后几个步骤。所以我认为，至少对于我们可能获得的兴趣数量，我们是持乐观态度的。

Pushmeet Kohli（30:53） So, I mean, one thing I've found very remarkable about the bio community is how cognizant they are of not just the threats today, but the threats of tomorrow. And so they have been extremely receptive of the technology because they see the challenges every day that they are getting these orders for gene synthesis, which can create proteins, and they have these filters that can catch problematic orders, but they know that those are not imperfect and more work needs to be done to develop them and they want to work 所以，我的意思是，我发现生物界非常值得注意的一点是，他们不仅意识到今天的威胁，也意识到未来的威胁。因此，他们对这项技术非常接受，因为他们每天都在面对挑战，他们收到的基因合成订单可以产生蛋白质，他们有这些过滤机制可以捕捉有问题的订单，但他们知道这些机制并不完美，还需要做更多工作来改进它们，而他们也愿意去努力改进

Hannah Fry（31:40） Dr. Amit Bhandari, PhD, PhD, PhD, PhD 阿米特·班达里博士，博士，博士，博士，博士

Jeremy Ratcliff（31:56） There was a memo that came out, I think it was two months ago or so, that sort of laid out vision as a whole, plus Isomorphic Labs of what we're thinking about bioresilience. And that matched a couple different efforts across pillars that are actually rooted in the UK's biological security strategy, so on prevent, detect, and respond. Our team has a couple different efforts under that, and broadly, we're looking at how we can leverage AI to reduce biological risk. It's focused both on natural threats and on sort of AI-enhanced augmented threats. We've got some projects that map really specifically to one area. So I think this synthetic bio is a good example where we're really thinking about AI-enhanced AI designs and what that might mean for being able to do pattern detection, We've got some other concepts that are much more in the natural threat space, and then some that sort of map between the both. 大约两个月前，有一份备忘录发布出来，我记得大概是两个月前左右，它概述了整体的愿景，以及 Isomorphic Labs 关于我们对生物韧性的思考。这与跨多个支柱的不同努力相一致，而这些努力实际上根植于英国的生物安全战略，包括预防、检测和应对。我们的团队在这方面有几个不同的项目，总体上，我们在研究如何利用人工智能来降低生物风险。这既关注自然威胁，也关注某种人工智能增强的威胁。我们有一些项目非常具体地对应某个领域。所以我认为这个合成生物是一个很好的例子，我们确实在思考人工智能增强的人工智能设计，这可能意味着能够进行模式检测。我们还有一些概念更多地涉及自然威胁领域，还有一些概念则在两者之间对应。

Jeremy Ratcliff（32:39） So, sort of our theory of change is that if you make biology less useful for someone who's trying to do something malicious, then that in and of itself can prevent them from using it in the first case. So for us, if we're able to make new capabilities and tools that make our entire public health system more robust, or make it easier for epidemiologists to identify an outbreak, that can in and of itself make an outbreak less likely. 所以，我们的变化理论某种程度上是，如果你让生物学对试图做恶意事情的人来说变得不那么有用，那么这本身就可以防止他们在第一时间使用它。对于我们来说，如果我们能够开发出新的能力和工具，使我们的整个公共卫生系统更强大，或者使流行病学家更容易识别疫情爆发，这本身就可以降低疫情爆发的可能性。

Hannah Fry（33:02） Because you want the good side of this, right? You want like the benefits of it, but you don't want it to come along with all of the potential downsides. 因为你想要它的好处，对吧？你想要它的益处，但你不想要它伴随所有潜在的缺点。

Pushmeet Kohli（33:09） Absolutely, absolutely. And I think AI will have immense positive impacts in human health and understanding of biology at large. And I mean, it's already happening around us, right? Isomorphic Labs and many other sort of companies who are leveraging AI for drug discovery, understanding human health and so on. But at the same time, there will be problematic use cases that will be enabled and we need all the controls and all the sort of measures that we can place to make sure that those tasks are difficult or become infeasible. 绝对，绝对。我认为人工智能将在人类健康和对生物学的整体理解方面产生巨大的积极影响。我的意思是，这种情况已经在我们周围发生了，对吧？Isomorphic Labs 和许多其他利用人工智能进行药物发现、理解人类健康等的公司。但与此同时，也会出现一些有问题的使用案例，我们需要采取所有控制措施和各种手段，确保这些任务变得困难或者变得不可行。

Hannah Fry（33:48） Just going back to the landscape of digital media for a moment, because I mean, at the moment, I think this stuff is quite fragmented. Do you think that we will get to a point where there is a central space that you can go to that will just tell you whether something is AI generated or not? 只是回到数字媒体的格局一会儿，因为我的意思是，目前我认为这些东西相当分散。你认为我们会到达一个地步，有一个中央空间，你可以去那里，它会直接告诉你某些东西是否是由人工智能生成的吗？

Pushmeet Kohli（34:04） I think the field is moving towards that. There is overall sort of industry alignment on the need for provenance solutions where companies have agreed on a standard of making sure that when there are edits or when there is generative AI, like sort of placing that information alongside the file. The issue with that is that metadata can be sort of stripped off, which is why we need strong binding, which what watermarks provide. So by combining these approaches and by building a solution that works for everyone. I think we will be able to get to a standard. But I think like progress is being made on that, but it just takes time. 我认为这个领域正朝着那个方向发展。整个行业在溯源解决方案的需求上总体上达成了一种共识，公司们同意采用一个标准，确保当有编辑或生成式人工智能时，将这些信息放在文件旁边。问题在于元数据可能会被去掉，这就是为什么我们需要强绑定，而这正是水印提供的。所以，通过结合这些方法并构建一个适用于所有人的解决方案，我认为我们将能够达到一个标准。但我认为，这方面的进展正在进行中，只是需要时间。

Hannah Fry（34:58） But this also, I guess, same question for the biological side of things. Is that the aim then that there will be this industry standard at some point that everybody is using? 但我想，对生物方面来说也是同样的问题。那么目标是不是有朝一日会有一个行业标准，大家都在使用？

Jeremy Ratcliff（35:09） There's a lot of things, and we even note this in the discussion, where we know that there's engineering headroom to be able to move into, both in the way that you're calculating G-values and introducing the watermark. But at its surface, we do sort of believe that watermarking embedded in an imperceptible way within the sequences themselves is likely to be one of the best ways forward for being able to identify the provenance of AI-generated sequences. 有很多事情，我们甚至在讨论中也注意到这一点，我们知道在工程上有余地可以进一步推进，无论是在你计算 G 值的方式上，还是在引入水印方面。但表面上，我们确实认为，将水印以不可察觉的方式嵌入序列本身，可能是识别 AI 生成序列来源的最佳方法之一。

Hannah Fry（35:32） I do also wonder though whether there's a bit of a game of cat and mouse going on here, right? Because the more universal a system becomes, the more sort of that it's like it's clear what the rules are and how it's implemented. Does it not become easier for somebody to come along with another system that is able to undo it? 我也确实想知道，这里是否有点猫捉老鼠的游戏，对吧？因为一个系统越是通用，就越明显它的规则是什么以及如何实施。这样是不是更容易有人提出另一个系统来推翻它呢？

Pushmeet Kohli（35:49） Yes, so I think this is very much a risk, which is why I think it's really important for us to have these measures where you have these secret keys with which we can embed watermarks in the signal itself, right? The Podcast. Right? And destroy the original sort of capability of the task that you had designed the thing for. 是的，所以我认为这确实是一个风险，这就是为什么我认为我们必须采取这些措施非常重要，你拥有这些秘密密钥，可以用它们在信号本身中嵌入水印，对吧？播客，对吧？并破坏你为该任务设计的原始能力。

Hannah Fry（36:30） Like it's so embedded within it that there's no way to undo it. Yes. But I guess it is, as you said, this is not necessarily the final way of doing things. This is sort of early days. 就像它已经深深嵌入其中，根本无法撤销。是的。但我想正如你所说，这不一定是做事的最终方式。这只是早期阶段。

Jeremy Ratcliff（36:40） The fact that you can have like a biological object, right? Like a sort of, right down at that level, that contains within it the story of where it came from. It's pretty incredible. And I guess I would say we're not the first ones to do watermarks, but we're the first ones to our knowledge to both show imperceptibility and function preservation, and including in vitro and sort of lab-based results. 你可以拥有一个生物对象，对吧？就像在那个层面上，它内部包含了它来源的故事。这相当不可思议。我想我会说，我们不是第一个做水印的人，但据我们所知，我们是第一个同时展示不可察觉性和功能保留的人，包括体外和实验室的结果。

Hannah Fry（37:03） Absolutely amazing. Really, really incredible stuff. Thank you both so much for joining me. That was amazing. Thank you. Words like guardrails and safety, they get thrown around a lot when it comes to AI. But this right here, this is concrete proof of this lab putting its money where its mouth is. They pioneered the technology to watermark AI generated content well before most other labs were thinking about it. They proved it was scalable, that it wouldn't impact on the quality or speed of the output. And now their ideas have been embedded within regulation. But rather than resting on their laurels, they are already looking ahead to what the next threats are and how they can help to build a world that is able to harness the power and potential of this technology without allowing space for the harms to take hold. And they are doing that before the threats fully materialize. The future, as it turns out, will come with the certificate of authenticity. 绝对令人惊叹。真的，真的非常不可思议。非常感谢你们俩加入我。这真是太棒了。谢谢你们。像“护栏”和“安全”这样的词，在谈论人工智能时经常被提及。但就在这里，这就是这个实验室“言行一致”的具体证据。他们在大多数其他实验室还在思考之前，就率先开发出了给 AI 生成内容加水印的技术。他们证明了它是可扩展的，并且不会影响输出的质量或速度。现在，他们的想法已经被纳入到监管中。但他们并没有就此自满，而是已经在展望下一个威胁是什么，以及他们如何帮助建立一个能够利用这项技术的力量和潜力，同时不让其带来伤害的世界。而他们是在威胁完全显现之前就采取行动。事实证明，未来将会带有“真实性证书”。

Hannah Fry（37:57） You have been listening to Google DeepMind: The Podcast with me, Professor Hannah Fry. We have plenty more to come on this series, but in the meantime, check out our other episodes and we will see you very soon. 你一直在和我一起收听，汉娜·弗莱教授。本系列还有很多内容，不过在此期间，看看我们的其他节目，我们很快再见。