app.py

from collections.abc import Sequence
import random
from typing import Optional, List, Tuple

import gradio as gr
import spaces
import torch
from transformers import (
    AutoModelForCausalLM,
    AutoTokenizer,
    BayesianDetectorModel,
    SynthIDTextWatermarkingConfig,
    SynthIDTextWatermarkDetector,
    SynthIDTextWatermarkLogitsProcessor,
)

# If the watewrmark is not detected, consider the use case. Could be because of
# the nature of the task (e.g., fatcual responses are lower entropy) or it could
# be another

_MODEL_IDENTIFIER = 'google/gemma-2b-it'
_DETECTOR_IDENTIFIER = 'google/synthid-spaces-demo-detector'

_PROMPTS: Tuple[str] = (
    'Write an essay about my pets, a cat named Mika and a dog named Cleo.',
    '',
    '',
)

_TORCH_DEVICE = (
    torch.device("cuda:0") if torch.cuda.is_available() else torch.device("cpu")
)
_ANSWERS: List[Tuple[str, str]] = []

_WATERMARK_CONFIG_DICT = dict(
    ngram_len=5,
    keys=[
        654,
        400,
        836,
        123,
        340,
        443,
        597,
        160,
        57,
        29,
        590,
        639,
        13,
        715,
        468,
        990,
        966,
        226,
        324,
        585,
        118,
        504,
        421,
        521,
        129,
        669,
        732,
        225,
        90,
        960,
    ],
    sampling_table_size=2**16,
    sampling_table_seed=0,
    context_history_size=1024,
)

_WATERMARK_CONFIG = SynthIDTextWatermarkingConfig(
    **_WATERMARK_CONFIG_DICT
)

tokenizer = AutoTokenizer.from_pretrained(
    _MODEL_IDENTIFIER, padding_side="left"
)
tokenizer.pad_token_id = tokenizer.eos_token_id

model = AutoModelForCausalLM.from_pretrained(_MODEL_IDENTIFIER)
model.to(_TORCH_DEVICE)

logits_processor = SynthIDTextWatermarkLogitsProcessor(
    **_WATERMARK_CONFIG_DICT,
    device=_TORCH_DEVICE,
)

detector_module = BayesianDetectorModel.from_pretrained(_DETECTOR_IDENTIFIER)
detector_module.to(_TORCH_DEVICE)

detector = SynthIDTextWatermarkDetector(
    detector_module=detector_module,
    logits_processor=logits_processor,
    tokenizer=tokenizer,
)


@spaces.GPU
def generate_outputs(
    prompts: Sequence[str],
    watermarking_config: Optional[SynthIDTextWatermarkingConfig] = None,
) -> Tuple[Sequence[str], torch.Tensor]:
  tokenized_prompts = tokenizer(
      prompts, return_tensors='pt', padding="longest"
  ).to(_TORCH_DEVICE)
  input_length = tokenized_prompts.input_ids.shape[1]
  output_sequences = model.generate(
      **tokenized_prompts,
      watermarking_config=watermarking_config,
      do_sample=True,
      max_length=500,
      top_k=40,
  )
  output_sequences = output_sequences[:, input_length:]
  detections = detector(output_sequences)
  return (
      tokenizer.batch_decode(output_sequences, skip_special_tokens=True),
      detections
  )


with gr.Blocks() as demo:
  gr.Markdown(
    '''
    # Using SynthID Text in your Generative AI projects

    [SynthID][synthid] is a Google DeepMind technology that watermarks and
    identifies AI-generated content by embedding digital watermarks directly
    into AI-generated images, audio, text or video.

    SynthID Text is an open source implementation of this technology available
    in Hugging Face Transformers that has two major components:

    *   A [logits processor][synthid-hf-logits-processor] that is
        [configured][synthid-hf-config] on a per-model basis and activated when
        calling `.generate()`; and
    *   A [detector][synthid-hf-detector] trained to recognized watermarked text
        generated by a specific model with a specific configuraiton.

    This Space demonstrates:

    1.  How to use SynthID Text to apply a watermark to text generated by your
        model; and
    1.  How to identify that text using a ready-made detector.

    Note that this detector is trained specifically for this demonstration. You
    should maintain a specific watermarking configuration for every model you
    use and protect that configuration as you would any other secret. See the
    [end-to-end guide][synthid-hf-detector-e2e] for more on training your own
    detectors, and the [SynthID Text documentation][raitk-synthid] for more on
    how this technology works.

    ## Applying a watermark

    Practically speaking, SynthID Text is a logits processor, applied to your
    model's generation pipeline after [Top-K and Top-P][cloud-parameter-values],
    that augments the model's logits using a pseudorandom _g_-function to encode
    watermarking information in a way that balances generation quality with
    watermark detectability. See the [paper][synthid-nature] for a complete
    technical description of the algorithm and analyses of how different
    configuration values affect performance.

    Watermarks are [configured][synthid-hf-config] to parameterize the
    _g_-function and how it is applied during generation. The following
    configuration is used for all demos. It should not be used for any
    production purposes.

    ```json
    {
        "ngram_len": 5,
        "keys": [
            654, 400, 836, 123, 340, 443, 597, 160,  57,  29,
            590, 639,  13, 715, 468, 990, 966, 226, 324, 585,
            118, 504, 421, 521, 129, 669, 732, 225,  90, 960
        ],
        "sampling_table_size": 65536,
        "sampling_table_seed": 0,
        "context_history_size": 1024
    }
    ```

    Watermarks are applied by initializing a `SynthIDTextWatermarkingConfig`
    and passing that as the `watermarking_config=` parameter in your call to
    `.generate()`, as shown in the snippet below.

    ```python
    from transformers import (
        AutoModelForCausalLM,
        AutoTokenizer,
        SynthIDTextWatermarkingConfig,
    )

    # Standard model and tokenizer initialization
    tokenizer = AutoTokenizer.from_pretrained('repo/id')
    model = AutoModelForCausalLM.from_pretrained('repo/id')

    # SynthID Text configuration
    watermarking_config = SynthIDTextWatermarkingConfig(...)

    # Generation with watermarking
    tokenized_prompts = tokenizer(["your prompts here"])
    output_sequences = model.generate(
        **tokenized_prompts,
        watermarking_config=watermarking_config,
        do_sample=True,
    )
    watermarked_text = tokenizer.batch_decode(output_sequences)
    ```

    ## Try it yourself.

    Lets use [Gemma 2B IT][gemma] to help you understand how watermarking works.

    Using the text boxes below enter up to three prompts then click the generate
    button. An example is provided to help get you started, but the cells are
    fully editable.

    Gemma will then generate watermarked and non-watermarked responses for each
    non-empty prompt you provided.

    [cloud-parameter-values]: https://cloud.google.com/vertex-ai/generative-ai/docs/learn/prompts/adjust-parameter-values
    [gemma]: https://huggingface.co./google/gemma-2b
    [raitk-synthid]: https://ai.google.dev/responsible/docs/safeguards/synthid
    [synthid]: https://deepmind.google/technologies/synthid/
    [synthid-hf-config]: https://huggingface.co./docs/transformers/v4.46.0/en/internal/generation_utils#transformers.SynthIDTextWatermarkingConfig
    [synthid-hf-detector]: https://huggingface.co./docs/transformers/v4.46.0/en/internal/generation_utils#transformers.BayesianDetectorModel
    [synthid-hf-detector-e2e]: https://github.com/huggingface/transformers/tree/v4.46.0/examples/research_projects/synthid_text/detector_training.py
    [synthid-hf-logits-processor]: https://huggingface.co./docs/transformers/v4.46.0/en/internal/generation_utils#transformers.SynthIDTextWatermarkLogitsProcessor
    [synthid-nature]: https://www.nature.com/articles/s41586-024-08025-4
    '''
  )
  prompt_inputs = [
      gr.Textbox(value=prompt, lines=4, label='Prompt')
      for prompt in _PROMPTS
  ]
  generate_btn = gr.Button('Generate')

  with gr.Column(visible=False) as generations_col:
    gr.Markdown(
      '''
      ## Human recognition of watermarked text

      The primary goal of SynthID Text is to apply a watermark to generated text
      without affecting generation quality. Another way to think about this is
      that generated text that carries a watermark should be imperceptible to
      you, the reader, but easily perceived by a watermark detector.

      The responses from Gemma are shown below. Use the checkboxes to mark which
      responses you think are the watermarked, then click the "reveal" button to
      see the true values.

      The [research paper][synthid-nature] has an in-depth study examining human
      perception of watermarked versus non-watermarked text.

      [synthid-nature]: https://www.nature.com/articles/s41586-024-08025-4
      '''
    )
    generations_grp = gr.CheckboxGroup(
        label='All generations, in random order',
        info='Select the generations you think are watermarked!',
    )
    reveal_btn = gr.Button('Reveal', visible=False)

  with gr.Column(visible=False) as detections_col:
    gr.Markdown(
      '''
      ## Detecting watermarked text

      The only way to properly detect watermarked text is with a trained
      classifier. This Space uses a pre-trained classifier hosted on Hugging Face
      Hub. For production uses you will need to train your own classifiers to
      recognize your watermarks. A [Bayesian detector][synthid-hf-detector] is
      provided in Transformers, along with an
      [end-to-end example][synthid-hf-detector-e2e] of how to train one of these
      detectors.

      You can see how your guesses compared to the actual results below. As
      above, the responses are displayed in checkboxes. If the box is checked,
      then the text carries a watermark. Your correct guesses are annotated with
      the "Correct" prefix.

      [synthid-hf-detector]: https://huggingface.co./docs/transformers/v4.46.0/en/internal/generation_utils#transformers.BayesianDetectorModel
      [synthid-hf-detector-e2e]: https://github.com/huggingface/transformers/tree/v4.46.0/examples/research_projects/synthid_text/detector_training.py
      '''
    )
    revealed_grp = gr.CheckboxGroup(
        label='Ground truth for all generations',
        info=(
            'Watermarked generations are checked, and your selection are '
            'marked as correct or incorrect in the text.'
        ),
    )
    gr.Markdown(
      '''
      ## Limitations

      SynthID Text watermarks are robust to some transformations, such as
      cropping pieces of text, modifying a few words, or mild paraphrasing, but
      this method does have limitations.

      - Watermark application is less effective on factual responses, as there
        is less opportunity to augment generation without decreasing accuracy.
      - Detector confidence scores can be greatly reduced when an AI-generated
        text is thoroughly rewritten, or translated to another language.

      SynthID Text is not built to directly stop motivated adversaries from
      causing harm. However, it can make it harder to use AI-generated content
      for malicious purposes, and it can be combined with other approaches to
      give better coverage across content types and platforms.
      '''
    )
    reset_btn = gr.Button('Reset', visible=False)

  def generate(*prompts):
    prompts = [p for p in prompts if p]
    standard, standard_detector = generate_outputs(prompts=prompts)
    watermarked, watermarked_detector = generate_outputs(
        prompts=prompts,
        watermarking_config=_WATERMARK_CONFIG,
    )
    upper_threshold = 0.9501
    lower_threshold = 0.1209

    def decision(score: float) -> str:
      if score > upper_threshold:
        return 'Watermarked'
      elif lower_threshold < score < upper_threshold:
        return 'Indeterminate'
      else:
        return 'Not watermarked'

    responses = [
        (text, decision(score))
        for text, score in zip(standard, standard_detector[0])
    ]
    responses += [
        (text, decision(score))
        for text, score in zip(watermarked, watermarked_detector[0])
    ]
    random.shuffle(responses)
    _ANSWERS.extend(responses)

    # Load model
    return {
        generate_btn: gr.Button(visible=False),
        generations_col: gr.Column(visible=True),
        generations_grp: gr.CheckboxGroup(
            [response[0] for response in responses],
        ),
        reveal_btn: gr.Button(visible=True),
    }

  generate_btn.click(
    lambda: gr.update(value='Generating...', interactive=False), None, generate_btn
  ).then(
     generate,
     inputs=prompt_inputs,
     outputs=[generate_btn, generations_col, generations_grp, reveal_btn]
  )

  def reveal(user_selections: list[str]):
    choices: list[str] = []
    value: list[str] = []

    for (response, decision) in _ANSWERS:
      if decision == "Watermarked":
        if response in user_selections:
          choice = f'Correct! {response}'
        else:
          choice = response

        value.append(choice)
      else:
        choice = response

      choices.append(choice)

    return {
        reveal_btn: gr.Button(visible=False),
        detections_col: gr.Column(visible=True),
        revealed_grp: gr.CheckboxGroup(choices=choices, value=value),
        reset_btn: gr.Button(visible=True),
    }

  reveal_btn.click(
    reveal,
    inputs=generations_grp,
    outputs=[
        reveal_btn,
        detections_col,
        revealed_grp,
        reset_btn
    ],
  )

  def reset():
    _ANSWERS.clear()

    return {
        generations_col: gr.Column(visible=False),
        detections_col: gr.Column(visible=False),
        revealed_grp: gr.CheckboxGroup(visible=False),
        reset_btn: gr.Button(visible=False),
        generate_btn: gr.Button(value='Generate', interactive=True, visible=True),
    }

  reset_btn.click(
    reset,
    inputs=[],
    outputs=[
        generations_col,
        detections_col,
        revealed_grp,
        reset_btn,
        generate_btn,
    ],
  )

if __name__ == '__main__':
  demo.launch()