back to article Facebook mulls tagging pics with 'radioactive' markers to trace the origin of photos used to build image-recog AI

Facebook researchers have developed a digital watermarking technique that allows developers to tell if a particular machine-learning model was trained using marked images. "We call this new verification method 'radioactive' data because it is analogous to the use of radioactive markers in medicine: drugs such as barium …

  1. Kevin Johnston


    A practical use for steganography then. Not exactly ground breaking

    1. Anonymous Coward
      Anonymous Coward

      Re: steganography

      Beat me to it.

      If I hear one floppy fringed hipster c*** start telling me how "amazing" this is, I might just snap.

      I would piss my pants laughing if someone has already done this, only not made a big thing about it ... pretty certain some photographers were looking at holding Google to account over it's rather liberal views on copyright.

      1. Korev Silver badge

        Re: steganography

        I'd find it even funnier if someone sued Facebook after someone "borrowed" a picture breaking a photographer's copyright and FB wouldn't take it down...

        1. Kevin Johnston

          Re: steganography

          Of course, yes....add the EXIF data into the published image through the 'watermark' and wait for the usual suspects to scrape a copy then...profit?

          1. Stork Silver badge

            Re: steganography

            One of the problems with FB and photos is that they strip all EXIF data, including your carefully crafted copyright notice (don't laugh, they say it is for privacy).

            Stopping doing that would be an easy first step to trace origins...

            1. Anonymous Coward
              Anonymous Coward

              Re: steganography

              So Facebook strips all your information and permanently tags it with thier information to TRACK YOU FOREVER?

              It's Thursday.

      2. Anonymous Coward
        Anonymous Coward

        Re: steganography

        I thought steganography was the study of the steganographisaurus but I could never find any data to corroberate my hypothesys. It's as if it's all hiding so it can't be found...

        1. Steve K Silver badge

          Re: steganography

          Maybe it's the deuthinkisaurus instead?

    2. Steve K Silver badge

      Re: So...

      Would this kind of watermarking survive format changes or other operations like recompression or resampling/resizing up or down?

      1. Anonymous Coward
        Anonymous Coward

        Re: Would this kind of watermarking survive format changes

        When done properly, yes.

        Yes, "when", not if ....

    3. ibmalone Silver badge

      Re: So...

      It's a bit more clever than that. I watermark the pictures, you use them to train a classifier (alongside other data), I can then see that your classifier was trained with these watermarked pictures. Classic steganography is I watermark the pictures and can later find the watermark because I know what I was looking for. In fact, it's almost anti-steganography, I'm silently teaching the classifier to recognise the watermark without you (the person who thinks they're training it) knowing, a bit like the apocryphal Russian-tanks scenario.

      1. ScrappyLaptop

        Re: So...

        Or, pretend that you're doing it to train AI's but in reality your TOS says that you own all the images people post on your social network site. So you mark them just in case that massive collection of images you own becomes valuable, or you decide to open your own stock image company. Better still, you tag each photo with an unique identifier so you can track it's progress and connections between people, somewhat like a cookie but inside the image files...the possibilities are endless for FB.

        1. Steve K Silver badge
          Black Helicopters

          Re: So...

          ..and there we have the real reason

        2. ibmalone Silver badge

          Re: So...

          Well, they're explicitly not doing it to train AI, and there's plenty of reasons for watermarking already that nobody would bat an eyelid for them to use. (Whatever you think of facebook and its users, it'd be absolutely legitimate for them to watermark photographs to prevent third parties scraping and using the pictures.) I'm sure they're contemplating all that stuff, but this isn't the way to achieve any of those goals and it is a way to achieve a different self-interested aim (make it so people other than them can't benefit from the pictures in this way), so I don't think cynicism necessarily says that what they're trying to do here is anything other than what they say they're trying to do.

  2. Neil Barnes Silver badge

    My first thought on reading 'radioactive markers'

    was 'half-life'... as if this were a marker which would decay with time.

    1. macjules Silver badge

      Re: My first thought on reading 'radioactive markers'

      "Half-life" is the time it would take for Mark Zuckerberg to decay should he be dropped into the Mariana's Trench in a barrel full of Plutonium.

    2. Korev Silver badge

      Re: My first thought on reading 'radioactive markers'

      >was 'half-life'... as if this were a marker which would decay with time.

      Half Life 1 & 2 are both cracking games that haven't decayed much with time.

      Half Life 3 would be nice though :)

  3. Julz Silver badge


    This is just the prelude to court cases where Farcebook sues hapless minions who dared to used 'their' data set to train a model that's not contributing to their bottom line.

  4. Anonymous Coward
    Anonymous Coward

    3.6 not great, not terrible

  5. Christopher Reeve's Horse

    But surely, it's impossible

    - to imagine a scenario where someone would be utilising Facebook's data sets inappropriately? It must all be appropriate as Facebook profited from selling them, right?

    And don't call me Shirley...

  6. Detective Emil

    Eggheads? No, more likely PR drones.

    Barium sulfate is indeed used an X-ray contrast medium. But it's not radioactive, and neither are the X-rays (even if those who use them are known as radiographers).

    1. Charles 9 Silver badge

      Re: Eggheads? No, more likely PR drones.

      X-rays can't be radioactive (they're electromagnetic radiation), but some sources certainly would be (the most common way, though, is to emit high-energy electrons at tungsten, which isn't itself radioactive).

      1. Anonymous Coward
        Anonymous Coward

        Re: Eggheads? No, more likely PR drones.

        Yeah, that's like saying "this photo aint digital" while holding a print out in your hand, and the othre person an SD card. ;)

      2. Medical Cynic

        Re: Eggheads? No, more likely PR drones.

        Sources emit radiation - alpha, beta, gamma. But not x-rays. The gamma rays may be of the same frequencies as x-rays emitted by decelleration of electrons in a Tungsten-Rhenium target [the bremmstrahlung effect], but they are named "X-rays".

        1. Charles 9 Silver badge

          Re: Eggheads? No, more likely PR drones.

          Radiation is more than just radioactivity. Visible light is also radiation (hint: radio waves are on the low end of the electromagnetic spectrum, microwaves used for radar and to cook are on the same spectrum, plus it's not alpha, beta, or whatever that put people in a tizzy about cell phones near people's skulls).

  7. Gonzo wizard

    How could this possibly go wrong?

    "Let's invisibly watermark every picture that goes through our servers" will help Facebook confirm connections between individuals that aren't explicitly declared by either party via a connection in Facebook. Nope. No thanks. Nyet. Nein. It's only a matter of time before this is weaponised against us...

  8. Skymonrie

    All this is going to do is cause people using marked data sets to re-render them; bye bye watermark.

    *edit* double posted by accident, apologies

  9. Skymonrie

    Almost entirely pointless

    Aside from the part mentioning validating image sets used when people are limited to certain data sets, all this is going to do is cause people to run the images through a another round of rendering...Completely voiding the watermark

    1. Charles 9 Silver badge

      Re: Almost entirely pointless

      How are they going to do that without access to the clean sources? And without the clean sources, how can one be sure they got rid of all the stego, given many stego techniques can withstand various levels of alteration?

  10. Anonymous Coward
    Anonymous Coward

    FaceBook and Facial Recognition

    Now that's a marriage made in Hell and Damnation (And a touch of Brimstone for good effect).

    Any images on any social media platform purporting to be of me are more than likely total fakes.

    I'd like to check but that requires signing up for (anto)social media which I will continue to refuse to do.

    {send Zuck to Hell and make him stay there}

  11. @dtl

    Barium Sulphate isn't radioactive. It's just dense and non-toxic so you can eat enough of it to show your guts up on a CT or X-Ray.

  12. ibmalone Silver badge

    Interesting, that it works quite so well (from a skim only 1% of data needs to be affected), however their augmentation tests are only against rotation and cropping, "In particular, a subspace analysis would likely reveal the marking direction. This adversarial scenario becomes akin to that considered in the watermarking literature, where strategies have been developed to reduce the detectability of the carrier." I'd think combined with more general augmentation (non-linear distortions and noise) that would greatly reduce its effectiveness.

    1. ibmalone Silver badge

      Thumbs down on technical issues with no comment as to why is a bit tedious people. If you've got a different opinion let's see it.

  13. IGotOut Silver badge

    I'm once again missing something this the same Facebook that tags people in photos without their permission?

  14. Drew Scriver

    Doctored photos from established news orgs to stay?

    For a moment I thought Facebook were going to auto-detect doctored news photos from the AP et al, but alas. They're targeting artificial intelligence only, not organic intelligence.

    Time to join Stephen King in ditching Facebook?

  15. Alistair

    minor correction:

    Sounds like Silicon Valley doesn't like having its pictures lifted for other people's models unless they get $$$ for the images they've seized from their product.

  16. Anonymous Coward
    Anonymous Coward

    "Now, unbeknownst to you, someone obtains your data set, and uses it to train an image-classification system"

    I'm sure I remember reading an article not that long ago, where Facebook had been accused of doing exactly this to an AI research team.

  17. Eeep !

    Does anyone at FB think about the language they use?

    Now I can tell people that looking at pictures on Facebook is dangerous because they are radioactive - and it is Facebook telling us that.

  18. John Brown (no body) Silver badge

    Adusting pixel to watermark?

    So, just adjusting a few pixels means they can not only later identify the dataset the source image came from but also which image detection algorithms it was used to train. What about unintended consequences? Didn't we recently have a story about how changing just a few pixels could fool image recognition algorithms into identifying a picture of a bike as a toaster?

    1. ibmalone Silver badge

      Re: Adusting pixel to watermark?

      In a way this is how it works, rather than radioactive you could say "poisoning" the data. Later you can check those pixels on a bike and if a toaster pops out [surely it's toast that pops out?] then they used your images.

      The goal is to prevent anybody else training on it, with the constraint the images should still look okay. So it isn't really the intent that you can still actually train a working algorithm, they might prefer to be able to prevent that outright, but if you do they want to be able to tell after the fact. Unintended consequences aren't a problem so long as they don't allow the tracer to be scrubbed out, because the use isn't supposed to be taking place.

  19. Frumious Bandersnatch

    Not the face! AI ai ai!

  20. DarkRud

    Manipulated images are distributed as originals?

    Do you still get it?

  21. Fruit and Nutcase Silver badge

    Barium Sulphate - Radio Active???

    "We call this new verification method 'radioactive' data because it is analogous to the use of radioactive markers in medicine: drugs such as barium sulphate allow doctors to see certain conditions more clearly on computerized tomography (CT) scans or other X-ray exams,” the eggheads explained on Wednesday.

    Whilst there are radio isotope markers used in medical diagnosis, Barium Sulphate is used as a contrast agent for X-Ray based diagnostics because of its high absorbance of X-Rays, and not due to a radioactive decay characteristic.

    These Facebook "eggheads" and Zuckerberg should be given barium enemas and X-Rays taken of their guts so that they understand...

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021