Meta Shifts to Provenance as AI Detection Models Hit Scaling Limits

AI检测模型遇扩展极限，Meta转向来源溯源 由于不断演进的生成模型使得软件检测在平台规模下无法维系且成本过高，Meta正从事后AI分类器转向嵌入式水印和加密元数据。 Meta工程与产品负责人剖析了在Facebook、Instagram和WhatsApp上追踪并标记合成媒体所需的多层技术架构。专家组详细阐述了平台如何通过分层结合确定性C2PA元数据、主动无形水印（Content Seal）以及级联机器学习分类器，来平衡消费者、创作者和广告主之间的竞争需求。他们探讨了主要的系统难题，包括在包含多达1050万项资产的广告目录中扩展持续合规，以及应对在不可察觉性、鲁棒性和有效载荷容量之间的水印三难困境。演讲者得出结论，面对超逼真模型，独立的事后检测在数学和计算上都是不可持续的，因此他们敦促更广泛的科技领域在开放C2PA标准、互操作性测试大会（plugfest）以及安全的跨平台验证协议上展开合作。 Meta运行着一套多层溯源架构，整合了创作者主动披露、C2PA等加密元数据、无形水印（Content Seal）以及机器学习分类器，用以评估进入其平台的入站媒体。 (5:29) 广告基础设施需要一个双层系统来处理多达1050万项资产的目录，将针对广告主预览的快速确定性预检查与用于核查广告活动的异步“持续合规”引擎相结合，且不阻碍低延迟竞价。 (11:04) 无形水印面临着不可察觉性、抗篡改鲁棒性与有效载荷容量之间固有的数学三难困境，导致无法在不同平台之间采用单一的通用水印。 (16:37) Meta在战略上正从依赖事后AI检测模型过渡到以溯源为先的解决方案，因为逼真度的飞速提升长远来看将使被动检测难以为继。 (24:33)

Meta engineering and product leaders argue that scaling AI media transparency across billions of users requires a multi-layered defense-in-depth architecture combining deterministic metadata, imperceptible watermarks, and machine learning classifiers. However, they forecast that post-hoc algorithmic detection will eventually become unsustainable, necessitating an industry-wide pivot toward cryptographically secure provenance standards. Balancing Consumer, Creator, and Advertiser Demands (2:20) Mohit Diwan outlines the operational tension in balancing the conflicting priorities of consumers, creators, and commercial advertisers. Platform consumers increasingly demand clear disclosures to distinguish reality from synthetic alterations, though tolerance varies geographically; Diwan notes that U.S. users show lower tolerance for unlabeled AI media compared to users in India. Conversely, broad, unnuanced labels risk penalizing creators who use generative tools for minor edits, such as background noise reduction or touch-ups, by failing to reflect the proportion of human versus algorithmic input. Meanwhile, Sai Chandramouli emphasizes that advertisers require predictability, demanding pre-publication previews showing exact AI disclosure labels before deploying campaign budgets. Multi-Layered Defense: Metadata, Watermarks, and Classifiers (5:29) Because no single tool provides full coverage, Meta relies on a multi-tiered pipeline that pairs deterministic inputs with probabilistic inference. The stack begins with creator self-disclosures and cryptographically signed C2PA metadata documenting edit histories. However, because metadata is fragile and frequently stripped during uploads or intermediate editing, active watermarking tools like FAIR's Content Seal embed imperceptible signals directly into media pixels or audio frequencies, allowing identification to survive common manipulations like cropping, flipping, and color grading. Karthic Veera explains that passive classifiers serve as a critical safety backstop for uncredentialed inventory lacking provenance tags. Classifiers also provide edit distinction: unlike binary cryptographic flags that trigger on any modification, classifiers evaluate the saliency and proportion of synthetic changes, preventing minor adjustments from receiving misleading full-image AI labels. Compute Efficiency in Large-Scale Catalog Systems (11:04) Auditing advertising inventories—which scale up to 10.5 million image and video assets in a single catalog—presents severe computational bottlenecks. Chandramouli explains that Meta uses a two-tier compliance framework: a rapid pre-auction scan using lightweight deterministic checks previews labels for advertisers, followed by an asynchronous continuous compliance engine that audits every asset across a campaign's lifecycle without introducing auction latency. To manage the linear inference costs of running larger deep-learning detectors against photorealistic media, Karthic Veera details the use of cascaded architectures. Inexpensive, high-recall models sweep the general intake, routing only flagged candidates to compute-heavy models or appeals processes. Additionally, Meta has shifted engineering workflows away from slow retraining cycles toward automated adversarial agentic pipelines that continuously probe detectors against newly released frontier models to patch blind spots. Watermarking Trade-Offs and Cross-Platform Vulnerabilities (16:37) Alexandre Mourachko defines the technical physics of invisible watermarks as an inescapable trilemma between imperceptibility (zero visual or acoustic artifacts), robustness (resisting compression and editing), and capacity (embedding sufficient payload, typically around 256 bits). Because mathematically optimizing two axes inevitably degrades the third, Meta rejects a unified model in favor of a portfolio of watermark models tailored to varying product tolerances. Furthermore, provenance remains fragmented across industry silos. Meta cannot read watermarks generated by platforms like TikTok, nor can external platforms decode Meta's markers. Mourachko cautions that simply sharing detector models or open-sourcing weights creates severe security risks: adversaries could reverse-engineer the system to surgically scrub watermarks or forge Meta's signature onto malicious deepfakes. FAIR is currently developing protocols to enable secure cross-industry detection without exposing embedder intellectual property. Transitioning from Post-Hoc Detection to Provenance (24:33) Looking forward, Karthic Veera predicts that post-hoc classification will become technically unsustainable as generative engines achieve hyper-photorealism. In the long term, Meta plans to rely on upstream provenance infrastructure—principally metadata and secure watermarks—to establish whether content is AI-generated, freeing machine-learning classifiers to focus on subjective context, policy violations, and harm assessment. To accelerate this transition, Meta is hosting a C2PA plugfest in Menlo Park to establish industry consensus on payload depths and standard definitions for when an edit crosses into generative creation. Chandramouli and Mourachko urge industry partners to actively contribute to open RFCs and pull requests to build shared, interoperable verification standards before adversarial tooling outpaces existing safeguards. While cross-industry collaboration through standards like C2PA is accelerating, scalable provenance remains constrained by the lack of secure, shared watermarking protocols and clear boundaries separating minor edits from synthetic generation. Meta's roadmap indicates that long-term authenticity tracking depends on establishing tamper-resistant provenance upstream rather than relying indefinitely on post-hoc detection models.

Meta技术团队在@Scale大会上指出，面对对抗性演进的生成式AI媒体，单一检测手段已无法奏效，必须依托由创作者自披露、密码学元数据、隐形水印与被动分类器构成的多层纵深防御体系。团队强调，鉴于事后分类器在超逼真生成时代面临巨大的算力瓶颈与误报风险，长远的内容治理必须转向基于跨行业标准的出处验证机制。 利益相关方的诉求博弈与分级披露张力 (2:20) 在平台规模化应用AI出处标签时，必须权衡普通用户、创作者与广告主三方的对立诉求。Facebook信任与安全产品负责人Mohit Diwan指出，终端用户对信息源头的真实性要求极高，且存在明显的地域差异：美国用户对未标注的AI内容容忍度极低，而印度用户对合成内容的接纳度显著更高。然而，粗暴的全局标签往往会伤害创作者的积极性。创作者使用AI的范围从微小的音频降噪、背景杂音消除到全画面的生成式重塑，若仅因轻微修改就被打上‘AI生成’的统一标签，会掩盖人类的创作投入并引发强烈反弹。 广告生态对出处披露则提出了确定性与可预测性的要求。广告AI透明度工程负责人Sai Chandramouli表示，广告主正迅速转向原生AI制作流程，在投入预算投放广告前，他们需要明确预览广告外观以及具体的免责声明标签样式。因此，平台必须在避免欺骗消费者与防止标签稀释之间建立平衡，提供能够精准区分微调编辑与实质性生成的精细化披露机制。 多层纵深防御体系与分类器托底机制 (5:29) 为了在日均庞大的上传量下落地验证，Meta建立了一套自顶向下的多层技术栈。顶层为创作者自愿声明和C2PA等密码学元数据标准，提供确定性的资产编辑历史。FAIR研究经理Alexandre Mourachko强调，元数据虽然信息丰富，但在网络流转、转码或常规软件保存时极易被无意或恶意剥离。针对这一脆弱性，FAIR开发了名为Content Seal的不可见水印技术，在生成时刻将机器可读信号直接注入图像像素、视频帧或音频频段中，使其在经历翻转、亮度调整或常规色彩压缩后依然保持完好。 产品经理Karthic Veera进一步解释，被动内容分类器在整个管线中承担不可或缺的托底保障角色。目前平台上海量内容完全缺乏元数据凭证，分类器能够拦截未经凭证化的合成媒体。更重要的是，现存密码学出处标准往往采用粗暴的二元判定，而分类器能够对媒体内容进行比例与显著度判定，有效避免了因自动字幕或基础贴纸而将真实照片误判为完全由AI生成的极端情况。 大规模工程实现中的算力优化与水印权衡 (11:04) 将出处检测推广至Meta庞大的广告生态面临严苛的算力挑战。Sai Chandramouli介绍，Meta最大的单一广告目录包含高达1050万个图像与视频资产。为此，工程团队开发了两层架构：第一层是在拍卖前通过轻量级元数据检查和自声明进行即时扫描，为广告主生成标签预览；第二层则采用异步的‘持续合规’引擎，在竞价之外离线扫描每一个资产，确保广告在整个投放生命周期中合规。 在检测端，深度学习模型的推理成本随资产量线性增长。Karthic Veera指出，针对日趋逼真的前沿生成模型，团队采用了级联检测策略，先用低成本的高召回模型粗筛全量目录，再将可疑样本路由至高精度的重量级模型，并通过对抗性智能体系统持续探查检测盲区，实现自动化重训。在水印嵌入端，Alexandre Mourachko阐明了不可见性、鲁棒性与载荷容量（通常约为256比特）之间不可避免的‘三难困境’，Meta通过维护不同参数配置的模型组合，以匹配不同内部业务场景对画质损失与鲁棒性的差异化容忍度。 跨平台互通壁垒与出处验证范式转移 (22:00) 当前跨平台出处验证面临严重的生态割裂。Alexandre Mourachko直言，不同科技企业的水印方案处于孤岛状态，例如Meta无法识别来自TikTok的AI视频水印，反之亦然。直接向行业公开水印权重或检测器会带来灾难性的安全漏洞：恶意行为者可借此逆向工程精准抹除水印，甚至伪造虚假签名将恶性深度伪造内容归咎于Meta。目前尚无在不泄露核心知识产权与攻击面的前提下实现全行业通用验证的安全协议。 针对未来的发展路线，Karthic Veera明确提出，依赖事后分类模型识别AI生成内容在长期来看算力不可持续，技术演进正倒逼范式转移——必须由前置的出处标准（水印与元数据）来承载判定资产是否属于AI生成的基础任务，分类器则退守至评估有害性、显著性与上下文语义。为此，Meta计划在门洛帕克举办C2PA Plugfest技术测试活动，并呼吁行业伙伴加速针对标准RFC和代码PR的评审，建立统一的编辑粒度与出处规范。 Meta专家组总结认为，随着生成式模型在逼真度与复杂性上加速突破，数字媒体防伪已无法依赖单一平台的技术闭门造车。然而，跨企业水印互通仍受制于反向工程与签名伪造风险，行业在C2PA元数据粒度定义上也尚未达成共识；如何在不暴露安全攻击面的前提下落地开放且安全的跨平台验证标准，将是全球内容生态治理下一阶段的核心攻坚点。

## Background 该视频由 YouTube 频道 @Scale 于 2026 年 10 月 30 日发布。根据页面描述，这是一场由 Steve Dilla 主持，Mohit Diwan、Sai Chandramouli、Karthic Veera 和 Alexandre Mourachko 共同参与的现场圆桌讨论，主题聚焦于超大规模下的 AI 生成媒介溯源（AI Generated Media Provenance at Scale）。 ## TL;DR 来自 Meta 的核心技术与产品团队深入探讨了如何在支撑数十亿用户的庞大生态中，构建对抗虚假内容与保障透明度的 AI 溯源体系。讨论系统拆解了涵盖主动自主申报、C2PA 元数据标准、隐形数字水印（Content Seal）以及多层级 AI 分类器的立体防御技术栈，并详述了广告业务在千万级资产吞吐下所采用的低延迟预检与异步持续合规架构。此外，嘉宾们坦诚剖析了隐形水印面临的‘不可感知性、鲁棒性与容量’不可能三角，指出了直接共享模型可能导致的逆向工程与深度伪造冒用风险，并呼吁全行业跨越竞争壁垒，共同推进 C2PA 与互操作标准的建立。 ## Atmosphere & style 整场圆桌充满了典型硅谷顶尖科技大厂务实、严谨且高密度的工程探讨气息。主持人以轻松幽默的破冰开场，迅速将节奏带入由浅入深的技术攻防剖析中。各位专家各司其职，从基础架构、学术前沿算法到信任安全落地层层递进，既毫不掩饰超写实生成与算力爆炸带来的治理焦虑，又展现出系统化破局的从容自信，给听众带来一种置身前沿风暴中心、既硬核又极具战略纵深的沉浸式技术交流体验。 ## Bulletin - [06:06](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=366s) Meta 媒体溯源构建了由“自主申报/C2PA 元数据”、“Content Seal 隐形水印”与“高保真分类器”组成的三层防御架构，以兼顾确定性与概率性信号。 - [11:04](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=664s) 面对单一商品目录高达 1050 万件资产的规模压力，广告系统采取两级检测机制，用低延迟确定性预检配合后台异步持续合规校验，保障毫秒级竞拍效率。 - [16:37](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=997s) 隐形水印面临不可感知性、鲁棒性与容量的“不可能三角”，Meta 放弃单一通用模型，转而为不同业务线定制权衡各异的水印模型库。 - [22:00](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1320s) 跨平台水印共享面临逆向工程与深度伪造冒用风险，若直接公开嵌入器与检测器模型，可能导致水印被恶意抹除或伪造数字指纹栽赃平台。 ## Key takeaways - [02:20](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=140s) 内容溯源必须平衡终端用户知情权、创作者对“成比例披露”的诉求，以及广告主对投放前标签展示的确定性要求。 - [02:20](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=140s) 一刀切粗暴打标会掩盖微调与大幅生成的差异，引发创作者反弹并造成“标签稀释”，平台需避免过度惩罚正常工具修图。 - [06:06](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=366s) C2PA 等行业元数据与自主披露构成了第一道轻量级确定性信号，但元数据在跨平台下载、转码和编辑时极易被清洗剥离。 - [06:06](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=366s) 分类器作为全量库兜底防线，既负责识别缺乏元数据的超写实内容，又承担过滤轻微编辑、度量核心生成显著性的价值裁决角色。 - [09:48](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=588s) 隐形水印属于生成阶段的主动嵌入技术，相较于被动分类器具备极高的精确度，且在翻转、调色等常规二次编辑中具备顽强的存活鲁棒性。 - [11:04](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=664s) 广告资产库规模可达千万级，全量调用重型 AI 模型成本过高，必须依赖前端确定性秒级扫描与后台异步深度校验的分流架构。 - [13:46](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=826s) 为应对检测模型算力线性暴增，业界正转向轻量级高召回模型与重型 Agent 决策系统级联的阶梯式推理方案。 - [13:46](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=826s) 传统瀑布流训练无法跟上前沿生成迭代速度，引入对抗性 Agent 主动探测模型盲区可实现检测器的自动化持续微调与快速重训。 - [16:37](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=997s) 数字水印受制于不可感知性、抗破坏鲁棒性与信息容量三者不可兼得的物理限制，强行提升容量和抗损能力会破坏媒介画质。 - [19:15](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1155s) 元数据消费端面临三大行业瓶颈：缺乏统一的嵌入指导规范、传播链路中剥离严重，以及 AI 编辑与 AI 生成之间存在临界模糊性。 - [22:00](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1320s) 当前各厂商水印模型处于孤岛互斥状态，无法直接跨平台识别，但盲目共享检测模型又会暴露出被逆向工程与伪造指纹栽赃的巨大安全漏洞。 - [24:33](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1473s) 长期来看，单纯依靠检测器模型追赶生成技术将不可持续，“是否为 AI”的基础判别应由溯源生态承载，分类器则专注解决显著度与危害性裁决。 - [28:56](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1736s) 全产业链正打破竞争壁垒，通过 C2PA 工作坊、开源 RFC 与代码协作，共同推动数字水印与跨平台互操作性标准的落地收敛。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=4s) 圆桌开场与嘉宾背景介绍 主持人 Steve Dilla 开玩笑表示，午饭后的第一场圆桌向来是最难讲也最容易让人犯困的，但他很高兴能与大家一起探讨 AI 生成媒介（AI-generated media）这一当下全行业迅猛发展的核心议题。他指出，如果你身处 AI 领域，本场讨论将紧扣检测（detection）、标签标注（labeling）等实际技术落地；如果你不是 AI 领域的技术人员，这场分享则关乎如何在极其快速演进的赛道中设计和运营超大规模系统（scaled system）。在 Steve 看来，这是他科技从业生涯中演变最快的领域之一：“We're sort of right at the tip of the spear in terms of like the adversarial space as well as just like the good actor space and people trying to use AI to improve their content.” 随后，四位来自 Meta 的关键技术与产品负责人依次介绍了自己的团队与职能： - **Steve Dilla**（主持人）：Meta 媒体基础架构团队（Media Foundation）产品经理，负责媒体智能（Media Intelligence）方向，核心是利用 AI 理解媒体内容及其来源，支撑推荐排序（ranking）、电商商业化、内容信任与安全（trust）以及当天的核心议题——内容溯源（provenance）。 - **Alexandre Mourachko**：Meta 超级智能实验室（Meta Superintelligence Labs）旗下 FAIR 的研究经理，负责研发 Content Seal。这是一整套部署在 Meta 全线产品中的隐形水印模型与技术，覆盖图像、视频、音频和文本的水印嵌入与提取。 - **Karthic Veera**：Meta 推荐系统内容理解模型的产品经理，同时负责主导构建针对 AI 生成媒介的检测分类器模型。 - **Mohit Diwan**：Meta 信任与安全团队（Trust and Safety）成员，负责在业务侧直接消费 Karthic 团队产出的模型信号，负责落地安全治理规则、打标策略（labels）与违规处置。 - **Sai Chandramouli**：广告 AI 透明度（Ads AI Transparency）工程技术负责人，负责将全套检测、水印与标注技术工程化整合到 Meta 的广告主生态系统中。 --- ### [02:20](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=140s) 什么是出处溯源？用户、创作者与广告主的三方权衡 谈到内容出处溯源（Provenance），Mohit Diwan 阐明了其核心逻辑与服务的三大人群：普通用户、创作者和广告主。在终端用户层面，平台发现用户在浏览内容时若遭遇 AI 生成内容，体验往往大打折扣，但更深层的痛点在于“不想被蒙蔽”。用户需要清晰、确切地辨别什么是 AI 生成的、什么不是。这种心理在不同地理区域存在显著文化差异：在美国，用户对 AI 生成内容的容忍度较低、接受门槛较高；而在印度等地区，用户对其表现出明显更高的开放度与兴趣。 在创作者层面，行业各家大厂都在大力推动创作者利用 AI 工具进行创作。然而，现实中创作者使用 AI 的跨度极广——从微小的局部降噪、污点修复，到翻天覆地的画面主体结构重构。如果系统采取一刀切的做法，直接给内容打上一个粗暴的“AI 生成”标签，就会彻底掩盖掉细节，引发创作者的强烈不满与反弹。Mohit 直言：“All that details are like masked and creators don't think about like think about in the sense that we there is no proportional disclosure, right?”创作者渴望的是“成比例的披露”（proportional disclosure），而非轻微修图就被全盘打成 AI 内容。 ```mermaid flowchart TD accTitle: AI Content Provenance Ecosystem accDescr: Tripartite ecosystem balancing users, creators, and advertisers. subgraph Stakeholders ["生态核心参与方"] U["终端用户 (Users)<br/>诉求：真实性、知情权、防欺骗"] C["内容创作者 (Creators)<br/>诉求：精细化标签、成比例披露"] A["广告主 (Advertisers)<br/>诉求：AI降本提效、上线前确定性"] end subgraph Tension ["核心治理矛盾"] T1["粗暴打标 vs. 比例披露"] T2["生成逼真度提升 vs. 用户知情权"] T3["动态判定 vs. 广告审核透明可预测"] end U <--> T1 C <--> T1 A <--> T3 U <--> T2 ``` Sai Chandramouli 补充了广告主维度的挑战。现代广告主正变得极度“AI 原生化”（AI-native），投入了大量精力和预算使用 AI 工具制作广告物料。尽管广告主普遍积极主动地与 Meta 配合，希望向受众透明传达 AI 的使用，但他们对确定性有着严苛的要求：广告主必须在广告正式上线投放前，100% 确认系统会在广告上打出何种披露或 AI 标签，因为任何意外的标签形态都会直接影响广告转化率与品牌形象。 Mohit 总结道，整个产品 UX 的核心目标极其直白，就是帮助用户区分什么是真实、什么是 AI；而在实现这一目标的过程中，保护创作者权益、兼顾商业诉求与化解标签稀释风险，则是底层系统必须时刻管理的平衡艺术。 --- ### [06:06](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=366s) 分层技术架构：确定性元数据、分类器模型与隐形水印 当话题深入到底层架构设计时，Sai Chandramouli 介绍了 Meta 在广告与全平台所落地的分层技术栈（Multi-layered Stack）。为了在数十亿量级的媒体资产中判定是否包含 AI 生成成分，系统并不依赖单一路径，而是采用多维度输入信号的立体架构： ```mermaid flowchart LR accTitle: Multi-layered AI Provenance Detection Stack accDescr: Incoming media passes through deterministic signals, active watermarking, and passive classifiers. Input["输入媒体资产<br/>(图像 / 视频 / 音频)"] subgraph Layer1 ["确定性信号 (Deterministic)"] SD["自主披露 (Self-disclosure)"] MD["C2PA / 行业标准元数据"] end subgraph Layer2 ["主动嵌入信号 (Active)"] WM["Content Seal<br/>隐形水印检测"] end subgraph Layer3 ["被动兜底模型 (Passive)"] CL["高保真内容理解分类器"] end Input --> Layer1 Input --> Layer2 Input --> Layer3 Layer1 --> Decision["综合判定引擎<br/>(加权裁决 & 标签分发)"] Layer2 --> Decision Layer3 --> Decision ``` - **第一层：轻量级确定性信号（Deterministic Signals）** 最直接的途径是获取创作者或广告主的自主披露（Self-disclosure），即广告主主动勾选或声明“我们在制作 X、Y、Z 元素时使用了 AI”；再叠加 C2PA 等行业标准数字证书与富元数据（Metadata），精确读取内容被改动了哪些部分。 - **第二层：前沿分类器检测模型（Classifiers as Backstop）** Karthic Veera 解释了分类器在整个体系中的双重定位。其一是**覆盖率（Coverage）**：尽管溯源标准正在成熟，但全网大量媒体库存根本没有任何溯源信息，分类器必须充当全量库的坚固兜底（backstop）。这其中最大的工程难题是跟上生成模型的飞速进化：“Just last year, I think we have gone from, you know, extra fingers and missing limbs from generated content to ultra hyperrealistic content, right?”分类器必须在缺乏元数据时依然具备超写实内容的识别力。 其二是**高保真度裁决（High Fidelity）**：标准出处协议往往是一揽子检测，只要检测到 AI 就会报警。若不加甄别，用户给真人照片加个小贴纸或加句字幕都会被扣上“AI 生成媒体”的大标签。这不仅会造成“标签稀释”（label dilution），还会引发公关信任危机。分类器在此扮演了价值判断的角色，精准过滤掉微小编辑，识别出真正值得用户关心的核心 AI 生成内容。 - **第三层：主动式隐形数字水印（Invisible Watermarking）** Alexandre Mourachko 阐述了隐形水印与前两者的根本区别：分类器是在内容发布后进行被动研判（passive detection），而水印是**主动式检测（active detection）**。技术团队直接在媒体生成阶段向像素、声波或帧序列中注入人眼无法察觉、人耳无法听见的隐形信号。其核心优势在于极高的精确度（Precision），“你可以无条件信任该信号”；更关键的是**鲁棒性（Robustness）**。富元数据（Metadata）虽然承载的信息极度丰富，但一旦文件被跨平台下载、压缩、转发或截图，元数据极易被洗掉或被恶意剥离，而隐形水印则能顽强地在二次分发中留存下来。 ### [09:48](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=588s) 水印技术在媒体编辑中的鲁棒性与检测技术栈 元数据（Metadata）在实际传播过程中极其脆弱，无论用户是有意去除还是无意丢失，只要将图片导入图像编辑软件并重新导出保存，原有的元数据往往就会彻底剥落。Alexandre Mourachko 指出，正是在这种场景下隐形水印（Watermarking）发挥了关键作用，因为水印能够在此类编辑和分享流程中存活下来。一般而言，水印对于图像翻转（Flipping）、亮度微调以及色彩调整等常规编辑操作都具备强大的抵御能力。通过结合确定性与概率性手段，整个技术栈为大规模检测 AI 生成内容构筑了坚实防线。 主持人 Steve Dilla 随后总结了这套技术架构的协同运作方式：平台一方面拥有确定性信号（Deterministic Signal），另一方面也在持续构建概率性信号（Probabilistic Signal）。这些能力全面覆盖了流入 Meta 旗下各大产品线（包括 Facebook、Instagram 和 WhatsApp）的全部媒体资产。然而，在横跨数十亿用户级平台运作如此庞大的系统时，工程团队必须克服极具挑战性的规模化落地障碍。 --- ### [11:04](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=664s) 广告侧的海量规模挑战：双层检测与持续合规架构 当谈及工程规模时，广告业务不仅面临平台固有的海量吞吐量，还隐藏着广告素材库（Ads Catalog）本身的爆炸性规模。Sai Chandramouli 透露，Meta 支持海量的目录广告和动态广告，其中部分广告主的目录包含数百万种商品，“我们最大的一个商品目录实际上包含了 1050 万个图片和视频资产。” 团队的核心难点在于，既要精准判定素材是否由 AI 生成，又必须在数以千万计的吞吐规模与严苛的时效要求下完成检测。广告主在广告正式投产前必须获知素材的外观呈现以及是否会被打上 AI 标签，而分类器、隐形水印以及元数据解析等技术的大规模运行成本极高，每天针对百万级资产频繁调用会带来巨大的算力开销。 为了化解这一冲突，团队研发了一套两级检测架构（Two-tier System）。第一道防线依赖计算成本较低的确定性信号，例如广告主的主动申报与元数据标签，对上传的商品目录进行快速扫描预判；随后，后台独立的异步后处理系统会对目录中的每一件资产进行深度校验，以确认其真实的生成来源。这种时间差策略既满足了广告拍卖前毫秒级的展示反馈，又守住了合规底线。Sai Chandramouli 强调了对准确率的坚守：“我们有一套独立的系统，称之为‘持续合规’（Continuous Compliance），确保在整个广告投放周期内，每一个图片或视频资产的合规准确性都得到严格核验。” 主持人 Steve Dilla 亦补充道，这种架构完美平衡了法规强制要求、用户对透明标签的诉求，以及后台亚秒级广告竞拍（Sub-second Ad Auctions）的高性能指标。 ```mermaid flowchart TD accTitle: 广告资产 AI 检测两级架构 accDescr: 展示从广告主上传目录到快速预检与异步全量合规校验的分层处理流程 subgraph Upload["广告素材录入"] A["广告主上传商品目录<br/>(规模可达千万级资产)"] end subgraph Tier1["第一级：实时预检 (低延迟)"] B["确定性信号快速扫描<br/>(自主申报 / 元数据)"] C["生成初步标签预判<br/>(保障亚秒级竞拍与上线反馈)"] end subgraph Tier2["第二级：异步深度核验 (高精度)"] D["异步后处理系统<br/>(深度分类器 / 隐形水印检测)"] E["持续合规系统<br/>(周期内全量资产核验)"] end A --> B B --> C A --> D D --> E ``` - **最大广告资产目录**：单一广告主目录最高达到 1050 万个图像与视频资产。 - **系统核心机制**：前端结合确定性元数据提供秒级预览，后端“持续合规系统”通过异步处理保障全量数据零遗漏核查。 --- ### [13:46](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=826s) AI 检测器的算力权衡：分层级联与对抗性 Agent 面对飞速演进的生成技术，概率性检测模型（Detectors）面临着完全不同于元数据的算力困境。与处理成本近乎为零的元数据相比，检测模型的计算消耗会随着平台资产规模呈线性增长。更严峻的是，随着前沿生成模型不断生成逼近现实（Hyper-photorealistic）的高精度媒介，防御端也不得不部署参数更庞大、能力更顶尖的复杂大模型，导致单个资产的推理成本水涨船高。演讲者指出，当前业界已逐渐探索出两大核心分流策略：其一是提供不同性能档位的模型服务，通用基础模型以低成本覆盖全量资产，而消耗高算力的 Agent 决策系统则专用于高价值资产或申诉与错误预防（Mistake Prevention Appeals）等特殊场景；其二是构建级联检测系统（Cascade System），先由注重召回率（Recall）的轻量模型横扫全部库存作为粗筛，再将疑似样本移交给注重精确率（Precision）的重型模型作终审。 除了线上推理的算力优化，模型训练端同样面临着周期过长的结构性瓶颈。以往采用瀑布流式（Waterfall）的训练流程，往往需要耗费极长的研发迭代周期才能勉强跟上前沿生成模型的更新速度。如今业界正在转向对抗性智能体方案（Adversarial Agentic Solutions），通过部署对抗性 Agent 自主探测并定位现有检测模型的盲区与短板，实现自动化持续微调重训与快速部署，大幅缩短模型迭代交付的时间周期。Steve Dilla 借此回应了外界对“AI 必将摧毁一切安全防线”的悲观论调，指出真实情况是技术团队正利用 AI 构建具备同等规模防御能力的防护网。 - **阶梯式部署方案**：轻量级宽幅扫描模型（主打高召回率）与专家级 Agent 决策系统（主打高精确率与高危样本审核）相结合。 - **训练流程重塑**：弃用漫长的传统瀑布流训练，引入对抗性 Agent 主动挖掘模型漏洞并触发持续自动重训。 - **降本首要原则**：演讲者直言：“在考虑如何实现规模化时，我认为最终依然必须严重依赖内容来源标识，因为每带有一份确切来源标识的内容，模型就少了一份检测负担。” --- ### [16:37](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=997s) 隐形水印的不可能三角与定制化模型库 隐形水印在大规模工程落地中面临着另一层独特的数学与物理限制。Alexandre Mourachko 解释道，Meta 平台每天生成的 AI 内容达数百万计，长年累月累计的资产总量达数万亿级别，水印技术必须在这一体量下为每个资产注入独一无二的信号。在数字水印学术与工程领域，始终存在着相互制约的“不可能三角”：不可感知性（Imperceptibility）、鲁棒性（Robustness）与容量（Capacity）。不可感知性要求水印在视觉或听觉上完全无痕；鲁棒性要求内容在经历裁剪、压缩或色彩变动后仍能提取出标记；而容量则决定了媒介内部能够隐藏的比特信息量（例如图像通常嵌入 256 位）。 三者之间存在着不可调和的技术张力：若追求极高的信息容量与极强的抗破坏鲁棒性，就必然会牺牲画质，引入肉眼可见的噪点或伪影。Alexandre Mourachko 形象地比喻道：“通常这三个维度构成了一个三角关系，你可以选择其中两项并将其最大化，但你不可能三者兼得。” 更复杂的挑战在于，Meta 旗下不同业务线对这三项指标的容忍阈值截然不同。有的产品对微弱伪影并不敏感，而有的产品则对视觉纯净度有着极其严苛的要求，绝对无法容忍画质受损。面对碎片化的业务诉求，团队放弃了打造“单一通用模型通吃所有场景”的幻想，转而构建了一套多形态的“水印模型库”（Collection of Watermarks）。这些模型各自处于“不可能三角”的不同权衡平衡点上，通过与整体检测栈动态协同，为各业务线提供兼具鲁棒性与画质保障的综合解决方案。 ### [19:15](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1155s) 技术栈回溯：元数据标准与平台面临的三大落地难题 围绕水印模型在不同产品需求间平衡的不可能三角，Alexandre Mourachko 坦言，全行业很难指望靠单一水印方案解决所有问题。主持人 Steve Dilla 随即承接这一观点，将讨论切回到行业层面的系统架构。他指出，随着对抗攻防和科研探索的极速推进，整个行业中涌现了大量的并行探索，例如 C2PA 等元数据标准，以及在创作者、内容编辑工具与平台托管方之间的跨端交互。为了帮大家理清全貌，Steve 梳理了防伪技术栈的分层结构：最顶层是创作者的主动申报（self-disclosure），向下依次是元数据（metadata）、水印（watermarking），以及最底层的分类器（classifiers）。他请 Mohit Diwan 展开谈谈平台每天在消费和解析这些内容时，元数据层面正在面临哪些实际状况。 ```mermaid flowchart TD accTitle: AI媒体溯源防御技术栈 accDescr: 展示从上层的主动申报到最底层的分类器四层架构 subgraph Stack["AI 溯源技术分层架构"] A["主动申报 (Self-disclosure)"] B["元数据标准 (Metadata / C2PA)"] C["数字水印 (Watermarking)"] D["AI 分类器与检测模型 (Classifiers)"] A --> B B --> C C --> D end ``` Mohit Diwan 从平台元数据消费端的视角，系统性地归纳了全行业普遍遭遇的三大核心挑战。第一是全行业缺乏一致的嵌入指导标准。“There is no coherent guideline across the industry who are using that and and and we see that in in many shape or form because sometimes a light edit can be called out as generated versus like a very salient edit.” Mohit 解释道，业界在“何时该嵌入元数据”、“嵌入到何种程度”以及“该信号究竟表达什么含义”上没有形成统一认知，导致轻微的局部微调与大范围的显著生成经常被混为一谈。第二是元数据的留存困难，因为在各大平台或工具链的多个上传节点上，元数据极容易被有意或无意地剥离丢弃。第三是区分“AI 生成”与“普通编辑”本身就是极难的边界判定问题。无论标准线划在哪里，都会存在大量的边缘案例（edge cases）。为了打破这种割裂局面，Meta 正试图通过推动 C2PA 等标准化组织来凝聚行业共识。 - 行业缺乏统一规范：无法量化区分是工具层面的细微修图（light edit）还是结构性的主体生成（salient edit）。 - 管道剥离严重：多节点转码和第三方平台上传极易丢失或清洗掉原始的 C2PA 标记。 - 临界模糊性：在编辑工具愈发智能的背景下，AI 编辑与 AI 生成的定义边界难以完全厘清。 --- ### [22:00](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1320s) 跨平台水印共享的两难死局：逆向工程与深度伪造冒用 话题顺势深入到数字水印领域。Alexandre Mourachko 分析道，水印在不同产品需求矩阵下的权衡取向差异，使得在 Meta 内部统一水印尚且极其困难，在全行业推行通用单一水印更是不切实际。更棘手的现实是，目前业内在水印模型构建上根本没有标准可循，彼此之间筑起了信息孤岛。例如，如果一段由 TikTok 上的 AI 模型生成的视频被搬运并发布到了 Meta 旗下平台，Meta 完全没有能力检测出该视频带有 TikTok 的 AI 水印；反过来，TikTok 也同样无法察觉搬运自 Meta AI 的内容。 ```mermaid flowchart LR accTitle: 跨平台水印模型共享的安全风险 accDescr: 说明直接共享嵌入器与检测器模型导致的逆向工程与伪造风险 A["平台 A 共享核心模型<br/>(嵌入器与检测器)"] --> B["接收方/第三方直接掌握权重"] B --> C["逆向工程破解水印机制"] C --> D1["无损抹除水印<br/>(规避平台监管)"] C --> D2["伪造数字签名/身份冒用<br/>(生成恶性深度伪造甩锅平台 A)"] ``` 针对这种跨平台互认的僵局，一种直觉的设想是“各家直接互通有无、共享模型”，但 Alexandre 直言这种做法存在极其严重的安全隐患。“If you share your watermarking embedder and your watermarking detector with another company, or even publicly, um they can use this information to actually reverse engineer your watermark.” Alexandre 强调，一旦把水印的嵌入器（embedder）与检测器（detector）交出去，外部人员就能利用这些模型参数对其逆向工程，其后果不仅在于他人可以极具针对性地高效擦除水印，更可怕的是可能引发“企业身份冒用”。恶意攻击者可以利用提取出的模型伪造水印，制造出耸人听闻的恶性深度伪造（deep fake），并将源头栽赃给 Meta。因此，目前业内仍不存在绝对安全的跨平台检测互通方案。Alexandre 透露，他的团队正将此作为未来一年的重点攻坚课题，致力于联手行业各方打造一种既能包容各家产品线差异、又能安全实现互认的全新开放标准。 - 跨平台互斥盲区：各厂商专属自研模型导致跨平台传播时无法自动识别对端来源。 - 共享模型带来安全暴露：检测器与嵌入器一旦开源或共享，等于公开密钥，极易被逆向针对。 - 伪造与声誉风险：逆向工程后恶意分子不仅能擦除追踪，还能伪造平台数字指纹制造伪证。 --- ### [24:33](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1473s) 路线图展望：超逼真内容治理、C2PA 工作坊与检测机制演进 随着小组讨论进入尾声，主持人 Steve Dilla 提醒大家当下正值制定路线图（road mapping）的窗口期，这也是众人齐聚一处的原因。他邀请各位嘉宾分享各自团队接下来最为核心的攻坚方向。Mohit Diwan 首先从面向普通用户的内容消费体验切入。他指出，团队目前在兼顾覆盖广度的同时，核心目标是将治理重心锚定在“对用户影响最显著、欺骗性最强”的内容上。特别是在 Karthic Veera 提到的超逼真（photorealism / hyper photorealism）内容泛滥的背景下，Meta 设立的“北极星”目标是确保用户能够一眼识破什么是 AI 生成，同时保护创作者的积极性，不让合规的创作工具因为算法误判而受到非预期的限流干扰，并在多国繁复的监管浪潮中寻求平衡。此外，Mohit 现场向业界同仁发出邀请，Meta 将于数周后在门洛帕克（Menlo Park）园区举办 C2PA 实践工作坊（C2PA plug fest），重点讨论生成物定义与嵌入规范等动手实操课题。 随后，针对检测算法的前沿路线，Karthic Veera 给出了技术发展的冷思考。“In the long run, detection is going to get harder and harder, right? So, we really need to leverage more of provenance in the long run and and have provenance answer more of the question on what is AI.” Karthic 认为，即便检测器模型能够借助更丰富的输入信号和更强的模型在短期内跟上生成模型的脚步，但从长远来看，仅凭检测算法本身只会越来越难。行业终究要依靠底层的内容溯源（provenance）来解答“何为 AI”，从而把分类器解放出来，让其专门去负责处理显著性（saliency）度量、主观价值裁量以及特定业务场景的精细化需求。针对广告业务（ads），团队则呼吁业界在 C2PA 标准的 RFC 提案与代码 PR（pull requests）上提升协作活跃度，加速全行业的标准收敛。Steve 总结道，尽管技术复杂度不断飙升，但前沿科研与落地系统的双轨迭代，必将推动业界对 AI 内容的把控能力持续演进。 - 治理抓手：在兼顾常规覆盖的同时，重拳把控高欺骗性的“超逼真”内容，并在严控造假与保护创作者流量分发之间保持平衡。 - 行业活动：Meta 在门洛帕克园区组织 C2PA Plug Fest，落地统一嵌入规范并推进行业级实操对接。 - 攻防分工演进：检测器难以永无止境地与生成对抗，未来应将“是否为 AI”的基础判别交还给溯源生态，让分类器回归内容危害度、显著性及业务策略判定。 - 标准化呼吁：推动 C2PA 在代码 Pull Request 与 RFC 上的全行业快速协同，加速广告与多模态标准的统一步伐。 ### [28:56](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1736s) 跨行业协作契机与内容溯源标准的未来展望 在讨论的收尾阶段，讲者重点强调了内容创作者、软件开发商与平台之间前所未有的合作机遇。无论是进行创作的内容创作者，还是负责开发用于编辑创作者及广告主上传内容软件的技术团队，如今都身处一个极为特殊的协作节点。讲者感慨这种合作态势在以往几乎闻所未闻，甚至原本处于激烈竞争关系的对手以及过去毫无业务交集的各方，如今都在真诚地寻求携手合作，因为全行业面对的是同一个亟待解决的生成式内容溯源与信任难题。正如讲者所指出的：“And I think everybody's facing the same problem, and so there's a lot of opportunities for collaboration on standards like C2PA, on watermarking and interoperability.” 讲者进一步展望了未来的技术演进与生态走向，指出随着针对生成式媒体的对抗性挑战（adversarial space）日益严峻，行业间的伙伴关系网络也在同频扩张，这将最终为平台用户和广大广告主带来切实而积极的成果。讲者在尾声向所有参会者与听众表达了感谢，期待未来一年在行业合作深化以及溯源技术标准升级方面取得更多实质性进展，并期盼在下一次年度活动中带来更多重磅更新。 - **全产业链生态协作**：涵盖一线内容创作者、第三方媒体编辑软件提供商、分发平台以及广告主，打破传统竞争壁垒以应对共同挑战。 - **核心标准化方向**：重点聚焦于 C2PA（内容溯源与真实性联盟）技术规范、数字水印（watermarking）技术以及跨系统与跨平台的互操作性（interoperability）。 - **对抗环境与生态协同效应**：随着生成式对抗技术与滥用风险的升级，多方协作的深度与防护机制的落地速度也将相应加快，保障用户体验与广告投放环境的透明可信。 ## Notable quotes > [24:33](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1473s) In the long run, detection is going to get harder and harder, right? So, we really need to leverage more of provenance in the long run and and have provenance answer more of the question on what is AI. — Karthic Veera > [22:00](https://www.youtube.com/watch?v=ld2Eow7MYoI&t=1320s) If you share your watermarking embedder and your watermarking detector with another company, or even publicly, um they can use this information to actually reverse engineer your watermark. — Alexandre Mourachko ## Mentioned Steve Dilla, Mohit Diwan, Sai Chandramouli, Karthic Veera, Alexandre Mourachko, Meta, Meta Superintelligence Labs, FAIR, Content Seal, C2PA, Facebook, Instagram, WhatsApp, TikTok ## Video description Moderator: Steve Dilla Panelists: Mohit Diwan, Sai Chandramouli, Karthic Veera, and Alexandre Mourachko [Source](https://www.youtube.com/watch?v=ld2Eow7MYoI)

[24:33] Karthic Veera: In the long run, detection is going to get harder and harder, right? So, we really need to leverage more of provenance in the long run and and have provenance answer more of the question on what is AI. [22:00] Alexandre Mourachko: If you share your watermarking embedder and your watermarking detector with another company, or even publicly, um they can use this information to actually reverse engineer your watermark.

[24:33] Karthic Veera: In the long run, detection is going to get harder and harder, so we really need to leverage more of provenance in the long run and have provenance answer more of the question on what is AI.

[0:04] The first panel after lunch always a [0:06] little tough. We're glad to be here. We [0:08] are here today to talk a little bit [0:10] about AI generated media and this is [0:12] obviously a huge growing space right now [0:14] in the industry. [0:16] I'd love to just introduce the panel. [0:17] What we're going to talk about has to do [0:19] if you're in the AI space a lot with [0:21] with what you're doing around detection [0:22] and labeling and things like that. And [0:24] if you're not in the AI space, what [0:25] we're going to cover is like the [0:27] principles of a scaled system in a [0:28] rapidly evolving space. And I think in [0:31] my time in tech, this has probably been [0:33] one of the fastest evolving spaces I've [0:35] worked in. We're sort of right at the [0:37] tip of the spear in terms of like the [0:38] adversarial space as well as just like [0:41] the good actor space and people trying [0:42] to use AI to improve their content. So, [0:44] that's a little bit of what we'll unpack [0:45] today. My name is Steve. I am a product [0:47] manager in the media foundation team at [0:49] Meta. [0:50] We [0:51] my specific part of the org deals with [0:53] what we call media intelligence, which [0:55] is basically using AI to understand [0:56] what's in media and where it came from. [0:58] And we use that to power things like [1:00] ranking and commerce use cases along [1:02] with trust and then of course the [1:04] providence topic that we are talking [1:06] about today. So, without further ado, [1:08] our panel, please give folks just a [1:09] sense of where you are in the org and [1:11] like the types of things you're working [1:12] on and then we'll get into things in [1:13] just a moment. [1:15] >> Cool. Thank you, Steve. My name is Alex [1:17] Morashko. I'm a research manager at FAIR [1:20] within the Meta Super Intelligence Labs. [1:22] My team is responsible for developing [1:25] Content Seal, which is the set of [1:27] watermarking models and and techniques [1:30] that we're using all across Meta, across [1:32] all of [1:33] our products to watermark images, video, [1:36] audio, and text. [1:39] >> Yeah. Hi, I'm Karthik Vedula. I'm a [1:40] product manager at Meta. [1:42] My team works on the content [1:44] understanding models that power Meta's [1:46] recommendation systems. My team also [1:48] focuses on building the detection models [1:50] for AI generated media. [1:52] >> Hi everybody. My name is Mohit Dewan. I [1:55] am part of Facebook Trust and Safety. [1:57] So, the models which Karthik develops, [1:59] that's the one which we consume and [2:02] uh provide labels and provide [2:04] enforcement on on top of and [2:06] deal with safety issues. [2:08] >> Hey everyone, I'm Sai. I'm the eng lead [2:11] for ads AI transparency. [2:14] We actually integrate all the fine [2:16] technologies these people develop across [2:18] the advertiser ecosystem. [2:20] >> So, okay, today I guess that we want to [2:22] get into this idea of AI-generated media [2:25] and provenance. I think maybe to start [2:26] before we get into like the technical [2:28] side and some of the scale questions, [2:29] it'd be great to just begin with like [2:31] what provenance is and kind of anchoring [2:32] to the space. And maybe Mohit, your your [2:34] team's been in this probably the longest [2:36] out of everybody on the stage in terms [2:38] of what you're doing on the Facebook [2:39] side. Could you help us just understand [2:41] like who are the people you think about [2:43] and who are you building for as you're [2:44] you're you're working on these systems? [2:46] >> Yeah, absolutely. So, we when we think [2:48] about who we serve, there are users, [2:51] there are creators, and Sai is going to [2:54] talk a little bit about advertisers as [2:55] well. But, as we think about building [2:58] these systems, our users are really like [3:01] you know [3:03] turned off with some of this [3:04] AI-generated content when they consume [3:06] on the platform. But, we've also learned [3:09] that when they do encounter this kind of [3:11] content, they want to clearly discern [3:13] what is and what is not AI so that they [3:15] are not misled. And this is this has [3:18] like very wide variations across [3:22] regions. In US, we see that users are [3:26] don't have a lot of appetite for this [3:27] kind of content. But, in India, there is [3:29] a lot more openness about this. On the [3:33] other side, as we are building for [3:35] users, we need to think about [3:38] the creators aspect as well. Along with [3:41] a lot of our companies, we are you know [3:43] pushing creators to use AI and they do [3:47] use [clears throat] it for a variety of [3:48] reasons, which goes from really like [3:52] small nitpicking noise removals to like [3:56] major transformations on the content. [3:59] And when we consume that and mask it for [4:02] users by showing maybe like a label on [4:05] this content which is this is created [4:07] with AI. All that [4:09] details are like masked and creators [4:12] don't think about like think about in [4:14] the sense that [4:16] we there is no proportional disclosure, [4:19] right? They want to really share what [4:22] that looks like. But maybe on the [4:24] advertiser side you can talk a little [4:25] bit about [4:27] on that front. [4:28] >> Yeah, I think [4:29] one of the things about our advertisers [4:31] is that they are getting to be very [4:33] AI-native. They're spending a lot of [4:35] cycles and investing towards AI tooling [4:37] for generating advertisements. They've [4:39] also been very proactive and like [4:41] working with us to figure out what's the [4:43] best way to communicate that [4:44] transparently to end users. [4:47] But we also have to balance that with [4:48] the advertiser expectation [4:51] on knowing how exactly an ad would look [4:53] like before it goes live because they [4:56] want to know what kind of disclosures or [4:58] AI labels we're placing on them. [5:01] >> Yeah, and I think just to come back to [5:03] see what you were asking like the core [5:05] goal over here is very simple in terms [5:08] of UX. [5:09] Users really want to understand what is [5:11] and what is not AI. And when we put [5:14] these labels on these content, that's [5:16] what we are helping them do. Now all the [5:19] systems all the creator equities which [5:23] we are balancing are going to be part of [5:25] the risks we manage as we develop this [5:28] game. [5:29] >> Yeah. So, okay, that's a little bit [5:32] about the space and I maybe as you've [5:33] been scrolling through like Instagram or [5:35] Facebook you've come across some of [5:36] these labels. So, the system that powers [5:38] that is sort of what's represented on [5:39] the stage here the teams that are [5:41] represented here at least. [5:43] Site in on the ad side of the house you [5:45] guys have been working on deploying that [5:47] system maybe even ahead of some of what [5:48] we've done in organic. And could you [5:50] just walk us through like what's the [5:51] stack? How do you think about this? And [5:53] then I think we want to go deep into the [5:55] things that the people here care about [5:56] which is like how do you operate a [5:57] system of this scale across billions of [5:59] pieces of media, billions of users, [6:02] and and there's quite a quite a lot of [6:03] technical detail I think we can get [6:05] into. [6:06] >> Yeah, sure. So, I think for the [6:08] technical stack itself, we are we've [6:10] always been thinking about it as a [6:12] multi-layered stack. We use multiple [6:14] incoming signals to determine if AI was [6:16] used or not. So, we use deterministic [6:19] signals. One of the lightest weight ones [6:21] would be getting a self-disclosure from [6:23] the advertiser themselves. Like just [6:25] them telling us, "Hey, we used AI as [6:27] part of this to make changes to X, Y, [6:29] and Z." We augment that with other [6:32] deterministic metadata like industry [6:35] standards like C2PA to get more details [6:37] on what exactly was changed. We're also [6:40] integrating with Alex's Karthik's teams' [6:43] outputs which are like classifiers and [6:45] invisible watermarks. [6:48] >> I can go a little bit into the [6:49] classifier side of things. For modeling, [6:52] there are I'd say two key product [6:54] problems we're trying to solve. One is [6:56] coverage. Provenance is definitely [6:59] maturing in industry. But a good chunk [7:02] of the content that comes into our [7:04] inventory does not have provenance [7:06] information. So, that's where [7:07] classifiers act as a backstop providing [7:10] that coverage you need across the entire [7:11] inventory. [7:12] And and the biggest challenge you need [7:14] to solve here is basically keeping pace [7:16] with the frontier generators, right? [7:18] Just last year, I think we have gone [7:20] from, you know, extra fingers and [7:22] missing limbs from generated content to [7:25] ultra hyperrealistic content, right? So, [7:28] the challenge is definitely keeping pace [7:30] with detection when provenance is not in [7:32] available. [7:34] The second challenge we try to solve is [7:36] actually providing more fidelity. As As [7:38] Smote was talking about, you know, [7:40] product use cases cannot leverage these [7:43] signals as is. When you think about [7:46] provenance, it it kind of detects AI [7:48] very broadly. Rightly so. But [7:52] kind of given that the technology is [7:53] headed, right? Especially with AI edits, [7:56] you kind of start seeing a scenario [7:58] where a user trying to add a simple [8:00] sticker to a real picture or trying to [8:02] add a caption can get labeled as AI [8:05] generated media. You do not want that, [8:07] right? Like you cause a lot of label [8:09] dilution and you also create create a [8:11] backlash. So, that's where classifiers [8:13] come in where they can add that extra [8:15] level of judgement to kind of what is [8:17] the content that our users and creators [8:20] more care about and provide that [8:22] fidelity for use cases. [8:25] >> Um and to come back to what Sai [8:27] introduced, we're using an entire stack [8:29] for for provenance. We're using [8:30] metadata, we're using classifiers, [8:34] but we're also using invisible [8:36] watermarking. [8:37] And it watermarking overall complements [8:39] the stack. [8:40] Instead of, you know, passively looking [8:43] at the content once it's been created, [8:45] analyzing it, giving [8:47] an opinion on whether or not it's EIGM [8:49] or not, [8:50] here we're with watermarking we're doing [8:52] an active detection instead. So, the [8:54] idea is that um [8:56] conceptually you're injecting a signal [8:59] directly into into the media that, you [9:02] know, with the naked eye, in the case of [9:04] any image, you cannot see or in the case [9:06] of a video you cannot really [9:08] observe or for audio you cannot hear it. [9:11] And this signal you can still detect it [9:14] as the, you know, media is being is [9:16] being shared online. [9:18] This has nice properties, [9:21] especially in in the fact that it's [9:22] typically very high precision. So, you [9:25] can you can trust the signal, this [9:27] detection. [9:29] But more importantly, it's it's fairly [9:30] robust. [9:32] In the case of metadata, you can you can [9:33] add a lot of information and it's super [9:35] rich, right? What you can put inside of [9:37] metadata, but [9:39] metadata typically does not survive [9:41] when content is being shared online. [9:45] Either, you know, [9:46] people would remove the data metadata [9:48] intentionally or just by mistake. [9:51] Chances are when you open an image, for [9:54] example, inside of [9:56] an edit you know, edit software, [9:59] when you save the the content it will [10:00] not save it with the metadata. [10:02] And here watermarking comes in clutch [10:05] because [10:06] it will survive actually, [10:09] you know, that this kind of sharing [10:11] process [10:12] with the media. [10:14] So, typically with a watermark will [10:15] survive things like flipping the image [10:19] or changing the brightness, changing the [10:20] colors. [10:21] So, overall this, you know, with this [10:23] text stack we've got a nice set of [10:26] solutions to be sure that we we can [10:28] detect [10:30] AI generated media [10:31] at scale. [10:32] >> Yeah, okay. So, thanks for walking us [10:33] through the stack. So, we have some [10:35] deterministic signal, we have some [10:37] probabilistic signal that we're working [10:38] on developing, and all of these together [10:41] work across basically all the media [10:43] coming in to any of Meta's properties, [10:44] whether that's Facebook or Instagram, [10:46] WhatsApp, across everything we're doing. [10:48] Um, obviously there's some engineering [10:50] challenges of operating a system of that [10:52] size. And maybe Sai we'll start with you [10:53] on the ad side because you not only have [10:55] all the scale that you think of when you [10:57] think of Meta, but you have the [10:58] non-obvious scale of like how large our [11:00] ads catalog actually is and what's [11:02] inside of it. What are What are you guys [11:03] working through right now? [11:04] >> I'm going to geek out a little bit till [11:06] Steve tells me to shut up here, but So, [11:08] on the ad side, like any large [11:10] advertising platform, Meta supports [11:12] catalog and dynamic ads. Some of our [11:15] catalogs can be in the millions. [11:17] Our largest catalog was actually 10.5 [11:20] million image and video assets together. [11:23] So, one of the key challenges around [11:25] this is we want to balance between [11:28] having the outcome of AI detection, [11:32] knowing whether something was AI [11:33] generated or not, and we also need to [11:36] balance it with the size and scale at [11:39] which we need to perform these [11:41] detections. [11:42] So, for instance, when when previously I [11:44] said advertisers want to know how the [11:47] ads are going to look like before they [11:48] go out, one of the things we need to do [11:50] is, if they uploaded a catalog of a [11:52] million items, we need to make sure that [11:54] we tell them that we are going to label [11:56] it as AI generated or not. [11:58] Part of the challenge here is not just [12:01] doing this in real time, but also the [12:03] the breadth of technologies that we're [12:05] using. We're using classifiers, we're [12:06] using invisible watermarks, we're using [12:08] metadata based standards. And all of [12:10] those don't come cheap, and when you're [12:12] running at millions of times per day for [12:15] every single ad catalog, [12:17] the scaling problem is huge. So, what we [12:19] have been investing towards, at least, [12:21] is trying to develop a two-tier system [12:24] where we did the like we depend on the [12:26] deterministic signals like [12:28] self-disclosures and metadata as like a [12:30] first line of defense. We do like a [12:32] quick scan through the catalog, figure [12:34] out if we can land up with an [12:37] AI-generated label. And then we also [12:39] build a separate post-processing [12:41] asynchronous system where every single [12:44] asset in the catalog is validated to be [12:48] absolutely sure whether AI was used or [12:50] not. And doing these [12:53] at different points in time gives us the [12:55] flexibility to kind of let advertisers [12:57] know what's going to happen and label [12:59] these before the ads go live. But at the [13:01] same time, we don't compromise on [13:03] correctness. We have like a separate [13:05] system, we call it continuous [13:07] compliance. We make sure that every [13:09] single [13:10] image or video asset is actually checked [13:12] for correctness over the course of an ad [13:15] campaign. [13:16] >> And so in this way you're sort of [13:17] balancing the like we have a regulatory [13:19] requirement obviously in this space to [13:20] like label AI content. We have a user [13:22] requirement, the users want it labeled, [13:24] but we also have these sub-second ad [13:26] auctions that need to happen and we need [13:27] to be able to maintain that performance. [13:29] So, okay, I appreciate you going deep [13:31] there. I actually want to go maybe to a [13:33] problem that's running on a different [13:34] time scale, which is in the detector [13:36] space. And and this is a space where [13:38] like not only are things evolving really [13:40] rapidly, but you've got to find a way to [13:42] like evolve the detectors at roughly the [13:44] same speed. [13:46] >> Yeah, definitely. On on the detector [13:47] side, I think the the challenge compared [13:50] to metadata is that metadata can come [13:52] cheaply, right? In terms of compute [13:54] cost. But with models, the compute cost [13:57] scales with inventory size. And second, [14:00] when you think about the frontier [14:01] generators, right? And these are hyper [14:03] photorealistic content, you really need [14:05] to also deploy very powerful large [14:08] models on the detection side. So, what [14:09] that means is that the compute cost per [14:11] item also increases. [14:14] So, we have of think the industry is [14:16] settling into strategies here in terms [14:18] of how we handle this. Uh [14:20] The first one is in terms of offering [14:22] these models at different performance [14:24] points, right? So, you can think of a a [14:27] model that is [14:30] competitive in terms of performance that [14:32] provides scale for your entire [14:33] inventory, while you can think of [14:35] another agentic system that is more [14:37] powerful, uh definitely comes with [14:39] higher cost, but you can apply to [14:41] high-value assets or for special use [14:43] cases like mistake prevention appeals. [14:46] Uh the second strategy is instead of [14:48] deploying one model as like a cascade [14:50] system where you have a cheaper model [14:52] that sweeps across the entire inventory, [14:55] uh focusing on recall, right? The goal [14:57] there is making sure you filter the [15:00] content for a more powerful second stage [15:02] of the model that can focus on [15:04] precision. And that's how you kind of [15:06] can scale based on both compute and cost [15:09] for these needs. [15:10] Uh but overall, when you think about how [15:11] do we scale, I think you still have to [15:13] fall back on prevalence heavily because [15:15] I mean prevalence heavily because every [15:18] piece of content that comes with [15:19] prevalence is one less for the model to [15:21] detect. [15:22] >> Yeah. Yeah, so this is kind of like [15:24] shaving off what can we shave off that [15:25] like becomes very cheap. And then I [15:26] think I what I hear from you is maybe [15:28] something that's getting more more [15:30] prominent with AI coding, which is like [15:32] it's just easy to code multiple [15:34] versions. It's easy to build a pipeline [15:36] that can handle things intelligently, [15:37] and we're no longer having to spend like [15:39] massive amounts of capacity to detect [15:41] things. [15:42] >> Very true. I I think again over here, [15:43] there are two parts to this. There is [15:45] the training side of it and the online [15:46] inference side of it. Uh while we talked [15:48] about the online inference, there is the [15:50] whole scaling challenge on the training [15:52] side. And, uh, I think where the [15:54] industry is moving towards is more of [15:57] adversarial agentic solutions where, [15:59] instead of the typical waterfall [16:01] training solutions where you have huge [16:03] cycles to catch up to new frontier [16:05] models, uh, [16:06] teams are deploying these adversarial [16:08] agents that can pinpoint where the model [16:10] has gaps and continuously retrain them, [16:13] deploy them, much reducing the, uh, [16:15] cycle time to reference the models. [16:17] >> Yeah. Yeah, I think that's one of the [16:18] things when you think about, like, I [16:19] hear a lot of the, you know, "AI is [16:21] going to basically break everything," [16:23] and there's a version of that that's [16:24] true. But there's also a version where [16:26] AI is also able to defend at AI scale [16:28] and, and we're starting to see that [16:30] across, like, the systems here at Meta. [16:32] I think Alex, your team's focused on [16:33] like sort of a different part part of [16:35] that same problem. [16:37] >> Um yeah, when it comes to scale, um [16:40] invisible watermarking has has a unique [16:42] set of challenges. Um [16:44] namely, at Meta at least we generate you [16:47] know, millions of of AI content, AI [16:50] pieces of media every day [16:52] and over time, you know, this counts in [16:54] in the trillions, right? And so we have [16:56] to make sure that invisible watermarking [16:57] can actually inject a kind of a unique [16:59] signal [17:00] even at this kind of scale. Um taking a [17:03] step back real quick, in the field of [17:05] watermarking, there are typically three [17:07] axes that are kind of, you know, um [17:11] that kind of play against each other. Um [17:13] you've got imperceptibility, it's [17:15] natural, right? You don't want the [17:16] watermark. It has to be invisible or [17:18] inaudible, so you don't want people to [17:20] realize that there is a watermark there. [17:23] Um you've got robustness, so you do want [17:25] to keep the watermark even if people are [17:28] slightly modifying the content. Uh and [17:30] then you've got capacity. [17:33] Typically, the those models they don't [17:35] just inject a binary signal into the [17:37] media. They actually hide a series of [17:39] bits. [17:40] In for example, in the case of of [17:42] images, you typically will hide 256 bits [17:46] or something like that. Um and so this [17:49] restricts actually the the amount of [17:50] information that you can embed inside of [17:52] the media. Um if you if you do the math, [17:55] you know, you can you can only go [17:57] so high in terms of unique signatures [17:59] that that you can hide there. So you've [18:01] got tension. [18:03] Uh you've got tension between having [18:05] super high capacity, having super high [18:07] robustness, and at the same time having [18:10] high imperceptibility. Typically, those [18:12] those three things are on a triangle, [18:14] right? You can pick two, maximize them, [18:16] but you cannot pick three. Um [18:18] and this is even more complex as at [18:21] least at Meta, but I also suspect across [18:22] the industry, [18:24] every single product will have its own [18:26] requirements. [18:27] So, we've got some products that are [18:29] fine with, you know, having a watermark [18:31] that is slightly perceptible with maybe [18:33] a few artifacts, but then you've got [18:36] some [18:37] products where it's absolutely [18:39] intolerable to to see anything. So, the [18:43] way we're we're solving this [18:45] is rather than having one single model [18:49] to rule them all, right? One single [18:51] watermark, we have more of a collection [18:53] of of watermarks. [18:55] And some of them will be, you know, at [18:57] they will all operate at a different [18:59] operating point across the three [19:01] axes. [19:03] And together with the rest of the stack, [19:04] we can offer, [19:06] you know, a comprehensive solution, a [19:07] holistic solution that is rather robust [19:10] overall. And we'll come back to this in [19:13] a minute, but this is this challenge [19:15] around, you know, balancing those three [19:17] axes and having different product [19:19] requirements; is also one of the sources [19:22] of [19:23] well, one of the reasons why I think [19:25] across the industry, we cannot have a [19:27] single watermark [19:29] for all of us. But we'll come back to [19:31] this in a minute. [19:31] >> Yeah, so okay, we haven't gotten into a [19:33] lot of the industry bit of this yet. And [19:35] it's one of the more interesting things. [19:37] And I mentioned earlier like this is [19:38] obviously such a fast-moving space. It's [19:40] a fast-moving space as we've talked [19:42] about in adversarial. It's a fast-moving [19:44] space in what we're doing for our [19:45] research front. [19:47] But it's also fast-moving in that a lot [19:48] of folks are actually trying to solve [19:49] this problem in parallel. And so, there [19:51] are standards for metadata like C2PA. [19:54] There are different ways that we're [19:56] interacting across like content creators [19:59] and content editors and like the [20:00] platforms that are hosting things. And [20:02] and I think to give folks a sense of [20:04] like what's happening, it might help to [20:05] go back up in the stack. So, we talked [20:07] about at the top of the stack, we have [20:08] self-disclosure and then we have [20:09] metadata and then classifiers and or [20:11] sorry, watermarking and then [20:12] classifiers. Let's move back up for a [20:14] second to metadata. And Mohit, like what [20:16] are we seeing in metadata standards and [20:18] like some of the things that are coming [20:19] into the platform on on the pieces of [20:21] content each day? [20:22] >> Yeah, the way [clears throat] [20:24] from the consumption side as we are [20:25] consuming metadata more and more, the [20:28] three key challenges which we are facing [20:31] across the border [20:33] as you kind of kind of rightly called [20:35] out the standard of when to embed [20:39] metadata, to what extent, and what [20:42] signal that is providing. There is no [20:45] coherent guideline across the industry [20:47] who [20:49] are using that and and and we see that [20:51] in in many shape or form because [20:53] sometimes a light edit can be called out [20:55] as generated versus like [20:59] a very salient edit. So, A, there is [21:02] very challenge on [21:05] the consistent guideline. The other part [21:08] is really like the preservation of [21:10] metadata as as we see [21:13] that, you know, you can very easily [21:15] strip it out on multiple upload points. [21:19] And and then lastly, like it is a very [21:21] hard problem to identify what is [21:24] generated versus what is edited because [21:27] as you develop these guidelines and no [21:29] matter wherever you draw the line, [21:31] there's always borderline and there's [21:33] there's always like these edge cases [21:35] which you will not be good at. So, as we [21:38] are consuming this over and over again, [21:40] what we are trying to do is [21:42] bring some coherence across industry [21:45] with [21:46] you know, some upcoming [21:48] initiatives led by Meta within C2PA [21:50] which will definitely dive dive in [21:53] further, but those are some of the key [21:54] challenges which we are facing across [21:56] metadata. I think it's very similar to [21:57] like watermarking as well. [22:00] >> Yeah, do you want to cover watermarking? [22:01] >> Yeah, yeah, for sure. So, like I was [22:03] saying earlier, [22:05] you know, each product has its own kind [22:06] of [22:07] preference with respect to where you sit [22:09] on this triangle. [22:11] And because of this reason, yeah, you [22:12] cannot imagine that a single watermark [22:14] can can work across the industry, right? [22:16] If we already have this problem inside [22:18] of Meta, you can imagine that it's it's [22:20] even bigger problem across the industry. [22:23] And what's more um [22:26] as of today, there is no standard to [22:29] developing one of those watermarking [22:30] models. [22:32] Um and then typically, if, you know, as [22:35] uh as Meta would develop a watermarking [22:36] model, um [22:39] other actors in the industry cannot [22:41] detect this watermark. Um and so, what [22:44] could happen concretely is is if a piece [22:47] of AI content is being generated, for [22:49] example, on on TikTok, right? And it [22:51] gets also shared um on Meta platforms. [22:54] Well, we cannot know that it's coming [22:55] from an AI model from TikTok. And they [22:58] cannot know either if if ever we are [23:00] sharing something created with a Meta AI [23:02] over there. Um [23:03] so, there is uh there is a tension here. [23:06] How do we make it so that everybody can [23:08] read each other's watermarks, right? And [23:10] so, one could think, "Okay, [23:12] you could make it simple, right? Just [23:14] share models across across um [23:17] uh companies." But, the problem when [23:19] doing this is as soon as you share your [23:22] watermarking uh models with some [23:23] somebody else, you expose yourself to [23:25] risk. Um if you share your watermarking [23:27] embedder and your watermarking detector [23:30] with another company, or even publicly, [23:32] um they can use this information to [23:34] actually reverse engineer your [23:35] watermark. And so, what could happen is [23:37] that, I mean, it gives them power to [23:39] very efficiently um remove your [23:41] watermarks from your content, but also [23:43] impersonate your your company. So, uh [23:46] someone could pass uh you know, uh as as [23:48] Meta saying, you know, creating a hor- [23:50] horrendous deep fake um and using this [23:53] these models, right? Um [23:55] to say that it was actually generated by [23:56] Meta. Um so, as of today, there is no [24:00] absolutely uh safe way to go about this. [24:02] Um [24:03] and this is one of the research areas [24:05] that my team is uh very excited uh [24:08] about. I think it's it's it's going to [24:10] give us uh work for for the next year. [24:13] Um, and we're actually looking to [24:15] collaborate with, um, you know, other [24:16] companies on this kind of research [24:19] project; on developing together kind of, [24:21] um, [24:22] a standard that is, uh, still open [24:24] enough that it caters to all of the [24:26] product requirements across the [24:28] industry, [24:29] uh, but makes it so that everybody can [24:31] read each other's watermark in a safe [24:32] way. [24:33] >> Yeah, okay. I think you set us up [24:35] actually well the play on the plane [24:36] here. We're coming up in the last few [24:37] minutes. [24:39] Obviously road mapping season. So that's [24:42] all also part of why we're all in in in [24:43] BK right now. [24:45] Help me understand a little bit about [24:46] what your teams are thinking about. What [24:47] are the challenges that are ahead? What [24:49] are the things that are sort of top of [24:50] mind? [24:51] And I think maybe like Mo hit let's [24:53] let's start with you on on kind of like [24:54] the tip of the spear here and what users [24:56] are seeing and what they're experiencing [24:57] on the platforms. [24:58] >> Yeah, absolutely. And [25:00] like I mentioned, what we are optimizing [25:02] for right now is like the coverage and [25:05] making sure that the breadth is is fine, [25:08] but at the same time we want to make [25:10] sure that we meet users with their [25:13] needs. That the content is label when [25:16] it's most impactful for them [25:18] and when it's most deceiving. So that [25:20] has been like the the forward-looking [25:22] focus. [25:23] Photorealism is one area where like an [25:26] hyper photorealism as Karthik called out [25:27] is one area which users are very [25:30] deceived, [25:31] but our our North Star here is to make [25:33] sure that users are able to clearly [25:35] discern what is AI versus not. Creators [25:39] feel confident in using these tools such [25:42] that it doesn't like, you know, [25:44] impact their distribution in a way that [25:47] they don't anticipate. And at the same [25:50] time like, you know, there are always [25:52] barrage of regulations which we are all [25:54] dealing with. [25:55] Those are some of the equities which we [25:57] are like, you know, balancing as we move [25:59] forward. And I think one of the [26:01] challenges which we also spoke about [26:03] around metadata specifically, we want to [26:06] develop these coherent guidelines. [26:09] We use this coalition called C2PA. If if [26:13] your organization is part of that, [26:15] please work with your, you know, partner [26:18] managers. We are as Meta organizing a [26:20] C2PA plug fest where we talk about these [26:23] guidelines on when do we consider [26:25] something generated, how do we embed [26:27] this metadata and provide this guidance [26:30] and very hands-on working session in a [26:32] couple of weeks here in Menlo Park. So, [26:35] would be great if you can join forces [26:38] with us. But, you know, those are some [26:40] of the ideas which we are thinking about [26:42] as we move forward. [26:43] >> Yeah. Yeah, and Alex, you you already [26:45] got into a few, but I I think there may [26:46] be a little more that you guys are also [26:47] kind of gearing toward. [26:49] >> Uh yeah, so like I said, the the [26:50] biggest, you know, challenge that we'll [26:52] have going forward is is really to work [26:54] all together towards this [26:56] this kind of industry standard if if we [26:59] if we will. [27:01] We've got several ways on on how to [27:03] achieve this. [27:04] My my team has started, you know, [27:06] thinking about concretely or from a [27:08] technical standpoint, how can you uh [27:11] get there? And we've got a [27:14] you know, a bunch of different proposals [27:16] and we're very open to, you know, [27:18] sharing this different [27:20] technical path with potential partners [27:22] and potentially with some of you in this [27:24] in this audience. [27:26] I I do think it will take time. Um but, [27:29] the research is is definitely worth it [27:31] for for the user and also in terms of [27:33] content, this is very cool, exciting [27:36] exciting research because nothing like [27:37] this exists today. [27:39] >> Yeah. Yeah, and Karthik, for detectors, [27:41] the rapidly moving space here. [27:43] >> Uh [27:44] Yeah, for detectors, we believe [27:46] detectors are going to keep pace maybe [27:48] by using richer inputs, stronger models. [27:51] But, in the long run, detection is going [27:54] to get harder and harder, right? So, we [27:55] really need to leverage more of [27:58] provenance in the long run and and have [28:01] provenance answer more of the question [28:03] on what is AI. So, freeing up the [28:05] classifier to answer questions [28:07] provenance cannot, like saliency and [28:09] judgment and driving some of the product [28:12] use cases. Yeah. [28:13] >> Yeah. How about in ads? [28:15] >> I think we are focusing on like industry [28:17] standardization around metadata. We have [28:19] we've been contributing there. One ask I [28:22] would have is like, you know, there [28:23] there are tons of companies involved in [28:25] this process. So, it would be great if [28:27] we could get more traction on like the [28:29] RFCs and like active pull requests in [28:31] the C2PS standard so that we can all [28:33] converge at a faster rate. [28:35] >> So, I think as you [28:37] look forward, I think what I hear from [28:39] all of you is like [28:40] lots of frontier research, lots of [28:43] evolution of at scale systems that are [28:44] currently deployed. And I think like if [28:46] I'm sitting in the audience today, like [28:48] the things that I would think about are [28:49] you can expect control over AI content [28:52] to evolve and get better and better over [28:53] time, even as the space is getting more [28:55] complex. [28:56] If you're somebody who's a content [28:57] creator, or you are somebody who runs [29:00] one of the one of the pieces of software [29:01] that edits content that creators or [29:03] advertisers put on our platforms, the [29:05] the opportunity for partnership here is [29:06] actually unlike anything I've seen also [29:09] in the past, where it's like people are [29:10] genuinely trying to work together people [29:12] that are competitors and people that [29:14] generally haven't been in the space [29:15] together. And and I think everybody's [29:16] facing the same problem, and so there's [29:18] a lot of opportunities for collaboration [29:20] on standards like C2PA, on watermarking [29:22] and interoperability. And I think what [29:25] we'll see over time is that again, as [29:27] the adversarial space grows, so does the [29:28] partnership space, and so do like really [29:30] good outcomes for our users and [29:32] advertisers. So, thanks to everyone for [29:34] the time today. It's been great to be [29:35] with you. [29:36] We hope to be back again next year with [29:38] more updates on like advancements in [29:40] partnership and advancements in [29:41] standards. [29:42] And this has just been great to chat [29:44] with you guys.