Code of Practice on Transparency of AI-Generated Content (marcatura ed etichettatura dei contenuti generati o manipolati dall'IA)

Signatories will implement marking and detection solutions which, together, maintain intended performance levels under varying conditions, covering both common alterations and adversarial attacks, to the extent technically feasible, and in alignment with the state of the art. This requirement does not apply to AI systems that are exceptionally subject only to one layer of metadata marking as specified in Measure 1.1.

First, Signatories will ensure their marking and detection solutions are robust to typical processing operations that may introduce varying degrees of distortion based on underlying parameter settings. Typical processing operations include:

a) in-place modifications, e.g. noise addition / removal, filtering, (re)compression, screenshot / screencasting, voice enhancement, lexical substitution, homoglyphs, change of file format, etc;

b) desynchronisation mechanisms, e.g. mirroring, cropping, up/downscaling, rotation, aspect ratio change, pitch shifting, time stretching, characters insertion / deletion, paraphrasing, translation cycles, etc;

c) survival of the analogue hole, e.g. print-and-scan (and optical character recognition), audio playback and recording, screen camcording, etc. Moreover, Signatories will ensure that detection is robust to localised changes to the content, for example if users decide to blur faces for privacy reasons prior to submission of the content to the detection solution of the Signatory. Second, Signatories will ensure that adversarial robustness of their marking and detection solutions is assessed in terms of resilience to malicious behaviour such as copying, removal, regeneration, and modification attacks on the markings. Signatories will measure robustness to malicious behaviour by the ability of the marking and detection solutions to verify marking integrity, i.e. whether a mark has been tampered with or modified to misrepresent the origin of the content. Signatories will choose the considered malicious behaviour as plausible real-world threats based on the type of content, the type of mark and the context of deployment and dissemination of the content. Signatories are encouraged to apply standard cybersecurity practices, such as rate limits, to prevent and counteract malicious use and attacks against their marking and detection solutions. Signatories are encouraged to frequently update their threat assessment to keep up to date with changes in the threat landscape. To assess the robustness to typical processing operations and malicious behaviour, Signatories will use the same performance metrics as for the reliability requirement in Measure 3.2.