AI Watermarking: How to Tell If Content Was Made by AI

During the 2024 US presidential campaign, AI-generated robocalls impersonating President Biden’s voice were used to discourage Democratic voters from participating in the New Hampshire primary. The Federal Communications Commission moved quickly — banning AI voice cloning in robocalls in February 2024. But the incident underscored a technical reality: by the time a deepfake is identified and acted upon, the damage is often done.

Watermarking promises a better approach: rather than trying to detect AI-generated content after the fact, watermarks embed verifiable signals at the moment of creation. The idea is borrowed from traditional media — invisible marks embedded in digital files that identify their origin — but the AI implementation goes significantly further.

What Is AI Watermarking?

AI watermarking refers to techniques that embed imperceptible signals in AI-generated content — images, audio, text, or video — that can later be detected to identify the content as AI-generated and/or trace its origin.

Unlike traditional digital watermarks (which might be visible or easily removed), AI watermarks are designed to be:

• Imperceptible: Indistinguishable from unwatermarked content to human perception
• Robust: Survivable through common modifications (cropping, compression, screenshot, format conversion)
• Verifiable: Detectable by authorized systems even after those modifications
• Informative: Potentially carrying metadata about creation date, tool, and version

How AI Watermarking Works Technically

Image Watermarking: Pixel-Level Modifications

For AI-generated images, watermarks are typically embedded by making imperceptible changes to pixel values during the generation process. These changes follow patterns that are statistically detectable but invisible to humans.

Google’s SynthID, developed by DeepMind and deployed in Imagen 3 (announced May 2023, widely deployed 2024), embeds watermarks in two layers:

• Image watermark: Imperceptible pattern embedded in pixel values using a trained neural network that optimizes for both imperceptibility and detectability
• Spectral watermark: Pattern embedded in the frequency domain of the image, making it more robust to spatial transformations

SynthID has been tested against cropping up to 75% of an image, color adjustments, JPEG compression down to quality 50, and screenshots — and maintains detection capability across all these modifications.

Audio Watermarking

Audio watermarking modifies the spectrogram — the frequency-time representation of sound — in ways imperceptible to human ears but detectable by machines. Google’s SynthID audio watermark is embedded in Lyria (Google’s music generation model) and has also been applied to AI speech synthesis.

In 2024, Meta released AudioSeal, an open-source audio watermarking system that claims state-of-the-art robustness against time stretching, noise addition, and lossy compression while remaining imperceptible to listeners.

Text Watermarking

Text watermarking is technically harder because text lacks continuous values to perturb slightly — it consists of discrete tokens. Two main approaches:

• Vocabulary partitioning (green/red lists): The Kirchenbauer et al. (2023) method from University of Maryland partitions vocabulary tokens into ‘green’ and ‘red’ lists at generation time and biases the model to choose green tokens. The resulting text has a statistically detectable excess of green tokens invisible to readers.
• Semantic watermarking: Selects synonyms or syntactic variants that preserve meaning but follow a detectable pattern. More robust to paraphrasing than token-level methods but harder to implement.

OpenAI has internally developed text watermarking technology but had not broadly deployed it as of early 2026, citing concerns about users evading it and potential impacts on non-English languages where vocabulary partitioning is less equitable.

The Coalition for Content Provenance and Authenticity (C2PA)

Alongside watermarking, the C2PA standard offers a different approach: cryptographically signed provenance metadata that travels with content. Instead of imperceptible signals, C2PA attaches a ‘content credentials’ manifest to files that records:

• What tool created the content (Adobe Firefly, DALL-E, etc.)
• What edits were made and with which tools
• When and by whom (with optional identity assertions)
• Whether training data was used from opt-out sources

The C2PA standard, governed by the Joint Development Foundation, is backed by Adobe, Microsoft, Intel, Arm, BBC, CBC, and over 100 other organizations. Adobe Content Credentials (released 2023) is the most deployed consumer implementation.

Major camera manufacturers are adopting C2PA: Nikon’s Z9 and Canon EOS R1 both support in-camera Content Credentials signing, allowing photojournalists to cryptographically certify that an image is authentic camera capture unmodified by AI.

Regulatory Push for Watermarking

Governments are increasingly mandating or encouraging AI watermarking:

• Biden EO 14110 (October 2023): Directed NIST and Commerce to develop watermarking standards for AI-generated content — provisions carried forward in agency guidance even after the EO’s revocation
• EU AI Act (Article 50): Requires providers of AI systems generating synthetic content to ensure outputs are marked as artificially generated ‘in a machine-readable format’
• EU Digital Services Act: Requires very large online platforms to label AI-generated content in political advertising
• China’s Generative AI Regulations (effective August 2023): Require watermarking of AI-generated content — China was among the first countries to mandate this
• California AB 2839/2355 (2024): Requires disclosure of AI-generated content in political ads; AI developers must disclose watermarking capabilities

In July 2023, seven leading AI companies — Anthropic, Google, Meta, Microsoft, OpenAI, Amazon, and Inflection — voluntarily committed to the Biden White House to develop and deploy watermarking technologies. This commitment was formalized in October 2023 as part of the White House’s ‘Voluntary AI Commitments.’

Limitations and Attack Vectors

No watermarking system is foolproof. Documented limitations include:

• Regeneration attacks: Passing a watermarked image through another image generation model removes the watermark while preserving quality
• Diffusion purification: Adding and removing noise using diffusion models can strip watermarks
• Collusion attacks: Averaging or blending multiple watermarked images can neutralize individual marks
• C2PA stripping: C2PA metadata can be stripped by re-saving files without credentials; platforms that strip metadata (many social networks do this by default) destroy the chain of custody
• Analog hole: Photographing a watermarked image displayed on a screen removes digital watermarks

Researchers at the University of Maryland (2023) demonstrated that the Kirchenbauer text watermarking scheme could be partially evaded through paraphrasing. Meta’s AudioSeal researchers explicitly benchmark against adaptive adversaries.

This creates a fundamental tension: watermarking provides genuine value in non-adversarial contexts (e.g., allowing platforms to identify and label AI content at scale) but cannot provide guarantees against determined adversaries. The technology works best as part of a broader ecosystem — alongside platform policies, legal deterrents, and media literacy education.

The 2024 Presidential Election as a Test Case

The 2024 US election was the first in which AI-generated deepfakes were deployed at meaningful scale in political contexts. Beyond the New Hampshire robocalls, documented incidents included:

• AI-generated images of Donald Trump with Black voters that spread virally on social media
• AI-synthesized audio clips of candidates circulated on encrypted messaging platforms
• AI-generated videos used in political ads in multiple state and local races

Detection-focused organizations like the Partnership on AI and the Content Authenticity Initiative found that virtually none of the AI-generated political content in circulation carried C2PA credentials or detectable watermarks — highlighting the gap between voluntary commitments and deployed reality. The 2026 and 2028 election cycles will be critical tests of whether mandatory watermarking requirements produce meaningful uptake.

Frequently Asked Questions

What is Google SynthID and how does it work?

Google SynthID is an AI watermarking system developed by DeepMind, deployed in Google’s Imagen and Lyria models. It embeds imperceptible patterns into image pixel values and audio spectrograms at generation time. The patterns survive common modifications like JPEG compression, cropping, and screenshots. Detection requires access to Google’s verification system — the watermark is not self-evident.

Can AI watermarks be removed?

Yes, with effort. Regeneration attacks (passing content through another AI generator), diffusion purification, and format conversion can degrade or remove watermarks. C2PA metadata is stripped by most social media platforms automatically. No current watermarking system provides guarantees against a technically sophisticated adversary. The systems work well for platform-scale detection in non-adversarial contexts.

What is C2PA and how is it different from watermarking?

C2PA (Coalition for Content Provenance and Authenticity) is a standard for attaching cryptographically signed provenance metadata to digital files, recording how content was created and modified. Unlike watermarking (which hides signals inside content), C2PA attaches visible and verifiable metadata. It’s more informative but also more easily stripped by re-saving files.

Is AI watermarking required by law?

The EU AI Act (Article 50) requires AI-generated content to be marked in machine-readable format. China’s Generative AI Regulations (effective August 2023) require watermarking. The US has moved more slowly — voluntary commitments from major AI companies exist, but no federal law mandates watermarking as of early 2026. Several US states are pursuing requirements for political advertising specifically.

Will AI watermarking solve the deepfake problem?

Not on its own. Watermarking is a valuable component of a broader solution that also needs to include platform policies, legal penalties for harmful deepfakes, media literacy education, and detection tools. Because watermarks can be removed by adversaries and are absent from content generated by open-source tools (like Stable Diffusion), they can’t provide universal guarantees. They work best for labeled, platform-deployed content where bad actors haven’t specifically targeted the watermarking system.

Sources

• Grokipedia
• Stanford HAI AI Index Report

Related reading: AI Content Detection Tools | AI and Copyright Law | AI Ethics for Beginners | AI Image Generation | AI Content Creation

Sources: Google DeepMind SynthID technical report (2023/2024), C2PA specification v2.0, Kirchenbauer et al. ‘A Watermark for LLMs’ (2023), Meta AudioSeal (2024), Biden White House Voluntary AI Commitments (2023), FCC deepfake robocall ruling (2024).

You May Also Like

• What Is Artificial Intelligence
• Best AI Tools for Beginners
• How to Use AI
• AI Tools Directory
• Best Free AI Courses