# AI watermarking and provenance

AI watermarking hides a detectable signal in generated text, images, audio or video, and provenance records where content came from. Learn methods, limits and the rules.

## Overview

AI watermarking means hiding a signal inside content produced by a generative model, so that a detector can later say "this was very likely made by that system". The signal is designed to be invisible or inaudible to people and to survive ordinary handling such as cropping, compression or light editing. Provenance is the broader idea of recording where a piece of content came from and what happened to it, typically as cryptographically signed metadata attached to the file.

Both respond to the same problem. [Generative models](/topics/generative-ai-llms) now produce text, images, voices and video that people often cannot tell apart from human work. That creates risks such as misinformation, fraud with cloned voices, academic dishonesty and non-consensual deepfakes. It also creates practical needs: platforms want to label content, newsrooms want to show that a photo is genuine, and regulators, notably in the EU and China, now require some machine-readable marking of AI output.

An everyday picture: banknotes. A note carries a watermark you can see when you hold it to the light, and also security features that only a machine can check. Separately, a bank keeps records showing where large sums came from. AI watermarking is like the hidden security feature inside the note itself; provenance metadata is like the paper trail. Neither is perfect. Forgers learn to imitate features, and paper trails can be lost. Used together, they make honest content easier to verify and dishonest content harder to pass off.

## What it is

| Approach | Where the signal lives | Strengths | Weaknesses |
|---|---|---|---|
| Statistical text watermark | In the choice of words, by biasing token sampling during generation | No visible change, detectable from text alone | Weakens with paraphrase, translation and short or factual text |
| Image, audio and video watermark | In pixel values, frequencies or latent space, added during or after generation | Survives common edits such as compression and cropping | Can be removed by strong edits or regeneration |
| Provenance metadata (C2PA Content Credentials) | A signed manifest attached to or bound to the file | Rich, verifiable history including human edits | Easily stripped when files are re-saved or screenshotted |
| Fingerprinting | A compact hash of the content stored in a database | Works without changing the content | Needs a lookup service, fuzzy matching is imperfect |
| Post-hoc AI detectors | A classifier that guesses whether content is AI-made | Works on any content | Unreliable, especially for text, with real false positives |

The first three are the main tools. Watermarks are robust but carry little information, often just "made by system X". Provenance metadata carries a lot of information but is fragile. That is why current guidance favours layering several techniques rather than relying on one; the EU's 2026 Code of Practice asks providers for at least two layers of machine-readable marking where necessary, such as metadata and watermarks.

## Where it came from

Digital watermarking for copyright protection dates back to the 1990s, when researchers hid owner information in images and audio. The generative AI version grew quickly from 2022 onwards.

For text, John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers and Tom Goldstein published "A Watermark for Large Language Models" in January 2023, presented at ICML 2023. Their method splits the vocabulary at each step into a pseudo-random "green list" and "red list" and gently favours green tokens, so that watermarked text contains statistically too many green tokens. Detection is a simple statistical test that needs no access to the model. In July 2023 OpenAI withdrew its general AI-text classifier, citing its low rate of accuracy, which underlined why proactive watermarks attract interest compared with after-the-fact detection.

Google DeepMind launched SynthID for images generated by its Imagen model in August 2023, and later extended it to audio, video and text. In October 2024 the team published SynthID Text in Nature ("Scalable watermarking for identifying large language model outputs", Sumanth Dathathri and colleagues), reporting a live experiment across nearly 20 million Gemini responses with no measured loss of quality. The same month, SynthID Text was open-sourced in [Hugging Face](/tools/hugging-face) Transformers (version 4.46). In May 2025 Google announced a SynthID Detector portal. Meta released Video Seal, an open video watermarking method, in December 2024.

For provenance, Adobe started the Content Authenticity Initiative in 2019, and Microsoft and the BBC led Project Origin. They joined with Arm, Intel and Truepic to found the Coalition for Content Provenance and Authenticity (C2PA) on 22 February 2021, which publishes the open technical standard behind "Content Credentials".

Regulation followed. China's measures for labelling AI-generated synthetic content, with accompanying national standards, took effect on 1 September 2025, requiring visible labels and labels embedded in file metadata. In the EU, Article 50 of the AI Act applies from 2 August 2026. The European Commission published a voluntary Code of Practice on marking and labelling AI-generated content on 10 June 2026. The Digital Omnibus amendments, Regulation (EU) 2026/1744, in force since 27 July 2026, give providers of generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the machine-readable marking duty in Article 50(2).

## How it works

### Statistical text watermarks

A language model produces text one token at a time by turning scores (logits) into probabilities and sampling. A watermark changes this step slightly, using a secret key:

```text
Green-list watermark (Kirchenbauer et al. 2023)

  seed     = hash( key, previous token )
  G        = random fraction γ of the vocabulary chosen by seed
  l'_k     = l_k + δ   if token k ∈ G,   else  l'_k = l_k
  p_k      = softmax(l')_k

Detection over T scored tokens, with s_G green tokens counted:

  z = ( s_G − γ · T ) / √( T · γ · (1 − γ) )
```

Here key is the secret watermark key, γ (gamma) is the share of the vocabulary placed on the green list, l_k is the model's original logit for token k, δ (delta) is the boost added to green tokens, p_k is the resulting probability, T is the number of tokens checked and s_G the number of them that are green. Without a watermark, about γ·T tokens would be green by chance; the z-score measures how far above chance the count is, and a large z (for example above 4) gives a very small probability of a false alarm. When the model is nearly certain of the next word (low entropy), the boost changes little, which is why short, formulaic or factual text carries a weaker signal.

SynthID Text uses a different sampling scheme called tournament sampling. Candidate tokens compete in rounds scored by pseudo-random functions of the key and recent context, and the winners are subtly more likely to score highly under those functions. Detection uses a scoring function or a trained Bayesian detector. In Transformers the configuration takes a list of secret integer keys and an n-gram length that trades detectability against robustness:

```python
from transformers import AutoModelForCausalLM, AutoTokenizer, SynthIDTextWatermarkingConfig

model_id = "google/gemma-2-2b-it"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id)

# Keep the keys secret; the documentation recommends 20 to 30 random integers.
watermarking_config = SynthIDTextWatermarkingConfig(
    keys=[654, 400, 836, 123, 340, 443, 597, 160, 57, 29, 590, 639, 13, 715,
          468, 990, 966, 226, 324, 585, 118, 504, 402, 721],
    ngram_len=5,
)

inputs = tokenizer(["Write a short note about tides."], return_tensors="pt")
output = model.generate(**inputs, watermarking_config=watermarking_config,
                        do_sample=True, max_new_tokens=120)
print(tokenizer.batch_decode(output, skip_special_tokens=True)[0])
```

### Image, audio and video watermarks

Media watermarks are usually learned. An encoder network hides a short bit string in the content and a decoder network recovers it; both are trained together against a set of simulated attacks such as compression, resizing, cropping and noise, so that the hidden bits survive them. Some methods insert the watermark during generation, for example in the latent space or starting noise of a [diffusion model](/tools/diffusion-models) such as [Stable Diffusion](/tools/stable-diffusion); others add it after generation. Video methods spread the signal across frames, and audio methods across time and frequency.

### Provenance with C2PA

C2PA defines a manifest: a bundle of assertions (for example "created with tool X", "edited by cropping", "contains AI-generated elements") plus a claim that lists them, signed with an X.509 certificate. The manifest is bound to the content with a cryptographic hash, so any change to the content breaks the "hard binding". Each edit in a supporting tool adds a new manifest that references the previous one, building a verifiable chain. Because metadata is easy to strip, the standard also allows "soft bindings" such as watermarks or fingerprints that let a verifier find the manifest again in a repository.

### Detection in practice

A verifier checks for signed metadata first, then runs the relevant watermark detectors. A positive watermark result is strong evidence for the system that holds the key; a negative result says little, because the content might come from another system or have been altered.

## Key concepts and terms

| Term | Meaning |
|---|---|
| Watermark | A hidden signal embedded in content so a detector with the key can identify its source |
| Provenance | A record of the origin and edit history of a piece of content |
| Content Credentials | The user-facing name for C2PA provenance metadata |
| Manifest | The signed C2PA data structure holding assertions about a file |
| Robustness | How well a watermark survives edits, compression and attacks |
| Imperceptibility | How invisible or inaudible the watermark is to people |
| Capacity | How many bits of information the watermark can carry |
| False positive rate | How often human-made content is wrongly flagged as watermarked |
| Spoofing | Making content appear watermarked when it is not, to frame a model or provider |
| Scrubbing | Removing a watermark while keeping the content usable |
| Entropy | How uncertain the model is about the next token; low entropy leaves little room for a text watermark |

## A worked example

This scenario is illustrative and does not describe a real company.

A small company runs an image and text generation service used by customers in the EU. It needs to meet Article 50(2) marking duties and wants a sensible technical design.

1. **Map outputs.** The service produces about 200,000 images and 1.5 million text answers a day. Images are downloaded as files; text is shown in a web app and copied by users.
2. **Images.** Every image gets an invisible learned watermark carrying a 32-bit identifier for the service, plus a C2PA manifest stating that it was generated by AI, signed with the company's certificate. In internal tests, the watermark is detected in 99 per cent of images after JPEG compression at quality 70 and a 20 per cent crop, but in only about 40 per cent after an aggressive regeneration attack.
3. **Text.** The team enables a statistical text watermark. On answers of 300 tokens or more, the detector flags 97 per cent of watermarked samples at a 1 in 10,000 false positive threshold; on answers under 50 tokens, detection drops sharply. After a user paraphrases with another model, detection on long answers falls to about 60 per cent.
4. **Logging.** For short text, the team relies on its own logs and terms of use rather than claiming the watermark always works.
5. **Disclosure.** The web app tells users they are interacting with AI, and the documentation explains what is marked, how to verify it and what the limits are.
6. **Review.** Results and limits are documented as part of the company's compliance record and reviewed when the Code of Practice or guidance changes.

The design layers metadata, watermarks and logs, and it is honest that none of them is unbreakable.

## Strengths and limitations

**Strengths:**

- Proactive: the signal is added at creation, so detection does not depend on guessing style.
- Low false positives: well-designed statistical watermarks give a measurable and very small false alarm rate.
- Invisible: no visible change to images or text for the user.
- Provenance metadata carries rich, verifiable history, including legitimate human edits.
- Supports compliance with labelling rules in the EU, China and elsewhere.

**Limitations:**

- Only content from cooperating providers is marked; open-weight models can be run without watermarks.
- Paraphrasing, translation and heavy rewriting weaken text watermarks; regeneration through another model can remove many image watermarks.
- Short, factual or highly constrained text carries little signal.
- Metadata is stripped by screenshots, re-encoding and many upload pipelines.
- Spoofing attacks can make human content look watermarked if keys or detectors leak.
- Detection usually requires the provider's key or detector, so there is no universal check.
- Absence of a watermark proves nothing about whether content is human-made.

## How it compares with alternatives

| Approach | How it identifies AI content | Strengths | Weaknesses |
|---|---|---|---|
| Watermarking | Hidden signal added at generation | Measurable, low false positives | Needs provider cooperation, can be scrubbed |
| C2PA provenance | Signed metadata chain | Rich history, open standard | Easily stripped |
| Post-hoc AI detectors | Classifier guesses from style | Works on any content | Unreliable, biased against some writers, easy to evade |
| Fingerprinting and logging | Provider stores hashes or records of outputs | No change to content | Needs lookup service, privacy and storage costs |
| Visible labels | Text or icon telling people content is AI-made | Clear to humans | Easy to crop or delete, no machine verification |

Current guidance favours combining several: visible labels for people, metadata for rich provenance, watermarks for robustness, and logs or fingerprints as a fallback.

## Practical guidance and best practices

1. Layer techniques. Use provenance metadata, an invisible watermark and, where useful, fingerprints or logs, because each fails in different ways.
2. Treat watermark keys as secrets. Store them like signing keys, rotate them with care and restrict detector access to limit spoofing.
3. Measure robustness against realistic attacks, ideally with a dedicated [red-teaming](/tools/red-teaming) exercise: compression, cropping, resizing, screenshots, paraphrasing and translation. Report detection rates at a fixed false positive rate.
4. Be honest about limits. Never present a watermark as proof that unmarked content is human-made, and never use a detector result alone to accuse someone.
5. Check quality impact on your own tasks, especially for text, where watermarking should not harm accuracy on factual or code answers.
6. Keep provenance through your own pipeline. Make sure resizing, transcoding and content delivery steps preserve or re-sign C2PA manifests.
7. Track regulation and codes. For EU deployments, follow Article 50, the Commission's Code of Practice and guidance; for China, the labelling measures and standards. See the [EU AI Act](/tools/eu-ai-act) page and wider [AI governance](/tools/ai-governance) practice.
8. Document your approach in [model cards](/tools/model-cards) and user documentation, including how third parties can verify content.

## Common mistakes

- Relying on post-hoc AI text detectors to make high-stakes decisions about students or employees.
- Assuming metadata alone is enough, when most social platforms and screenshots remove it.
- Testing robustness only against the attacks used in training the watermark.
- Leaving watermark keys in source code or shared configurations, inviting spoofing.
- Watermarking text but ignoring that most outputs are short and carry little signal.
- Claiming compliance from a single technique without documenting limits and fallbacks.

## Frequently asked questions

### Can AI-generated text be reliably detected?

Only partly. Without a watermark, detectors that guess from writing style are unreliable and can unfairly flag non-native writers. With a watermark, detection of long, unedited text can be very reliable, but paraphrasing, translation and short answers weaken it, and text from models without watermarks is not covered at all. Treat any detector result as one piece of evidence, never as proof.

### What is the difference between a watermark and Content Credentials?

A watermark hides a small signal inside the content itself, such as pixel patterns or word choices, and survives many edits. Content Credentials, based on the C2PA standard, are signed metadata attached to the file describing its origin and edits. They carry much more information but are easily removed. The two complement each other, and C2PA allows watermarks to act as a "soft binding" that helps recover lost credentials.

### Can watermarks be removed?

Yes, with enough effort. Research has shown that paraphrasing tools weaken text watermarks and that regenerating an image through a generative model can remove many invisible image watermarks; a NeurIPS 2024 paper argued that such pixel-level watermarks are provably removable in this way. Watermarks raise the cost of passing off AI content and catch casual misuse, but they do not stop a determined adversary.

### What does the EU AI Act require?

Article 50 sets transparency duties. Providers of AI systems that generate synthetic audio, images, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated, as far as technically feasible. Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, with some exceptions. People must also be told when they interact with an AI system. These duties apply from 2 August 2026, with the 2 December 2026 transition for the marking duty described above for systems already on the market. The Commission's Code of Practice is voluntary; it has a section for providers, including at least two layers of machine-readable marking where necessary, and a section for deployers, including guidance on an EU icon for labels.

### Is SynthID open source?

Partly. SynthID Text is available in Hugging Face Transformers and as open code, so developers can watermark their own models' text and train detectors. The image, audio and video versions used in Google products are not open in the same way; Google offers detection through its own tools.

### Do open-weight models undermine watermarking?

They limit it. Anyone running an open model locally can turn off or never add a watermark. This is one reason why provenance for authentic content, such as cameras and newsrooms signing genuine media, is seen as an important complement: it lets honest content prove itself instead of trying to catch every fake.

## Glossary

- Watermark key: the secret that determines how the watermark is embedded and detected.
- Green list: in the Kirchenbauer scheme, the pseudo-random set of tokens favoured during generation.
- Tournament sampling: the SynthID Text method of choosing tokens through scored rounds.
- z-score: a measure of how far an observed count is above what chance would predict.
- C2PA: the Coalition for Content Provenance and Authenticity and its open provenance standard.
- Hard binding: a cryptographic hash linking a manifest to the exact content.
- Soft binding: a watermark or fingerprint used to find a manifest after metadata is lost.
- Deepfake: AI-generated or manipulated media that resembles real people, places or events and could falsely appear genuine.
- Regeneration attack: passing content through another generative model to wash out a watermark.

## Summary

AI watermarking embeds hidden, detectable signals in generated text, images, audio and video, while provenance standards such as C2PA attach signed records of origin and edits. Statistical text watermarks, introduced by Kirchenbauer and colleagues in 2023 and deployed at scale by Google's SynthID Text, which was open-sourced in Hugging Face Transformers in 2024, bias word choices in a way that a keyed test can detect. Media watermarks hide bits that survive common edits, and Content Credentials provide rich but fragile metadata. None of these is unbreakable: paraphrasing, regeneration and metadata stripping weaken them, and unwatermarked open models remain. Regulation now asks for marking: China's labelling measures since September 2025 and the EU AI Act's Article 50 from 2 August 2026, supported by a voluntary Code of Practice published in June 2026. Layer several techniques, measure robustness honestly, protect keys, and never treat a missing watermark or a detector score as proof. This page is general information, not legal advice.