AI content watermarking

deepfake created using generative AI depicting a fictional dinner meeting between the terrorist Shoko Asahara and Japan's former prime minister Shinzo Abe, not containing any invisible watermark, drawing criticism for its lack of safeguards and being put under pressure from regulators Digital watermarking has been used for decades to protect physical and digital media, from paper currency to photographs. The rapid advancement of generative AI in the early 2020s, however, created a new and qualitatively different demand: rather than protecting a single artifact, watermarks for AI content must be embedded automatically across an open-ended distribution of generated outputs while remaining robust to a much wider class of adversarial transformations, including paraphrasing, image regeneration via diffusion models, and re-recording. Large image generation models such as DALL-E, Stable Diffusion, and Midjourney, along with large language models like ChatGPT, made it possible to produce highly realistic synthetic text, images, audio, and video at scale, raising significant ethical and security concerns. == Formal definitions and design goals ==

Most modern AI watermarking schemes can be formalized as a pair of algorithms (\mathsf{Wm}, \mathsf{Detect}) parameterized by a secret key k. The embedding algorithm \mathsf{Wm} takes a generative model M (and optionally a prompt) and returns a watermarked output x; the detection algorithm \mathsf{Detect}(x, k) outputs a real-valued score (typically a p-value or log-likelihood ratio) used to decide whether x was produced by the watermarked generator. The literature evaluates such schemes along several largely conflicting criteria: Criteria for evaluation include imperceptibility or quality preservation, measured for text via perplexity and human preference judgments, and for images and audio via metrics such as PSNR, SSIM, LPIPS, or PESQ. Forgery resistance or unforgeability means an adversary without the secret key should be unable to produce content that passes detection. == Techniques ==

AI watermarking techniques vary significantly depending on the type of content being watermarked. At its core, the process involves two main stages: embedding (or encoding) the watermark, and detection. Text Text watermarking is considered one of the most challenging modalities because natural language offers relatively limited redundancy compared to images or audio. A logits processor then increments every green-list logit by a fixed bias \delta > 0 before softmax: :\ell'_v = \ell_v + \delta \cdot \mathbf{1}[v \in G] so that, after sampling, green tokens are over-represented but generation is not constrained to green tokens alone; high-entropy positions tolerate the bias gracefully, while low-entropy positions (where one token dominates the logits) override the watermark and preserve correctness on factual content. The bias parameter \delta directly mediates the tradeoff between detectability and quality: a small \delta yields near-natural text but a weak signal, while a large \delta produces a strong statistical fingerprint at the cost of perplexity increase. Wouters (2023) translated this tradeoff into a multi-objective optimization problem and characterized the Pareto frontier of green-red watermarks. Distortion-free schemes A second family of schemes, beginning with an unpublished proposal by Scott Aaronson (2022) at OpenAI, sidesteps the quality-detectability tradeoff by preserving the model's marginal distribution exactly. Aaronson's Gumbel-max watermark samples the next token as w_t = \arg\max_i \frac{\log \xi_t[i]}{p_t[i]}, where \xi_t \in (0,1)^N is a pseudorandom vector keyed on previous tokens. By the Gumbel-max identity, w_t is exactly distributed according to p_t, so a single watermarked output is indistinguishable from an unwatermarked one; yet the correlation between \xi_t and w_t can be detected with the secret key. Christ, Gunn, and Zamir (COLT 2024) gave the first cryptographically rigorous construction, proving undetectability against any computationally bounded adversary who lacks the key, under standard assumptions on pseudorandom functions. Effectiveness regime All known generation-time text watermarks share the same fundamental dependence: their signal strength is proportional to the entropy of the model's next-token distribution. On low-entropy outputs (such as code completing a function signature, or factual recall of a single correct answer), there is little room to bias the sampler without breaking correctness, and the watermark is consequently weak. Watermarks therefore work best on essays, creative writing, and other long-form, high-entropy generations. Subsequent systems including StegaStamp (Tancik et al. 2020), which adds robustness to physical-world perturbations such as printing and photographing, and TrustMark (Bui et al. 2023), which targets resolution-agnostic watermarking for C2PA-style provenance, refined this paradigm. In-generation watermarking In-generation methods modify the AI model itself so that all of its outputs carry a watermark by construction. Stable Signature (Fernandez et al., ICCV 2023) fine-tunes the VAE decoder of a latent diffusion model such as Stable Diffusion so that every decoded image hides a fixed binary signature, recoverable by a pre-trained extractor with a likelihood ratio test for detection. The authors report >90% detection accuracy after a 90% crop, at a false-positive rate below 10^-6. A complementary approach is Tree-Ring Watermarks (Wen, Kirchenbauer, Geiping & Goldstein, NeurIPS 2023), which embeds a circular pattern in the Fourier transform of the initial Gaussian noise vector used to seed the diffusion sampler. Because the ring is invariant under spatial transformations (rotation, flipping, dilation) and survives the entire denoising trajectory, detection requires inverting the diffusion process to recover an estimate of the initial noise; this is a robust scheme that nonetheless requires access to the diffusion model and its inversion. SynthID-Image SynthID-Image, developed by Google DeepMind, uses a post-hoc model-independent design: a neural encoder embeds a watermark into the pixel data after generation, and a corresponding decoder detects it. The watermark is distributed holographically across the image, so even cropped fragments retain detectable information. By 2025, SynthID had been used to watermark over ten billion images and video frames across Google's services, making it the largest deployed AI image watermark to date. Audio Audio watermarking is constrained by the psychoacoustic threshold of human hearing: signals must be embedded in regions of the spectrum masked by louder content (a phenomenon known as auditory masking). Modern neural audio watermarks operate either on the raw waveform or on time-frequency representations such as mel spectrograms. The state of the art is exemplified by AudioSeal (San Roman et al., ICML 2024), which jointly trains a generator network that adds a watermark signal to an input waveform and a localized detector network that returns, for every audio sample, the probability that the watermark is present. AudioSeal introduced a novel perceptual loss based on auditory masking and is the first audio watermark to provide sample-level localization; that is, it can identify which segments of a longer audio file (e.g. a podcast partially modified with AI voice cloning) are watermarked. SilentCipher, and XAttnMark, which uses cross-attention to jointly optimize detection and bit-level attribution. Independent evaluations have, however, shown that all current post-hoc audio watermarks can be effectively removed by neural codecs (such as EnCodec) and learned denoisers, raising concerns about deployment robustness. == Industry implementations ==

SynthID SynthID is a suite of watermarking tools developed by Google DeepMind, designed to watermark and identify AI-generated images, text, audio, and video. It was first launched in beta in August 2023 for watermarking images generated by Imagen on Google Cloud's Vertex AI platform. By 2025, SynthID had been used to watermark over ten billion images and video frames across Google's services. The system is widely believed to be a Gumbel-max scheme of the type Aaronson proposed during his 2022 OpenAI residency. The company indicated it was exploring alternative approaches, including metadata embedding. Meta also developed Stable Signature, originally released by Meta AI in collaboration with Inria for Stable Diffusion. Unlike imperceptible pixel-level watermarks, C2PA embeds provenance data (known as "Content Credentials") into the file's metadata structure using the JUMBF (JPEG Universal Metadata Box Format) standard. This data is cryptographically signed via X.509 certificates, making it tamper-evident. Members of the coalition include Adobe, Microsoft, Google, Intel, OpenAI, and the BBC, among others. Industry practice is therefore converging on combining both approaches, with C2PA metadata providing a rich provenance record when present and imperceptible watermarking providing a more resilient fallback signal. == Limitations and challenges ==

Robustness against removal attacks A fundamental tension exists between the imperceptibility of a watermark and its robustness. Making a watermark less perceptible typically involves embedding it more subtly, but subtle watermarks are generally more vulnerable to removal through common operations like compression or cropping. For images, the most damaging class of attacks is regeneration via diffusion models. Zhao et al. (NeurIPS 2024) proved that under standard assumptions an attacker can use any sufficiently powerful diffusion model as a "purifier" to noise and re-denoise a watermarked image, reducing detection rates of HiDDeN, StegaStamp, TrustMark, and even Tree-Ring "from nearly 100% to essentially chance level" while preserving image content. The 2024 NeurIPS Erasing the Invisible challenge documented that under both white-box and black-box conditions, the winning attack achieved a 95.7% removal rate on a benchmark of state-of-the-art image watermarks with negligible quality loss. A theoretical capstone to this line of work is the impossibility theorem of Zhang et al. (ICML 2024), which proves that under two natural assumptions (namely, that an attacker has access to a "quality oracle" and a "perturbation oracle" that mixes within the set of high-quality outputs) strong watermarking is impossible for generative models, even with a private detection key. The authors instantiated their attack on KGW, Kuditipudi et al., and Zhao et al. and successfully removed all three watermarks. The result formalizes a long-standing intuition that as the gap between watermarked and unwatermarked high-quality outputs becomes a vanishingly small subset of the latter, attackers can always find quality-preserving perturbations that escape detection. Spoofing and forgery A symmetric threat to removal is spoofing or forgery, in which an adversary produces content that falsely triggers detection; for example, framing a model provider as the source of harmful output. Sadasivan et al. (2023) first demonstrated forgery against KGW by analyzing the empirical token frequency of watermarked text to recover an approximation of the green list. Jovanovic, Staab and Vechev (ICML 2024) systematized this in Watermark Stealing, showing that for under US$50 of API queries an adversary can steal the watermarking rules of state-of-the-art schemes and execute both spoofing and scrubbing attacks at scale. More recent work has extended forgery to ostensibly distortion-free schemes via mixed-integer linear programming over watermarked samples and via knowledge distillation that exploits "watermark radioactivity," which is the unintended transfer of watermark signals to student models trained on watermarked outputs. Defenses based on contrastive representation learning have been proposed but remain in early stages. Standardization and interoperability There is currently no universal standard for AI content watermarking. A watermark created by one company's system may be undetectable by another's tools, making broad-based verification difficult. Open-source models For open-source AI models, watermarking presents a particular challenge. If the watermarking code is part of an open pipeline, it is trivial for a user to fork the codebase and remove the watermarking step before generating content, or to fine-tune the model to forget the watermark behavior. Equity concerns OpenAI publicly raised concerns that text watermarking could disproportionately stigmatize non-native English speakers, who often use LLMs as legitimate writing assistants and would be more likely to have their text flagged as AI-generated even if they were the substantive author. While watermark-based detection is in principle less susceptible to this failure mode (since it does not rely on stylometric inference), the concern remains that any deployed detector will be used in high-stakes settings such as academic integrity adjudication. == Regulation ==

European Union The EU AI Act, which came into force on 1 August 2024, includes specific transparency obligations for AI-generated content under Article 50. The article requires providers of AI systems that generate synthetic audio, image, video, or text to ensure that their outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated." The act's recitals mention "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques" as possible implementation methods. The transparency obligations under Article 50 are set to become fully applicable on 2 August 2026. To support compliance, the European Commission is facilitating the development of a voluntary Code of Practice on Transparency of AI-Generated Content, which proposes a multi-layered approach combining digitally signed metadata with imperceptible watermarking. == See also ==