Definition
Watermarking is the practice of hiding a machine-detectable signal inside the content an AI model generates — text, images, audio or video — so that software can later confirm the content came from a model, even though a person reading or viewing it notices nothing. The signal does not sit in a visible corner logo or in a line of metadata that a re-upload would strip; it lives inside the content itself. For text, it is a subtle, deliberate skew in which words the model chooses. For images, of which Google's SynthID is the best-known system, it is a faint pattern woven across the pixels, below the threshold of human vision but readable by a matched detector.
This is a different thing from the Content Provenance (C2PA) standard, and the distinction is the single most useful idea on this page. Provenance attaches a signed manifest alongside the file — a cryptographic record of what device or model made it and when. It is rich and verifiable, and it is gone the instant someone screenshots the image or a platform strips the metadata on upload. A watermark carries far less information — often just "this is synthetic" — but it is inside the content, so it survives the screenshot that destroys the manifest. The two techniques fail in opposite ways, which is exactly why the major labs now deploy both.
What breaks if you get this wrong: people reach for watermarks as proof of authorship, and they are not that. A watermark tells you a specific model probably produced this text; it cannot tell you a human definitely did not, because absence of a watermark is the normal state of almost all content. Treating "no watermark detected" as "written by a person" is the mistake that turns a useful signal into a false accusation — the same trap deepfake detectors fall into from the other direction.
How It Works
The clearest way to see the mechanism is the text watermark introduced by Kirchenbauer and colleagues in their 2023 paper A Watermark for Large Language Models, because it is arithmetic you can check by hand.
A language model generates text one token at a time, each time producing a probability over its whole vocabulary and sampling from it. The watermark inserts one step in between. Just before each token is chosen, a pseudorandom function seeded by the previous token partitions the entire vocabulary into a green list — a fraction the paper calls gamma — and a red list. The sampler then adds a small constant, the hardness parameter delta, to the model's score for every green-list token, gently tilting the odds toward green words without ever forbidding a red one. Over hundreds of tokens this produces text that reads normally but contains far more green-list tokens than chance would ever explain. In the paper's main experiments gamma is 0.5 (green list is half the vocabulary) and delta is 2.0.
Detection needs no AI at all — just the secret function that regenerates the green lists. The detector walks the text, recomputes the green list at each position from the preceding token, counts how many tokens actually landed on green, and asks a single statistical question: is this more green than chance? Under the null hypothesis "this text was written with no knowledge of the green lists", the green-token count follows a binomial distribution, so the evidence is a one-proportion z-test. With green-token count s in a passage of T tokens, the paper's statistic is:
z = (s - gamma*T) / sqrt(T * gamma * (1 - gamma))
The paper rejects the null and flags the text as watermarked when z is above 4, at which threshold the false-positive rate is about 3 in 100,000 (3e-5). Note that both terms scale with length: the same proportion of green tokens yields a larger z in a longer passage, which is why the watermark becomes unmissable over a few hundred tokens and shaky over a sentence.
A worked example
Take a 200-token passage with gamma = 0.5, so chance alone would land about 100 tokens on green. The block below computes the z-score and its one-sided p-value for a few cases; its printed output is pasted directly beneath it.
import math
def z_score(green, total, gamma=0.5):
expected = gamma * total
std = math.sqrt(total * gamma * (1 - gamma))
return (green - expected) / std
def p_value(z): # one-sided tail of the standard normal
return 0.5 * math.erfc(z / math.sqrt(2))
rows = [
("human text (no watermark)", 100, 200),
("watermarked passage", 150, 200),
("the same passage, paraphrased", 118, 200),
("25-token watermarked snippet", 25, 25),
]
for label, green, total in rows:
z = z_score(green, total)
print(f"{label:32s} green={green}/{total} z={z:5.2f} p={p_value(z):.0e}")
Output:
human text (no watermark) green=100/200 z= 0.00 p=5e-01
watermarked passage green=150/200 z= 7.07 p=8e-13
the same passage, paraphrased green=118/200 z= 2.55 p=5e-03
25-token watermarked snippet green=25/25 z= 5.00 p=3e-07
Read down the column. Human text sits at z = 0 — exactly chance. A watermarked passage with 150 of 200 green tokens reaches z = 7.07, a p-value near 1e-12: the model was clearly nudging. A 25-token snippet where every token happens to land green still clears the bar at z = 5.0, but only just, which is why very short outputs are unreliable to judge. The third row is the honest one: paraphrase the watermarked passage so that only 118 tokens remain green, and z falls to 2.55 — below the threshold of 4, meaning the same text that was obvious before is now indistinguishable from human writing. Nothing about the words has to look different; changing which tokens appear re-randomizes which green list each position is scored against, and the signal bleeds away.
SynthID-Text and images
Google DeepMind's SynthID-Text, published in Nature in 2024 as Scalable watermarking for identifying large language model outputs, refines this idea with a scheme it calls Tournament sampling: it draws several candidate tokens from the model and runs them through a bracket of pairwise contests whose outcomes are tied to the secret watermark key, so the winner carries the signal. Its central claim is that a non-distortionary configuration preserves output quality — in a live experiment the paper reports roughly 20 million watermarked and unwatermarked Gemini responses were served to users, who did not report a quality difference (2024 figures). DeepMind open-sourced the method in 2024.
Image watermarking works on a different principle because there are no discrete tokens to bias. SynthID-Image trains a pair of neural networks jointly — an embedder that adds an imperceptible perturbation across the pixels of a generated image, and a detector trained to recover it. Because the signal is spread across the whole image rather than stored in a header, it survives moderate cropping, compression and colour filters that would erase attached metadata. The image models that carry it are the same diffusion and vision-transformer systems described under image generation; the watermark is applied as the image is produced, not bolted on afterward.
The property that ties both media together, and constrains everything downstream, is that detection is gated by a secret key. Only the provider that embedded a watermark — or a party it licenses — can check for it, because the detector needs the key that generated the green lists or the tournament outcomes. There is no universal reader that inspects arbitrary content for "any watermark".
Real-World Applications
- Google's consumer AI. SynthID watermarks images from Imagen and content generated across Gemini, and the open-sourced SynthID-Text is available through DeepMind's Responsible Generative AI Toolkit for other developers to apply to their own models.
- Cross-vendor adoption. On 19 May 2026 OpenAI announced it was embedding SynthID watermarking in its generated media alongside a public verification tool — a notable case of one lab adopting another's watermarking scheme, which only works if detection interoperates. Treat the specific adopter list as a snapshot; who watermarks changes far faster than how watermarking works.
- Regulatory compliance in the EU. Article 50(2) of the EU AI Act requires providers of generative AI systems to mark synthetic output in a machine-readable format, and watermarking is one of the two mechanisms (with C2PA) built to satisfy it. This duty applies from 2 August 2026. Systems already on the market before that date get a roughly four-month grace period, to 2 December 2026, to conform. Inoculation note for future editors: the November 2025 Digital Omnibus did not postpone this transparency deadline. What it delayed was the separate high-risk (Annex III) regime, which slipped to 2 December 2027. If you find a source claiming Article 50 was pushed to 2027, it has conflated the two — leave the 2 August 2026 date.
- Regulatory compliance in China. China's labeling measures, in force since 1 September 2025, require an embedded, machine-readable label identifying the provider of AI-generated content, alongside a visible label — a marking duty that watermarking directly answers.
- Platform and newsroom triage. Because detection needs the key, watermarks are most useful to the platforms that hold it: a service can check whether text or an image came from its own model before recommending, monetizing or republishing it, without running a fragile pixel-level classifier.
Challenges
Robustness is the central, unfixed problem. The worked example above is not a corner case; it is the design. Text watermarks degrade under paraphrasing, translation and manual editing because each of those changes which tokens appear, and the signal is carried by the tokens. Image watermarks are sturdier but not immune: heavy cropping, aggressive re-compression, style transfer, or the oldest trick of all — photographing the screen — can push the detector below its confidence threshold. A watermark raises the cost and effort of laundering synthetic content; it does not make laundering impossible, and any claim that it does should be read as marketing.
Detection is siloed by design. The secret-key requirement that makes watermarks hard to forge also means there is no cross-vendor detector. A journalist cannot paste arbitrary text into one tool and learn which model, if any, produced it; they can only check content against the specific provider that holds the matching key. This fragments the very verification the technique is supposed to enable.
Absence proves nothing. As with content provenance, the overwhelming majority of content carries no watermark at all, so a negative result means "unknown", not "human-made". A user interface that treats every unwatermarked file as suspect trains people to ignore the warning entirely.
Spoofing cuts the other way. A watermark that could be forged — applied to human writing to make it look machine-generated, or stripped and re-applied — would be worse than none, because it lends false authority to a false claim. Guarding the key is the whole ballgame, and the more parties a scheme licenses to detect, the larger the surface for a key to leak.
Future Trends
Regulation is setting the clock. The EU's 2 August 2026 marking duty converts watermarking from an optional trust feature into a compliance requirement, which is a far stronger adoption driver than good intentions. Expect the near term to be dominated by making existing schemes auditable enough to satisfy a regulator, not by new algorithms.
Convergence with provenance. The emerging consensus is not watermark or C2PA but both: a signed manifest for rich, verifiable history where the pipeline preserves it, and an embedded watermark as the fallback that survives the screenshot. OpenAI's 2026 move to embed SynthID alongside C2PA Content Credentials is the clearest sign of this belt-and-braces approach.
The robustness arms race continues. Every paper that strengthens a watermark against paraphrase is followed by one demonstrating a new removal attack. This is structurally similar to spam filtering: not a problem that gets solved once, but a moving equilibrium that has to be maintained. The honest framing for a reader is that watermarking makes casual misuse detectable and determined misuse expensive — a meaningful shift, and not the same thing as a guarantee.