AI content watermarking

AI content watermarking is the process of embedding imperceptible yet detectable signals into content generated by artificial intelligence systems, such as text, images, audio, or video. The technique allows the content to be traced and identified as machine-generated without compromising its quality for the end user.^[1] AI watermarking has emerged as a key approach to address growing concerns about misinformation, deepfakes, copyright infringement, and the traceability of synthetic content in the context of the rapid development of generative artificial intelligence.^[2]

Unlike traditional visible watermarks used in photography, AI content watermarks are typically invisible to humans and can only be detected and deciphered algorithmically.^[3] The concept is distinct from the watermarking of AI models themselves (to prevent model theft) and from the watermarking of training data (to combat unauthorized data use).^[3] Modern AI watermarking schemes are typically formalized as a pair of algorithms, an embedding (or generation) algorithm and a detection algorithm, sharing a secret key, whose performance is evaluated along three competing axes: quality (the watermark must not noticeably degrade outputs), detectability (the watermark must be statistically distinguishable from unwatermarked content), and robustness (the watermark must persist under adversarial or incidental modifications).^[4]

Digital watermarking has been used for decades to protect physical and digital media, from paper currency to photographs.^[3] Classical schemes typically embedded a fixed bit-string into a fixed cover signal, with robustness criteria defined against a small fixed set of distortions such as JPEG compression or additive Gaussian noise.^[12] The rapid advancement of generative AI in the early 2020s, however, created a new and qualitatively different demand: rather than protecting a single artifact, watermarks for AI content must be embedded automatically across an open-ended distribution of generated outputs while remaining robust to a much wider class of adversarial transformations, including paraphrasing, image regeneration via diffusion models, and re-recording.^[13][14]

Large image generation models such as DALL-E, Stable Diffusion, and Midjourney, along with large language models like ChatGPT, made it possible to produce highly realistic synthetic text, images, audio, and video at scale, raising significant ethical and security concerns.^[13] In July 2023, the Biden administration secured voluntary commitments from leading AI companies, including OpenAI, Alphabet, Meta, and Amazon, to develop watermarking and other provenance technologies to help users identify AI-generated content.^[15]

Most modern AI watermarking schemes can be formalized as a pair of algorithms ${\displaystyle ({\mathsf {Wm}},{\mathsf {Detect}})}$ parameterized by a secret key ${\displaystyle k}$. The embedding algorithm ${\displaystyle {\mathsf {Wm}}}$ takes a generative model ${\displaystyle M}$ (and optionally a prompt) and returns a watermarked output ${\displaystyle x}$; the detection algorithm ${\displaystyle {\mathsf {Detect}}(x,k)}$ outputs a real-valued score (typically a p-value or log-likelihood ratio) used to decide whether ${\displaystyle x}$ was produced by the watermarked generator.^[16] The literature evaluates such schemes along several largely conflicting criteria:^[4][17]

Criteria for evaluation include imperceptibility or quality preservation, measured for text via perplexity and human preference judgments, and for images and audio via metrics such as PSNR, SSIM, LPIPS, or PESQ.^[2] Detectability is typically expressed as the true positive rate at a fixed false positive rate (e.g. 1% or 10^-6), or as the number of tokens or pixels needed to reach a given confidence level.^[16] Robustness refers to the requirement that the watermark should survive expected modifications like JPEG or MP3 compression, cropping, noise, paraphrasing, or machine translation.^[13] Distortion-freeness is a stronger property requiring that the marginal distribution of any single watermarked output be statistically identical to the unwatermarked model's distribution. Schemes due to Aaronson, Christ et al., and Kuditipudi et al. are distortion-free in this sense, while the original Kirchenbauer et al. scheme is not.^[18][19] Forgery resistance or unforgeability means an adversary without the secret key should be unable to produce content that passes detection.^[20]

AI watermarking techniques vary significantly depending on the type of content being watermarked. At its core, the process involves two main stages: embedding (or encoding) the watermark, and detection.^[1] There are two primary methods for embedding: watermarking during content generation, which requires access to the AI model itself but is generally more robust, and post-generation watermarking, which can be applied to content from any source, including closed-source models.^[13]

Watermarks can be broadly classified as visible, including overt marks such as logos or text overlays, or imperceptible, which are detectable only by algorithms.^[1] They can also be classified by durability: robust watermarks are designed to withstand common transformations such as compression, cropping, and re-encoding, while fragile watermarks are easily destroyed by any alteration, making them useful for tamper detection.^[1] A further axis distinguishes zero-bit watermarks, which only signal "this content was generated by model M," from multi-bit watermarks, which embed an arbitrary payload (such as a user identifier) that can be recovered at detection time.^[21]

Text watermarking is considered one of the most challenging modalities because natural language offers relatively limited redundancy compared to images or audio.^[3] Modern approaches for large language models alter the autoregressive sampling process so that some statistical signature is left in the choice of tokens, while leaving the surface form of the text unchanged.^[16] The literature distinguishes three main families of generation-time text watermarks. Logit-biasing schemes (e.g. KGW) add a fixed bias ${\displaystyle \delta }$ to a pseudorandomly selected subset of vocabulary logits before softmax sampling.^[16] Reweighting or sampling-based schemes (e.g. SynthID-Text) compose multiple pseudorandom tournaments over the model's full distribution.^[4] Distortion-free schemes based on the Gumbel-max trick or inverse transform sampling (Aaronson 2022; Kuditipudi et al. 2023; Christ et al. 2024) preserve the marginal output distribution of the model.^[22][18]

The pioneering "green list / red list" scheme of Kirchenbauer et al. (KGW), introduced at ICML 2023, is the foundation for most subsequent text watermarks.^[16][17] At each decoding step ${\displaystyle t}$, a pseudorandom function (PRF) keyed by a secret ${\displaystyle k}$ is applied to a context window of ${\displaystyle h}$ previous tokens to deterministically partition the vocabulary ${\displaystyle V}$ of size ${\displaystyle N}$ into a "green list" ${\displaystyle G\subset V}$ of size ${\displaystyle \gamma N}$ and its complement, the "red list" ${\displaystyle R=V\setminus G}$, where ${\displaystyle \gamma \in (0,1)}$ (typically ${\displaystyle \gamma =1/2}$) is the green fraction.^[23] A logits processor then increments every green-list logit by a fixed bias ${\displaystyle \delta >0}$ before softmax:

${\displaystyle \ell '_{v}=\ell _{v}+\delta \cdot \mathbf {1} [v\in G]}$

so that, after sampling, green tokens are over-represented but generation is not constrained to green tokens alone; high-entropy positions tolerate the bias gracefully, while low-entropy positions (where one token dominates the logits) override the watermark and preserve correctness on factual content.^[16]

Detection requires only the secret key and the candidate text, not the language model itself. The detector recomputes the partition ${\displaystyle g(\cdot )}$ for each token, counts the number of green hits ${\displaystyle |G|_{\text{hits}}}$ in a sequence of length ${\displaystyle T}$, and computes a one-proportion z-test statistic:^[16]

${\displaystyle z={\frac {|G|_{\text{hits}}-\gamma T}{\sqrt {T\gamma (1-\gamma )}}}}$

Under the null hypothesis that the text was written by an unwatermarked source (human or another model), the green-hit count is approximately binomially distributed with mean ${\displaystyle \gamma T}$; a large positive ${\displaystyle z}$ rejects the null hypothesis. The original paper reports that fewer than 25 watermarked tokens are sufficient to detect a watermark with a false positive rate below 10^-5 on the OPT-1.3B model.^[16] A follow-up study by the same group documented robustness under temperature sampling, top-p (nucleus) sampling, and human paraphrasing, and proposed sliding-window detection with adaptive thresholds.^[24]

The bias parameter ${\displaystyle \delta }$ directly mediates the tradeoff between detectability and quality: a small ${\displaystyle \delta }$ yields near-natural text but a weak signal, while a large ${\displaystyle \delta }$ produces a strong statistical fingerprint at the cost of perplexity increase. Wouters (2023) translated this tradeoff into a multi-objective optimization problem and characterized the Pareto frontier of green-red watermarks.^[25]

A second family of schemes, beginning with an unpublished proposal by Scott Aaronson (2022) at OpenAI, sidesteps the quality-detectability tradeoff by preserving the model's marginal distribution exactly. Aaronson's Gumbel-max watermark samples the next token as ${\displaystyle w_{t}=\arg \max _{i}{\frac {\log \xi _{t}[i]}{p_{t}[i]}}}$, where ${\displaystyle \xi _{t}\in (0,1)^{N}}$ is a pseudorandom vector keyed on previous tokens. By the Gumbel-max identity, ${\displaystyle w_{t}}$ is exactly distributed according to ${\displaystyle p_{t}}$, so a single watermarked output is indistinguishable from an unwatermarked one; yet the correlation between ${\displaystyle \xi _{t}}$ and ${\displaystyle w_{t}}$ can be detected with the secret key.^[19][26]

Christ, Gunn, and Zamir (COLT 2024) gave the first cryptographically rigorous construction, proving undetectability against any computationally bounded adversary who lacks the key, under standard assumptions on pseudorandom functions.^[18] Kuditipudi, Thickstun, Hashimoto, and Liang (2023) proposed inverse-transform and exponential-min schemes ("ITS-edit" and "EXP-edit") that use a long fixed key sequence aligned with the generated text at detection time, yielding high robustness to insertions, deletions, and substitutions at the cost of detection time scaling with the key length.^[22]

The most large-scale deployment to date is SynthID-Text, published by Dathathri et al. in Nature in October 2024.^[4] SynthID-Text uses a tournament sampling scheme: at each step, ${\displaystyle 2^{m}}$ candidate tokens are drawn (with replacement) from the LLM's distribution, and a series of ${\displaystyle m}$ pseudorandom binary "tournaments" (each scored by a function ${\displaystyle g_{\ell }}$ derived from the secret key and the context) selects the surviving token. The scheme is shown to be non-distortionary in expectation (a weaker guarantee than Aaronson's per-sample distortion-freeness, but stronger than KGW's), and integrates natively with speculative decoding for production deployment.^[4] A 20-million-response live experiment in Google's Gemini system found no statistically significant degradation in user-rated response quality.^[4] The reference implementation was open-sourced through Google's Responsible Generative AI Toolkit and on Hugging Face.^[27][28]

All known generation-time text watermarks share the same fundamental dependence: their signal strength is proportional to the entropy of the model's next-token distribution. On low-entropy outputs (such as code completing a function signature, or factual recall of a single correct answer), there is little room to bias the sampler without breaking correctness, and the watermark is consequently weak.^[16][29] Watermarks therefore work best on essays, creative writing, and other long-form, high-entropy generations.^[29]

Image watermarking has the longest history of any modality and offers the highest channel capacity, since natural images contain large amounts of perceptually irrelevant high-frequency content into which signals can be hidden.^[12] Approaches to AI image watermarking can be classified along two axes: when the watermark is embedded (post-hoc vs. in-generation) and where in the image representation it lives (spatial domain, frequency domain, or latent space).^[2]

Post-hoc methods treat watermarking as a learned encoder-decoder problem. The seminal HiDDeN system of Zhu et al. (ECCV 2018) jointly trained an encoder network ${\displaystyle E_{\phi }}$ that injects a binary message into an input image and a decoder network ${\displaystyle D_{\psi }}$ that recovers it after a differentiable noise layer simulating compression and other distortions.^[30] Subsequent systems including StegaStamp (Tancik et al. 2020), which adds robustness to physical-world perturbations such as printing and photographing,^[31] and TrustMark (Bui et al. 2023), which targets resolution-agnostic watermarking for C2PA-style provenance, refined this paradigm.^[32]

In-generation methods modify the AI model itself so that all of its outputs carry a watermark by construction. Stable Signature (Fernandez et al., ICCV 2023) fine-tunes the VAE decoder of a latent diffusion model such as Stable Diffusion so that every decoded image hides a fixed binary signature, recoverable by a pre-trained extractor with a likelihood ratio test for detection. The authors report >90% detection accuracy after a 90% crop, at a false-positive rate below 10^-6.^[33]

A complementary approach is Tree-Ring Watermarks (Wen, Kirchenbauer, Geiping & Goldstein, NeurIPS 2023), which embeds a circular pattern in the Fourier transform of the initial Gaussian noise vector used to seed the diffusion sampler. Because the ring is invariant under spatial transformations (rotation, flipping, dilation) and survives the entire denoising trajectory, detection requires inverting the diffusion process to recover an estimate of the initial noise; this is a robust scheme that nonetheless requires access to the diffusion model and its inversion.^[34]

SynthID-Image, developed by Google DeepMind, uses a post-hoc model-independent design: a neural encoder embeds a watermark into the pixel data after generation, and a corresponding decoder detects it. The watermark is distributed holographically across the image, so even cropped fragments retain detectable information. By 2025, SynthID had been used to watermark over ten billion images and video frames across Google's services, making it the largest deployed AI image watermark to date.^[21][35]

Audio watermarking is constrained by the psychoacoustic threshold of human hearing: signals must be embedded in regions of the spectrum masked by louder content (a phenomenon known as auditory masking).^[36] Modern neural audio watermarks operate either on the raw waveform or on time-frequency representations such as mel spectrograms.

The state of the art is exemplified by AudioSeal (San Roman et al., ICML 2024), which jointly trains a generator network that adds a watermark signal to an input waveform and a localized detector network that returns, for every audio sample, the probability that the watermark is present. AudioSeal introduced a novel perceptual loss based on auditory masking and is the first audio watermark to provide sample-level localization; that is, it can identify which segments of a longer audio file (e.g. a podcast partially modified with AI voice cloning) are watermarked.^[36] Other notable systems include WavMark,^[37] SilentCipher,^[38] and XAttnMark, which uses cross-attention to jointly optimize detection and bit-level attribution.^[39] Independent evaluations have, however, shown that all current post-hoc audio watermarks can be effectively removed by neural codecs (such as EnCodec) and learned denoisers, raising concerns about deployment robustness.^[40]

SynthID is a suite of watermarking tools developed by Google DeepMind, designed to watermark and identify AI-generated images, text, audio, and video.^[41] It was first launched in beta in August 2023 for watermarking images generated by Imagen on Google Cloud's Vertex AI platform.^[35] The tool was subsequently expanded to cover text generated by the Gemini app, audio produced by Google's Lyria music model, and video from the Veo model.^[42] By 2025, SynthID had been used to watermark over ten billion images and video frames across Google's services.^[21]

For text, SynthID functions as a logits processor that applies a tournament sampling scheme; the underlying technology was published in Nature in October 2024 with full reproducibility data, and the code was open-sourced through Google's Responsible Generative AI Toolkit and Hugging Face.^[4][27] For images, SynthID-Image is a post-hoc neural encoder-decoder system that embeds a holographic watermark into pixels; a 2025 technical report describes its internet-scale deployment characteristics, including operation under JPEG compression, screenshot capture, and moderate cropping.^[21]

OpenAI developed a text watermarking system for ChatGPT that reportedly achieved 99.9% detection accuracy in internal testing.^[43][44] The system is widely believed to be a Gumbel-max scheme of the type Aaronson proposed during his 2022 OpenAI residency.^[26] Despite the technology being ready for nearly a year, OpenAI chose not to release it, as reported by The Wall Street Journal in August 2024.^[43] A company survey found that nearly 30% of ChatGPT users said they would use the service less if watermarking were implemented.^[43] OpenAI also raised concerns that the watermark was vulnerable to circumvention through translation tools, rewording with another AI model, or character insertion and deletion, and that the tool could disproportionately stigmatize non-native English speakers who use AI for writing assistance.^[44][45] The company indicated it was exploring alternative approaches, including metadata embedding.^[43]

Meta open-sourced AudioSeal in 2024 as the audio watermarking component of its Audiobox and SeamlessM4T speech systems, which together serve over 100,000 users daily.^[36][46] Meta also developed Stable Signature, originally released by Meta AI in collaboration with Inria for Stable Diffusion.^[33]

The Coalition for Content Provenance and Authenticity (C2PA) is a cross-industry initiative that has developed an open technical standard for establishing the origin and edit history of digital content through cryptographically signed metadata.^[47] Unlike imperceptible pixel-level watermarks, C2PA embeds provenance data (known as "Content Credentials") into the file's metadata structure using the JUMBF (JPEG Universal Metadata Box Format) standard. This data is cryptographically signed via X.509 certificates, making it tamper-evident.^[48] Members of the coalition include Adobe, Microsoft, Google, Intel, OpenAI, and the BBC, among others.^[48]

While C2PA is sometimes described as "watermarking," its approach is fundamentally different: it attaches verifiable metadata alongside the content rather than modifying the content itself, and the credentials are stripped by any system that re-encodes the file without preserving metadata (such as most social media platforms as of 2024-2025).^[49] Industry practice is therefore converging on combining both approaches, with C2PA metadata providing a rich provenance record when present and imperceptible watermarking providing a more resilient fallback signal.^[50]

A fundamental tension exists between the imperceptibility of a watermark and its robustness. Making a watermark less perceptible typically involves embedding it more subtly, but subtle watermarks are generally more vulnerable to removal through common operations like compression or cropping.^[1] For text, watermarks can be defeated by paraphrasing the output, translating it to another language, or using a second AI model to rewrite it.^[29][45] The DIPPER paraphraser of Krishna et al. (NeurIPS 2023) was specifically designed to break detection of LLM-generated text and reduces detection rates of KGW-style watermarks substantially while preserving semantic content.^[51]

For images, the most damaging class of attacks is regeneration via diffusion models. Zhao et al. (NeurIPS 2024) proved that under standard assumptions an attacker can use any sufficiently powerful diffusion model as a "purifier" to noise and re-denoise a watermarked image, reducing detection rates of HiDDeN, StegaStamp, TrustMark, and even Tree-Ring "from nearly 100% to essentially chance level" while preserving image content.^[14][52] The 2024 NeurIPS Erasing the Invisible challenge documented that under both white-box and black-box conditions, the winning attack achieved a 95.7% removal rate on a benchmark of state-of-the-art image watermarks with negligible quality loss.^[53]

A theoretical capstone to this line of work is the impossibility theorem of Zhang et al. (ICML 2024), which proves that under two natural assumptions (namely, that an attacker has access to a "quality oracle" and a "perturbation oracle" that mixes within the set of high-quality outputs) strong watermarking is impossible for generative models, even with a private detection key. The authors instantiated their attack on KGW, Kuditipudi et al., and Zhao et al. and successfully removed all three watermarks.^[54] The result formalizes a long-standing intuition that as the gap between watermarked and unwatermarked high-quality outputs becomes a vanishingly small subset of the latter, attackers can always find quality-preserving perturbations that escape detection.

A symmetric threat to removal is spoofing or forgery, in which an adversary produces content that falsely triggers detection; for example, framing a model provider as the source of harmful output. Sadasivan et al. (2023) first demonstrated forgery against KGW by analyzing the empirical token frequency of watermarked text to recover an approximation of the green list.^[55] Jovanovic, Staab and Vechev (ICML 2024) systematized this in Watermark Stealing, showing that for under US$50 of API queries an adversary can steal the watermarking rules of state-of-the-art schemes and execute both spoofing and scrubbing attacks at scale.^[20] Pang et al. (2024) introduced piggyback spoofing, in which malicious content is grafted onto genuine watermarked text in small doses while preserving the watermark signal.^[56] More recent work has extended forgery to ostensibly distortion-free schemes via mixed-integer linear programming over watermarked samples^[57] and via knowledge distillation that exploits "watermark radioactivity," which is the unintended transfer of watermark signals to student models trained on watermarked outputs.^[58] Defenses based on contrastive representation learning have been proposed but remain in early stages.^[59]

There is currently no universal standard for AI content watermarking. A watermark created by one company's system may be undetectable by another's tools, making broad-based verification difficult.^[1] Initiatives such as the ISO/IEC JTC 1/SC 42 working group on AI trustworthiness, the C2PA's Durable Content Credentials specification (which combines C2PA metadata with a watermarking layer), and the EU's voluntary Code of Practice are attempting to converge on shared schemes.^[50][60]

For open-source AI models, watermarking presents a particular challenge. If the watermarking code is part of an open pipeline, it is trivial for a user to fork the codebase and remove the watermarking step before generating content, or to fine-tune the model to forget the watermark behavior.^[13] A 2024 Nature commentary accompanying the SynthID-Text paper observed that this asymmetry (closed-source providers can enforce watermarking, open-source ones cannot) risks creating a two-tier provenance landscape unless watermarking can be moved into the model weights themselves.^[61]

OpenAI publicly raised concerns that text watermarking could disproportionately stigmatize non-native English speakers, who often use LLMs as legitimate writing assistants and would be more likely to have their text flagged as AI-generated even if they were the substantive author.^[45] A 2023 study by Liang et al. found that several non-watermark AI-text detectors already exhibit such bias, misclassifying TOEFL essays by non-native English students as AI-generated at substantially higher rates than essays by native speakers.^[62] While watermark-based detection is in principle less susceptible to this failure mode (since it does not rely on stylometric inference), the concern remains that any deployed detector will be used in high-stakes settings such as academic integrity adjudication.

The EU AI Act, which came into force on 1 August 2024, includes specific transparency obligations for AI-generated content under Article 50. The article requires providers of AI systems that generate synthetic audio, image, video, or text to ensure that their outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated."^[63] The act's recitals mention "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques" as possible implementation methods.^[64]

The transparency obligations under Article 50 are set to become fully applicable on 2 August 2026.^[65] To support compliance, the European Commission is facilitating the development of a voluntary Code of Practice on Transparency of AI-Generated Content, which proposes a multi-layered approach combining digitally signed metadata with imperceptible watermarking.^[50][65] The second draft of this Code, published in March 2026, recommends a two-layered marking strategy involving secured metadata and watermarking, with optional fingerprinting and logging.^[65]

In October 2023, Executive Order 14110 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence directed the Department of Commerce to develop guidance for content authentication and watermarking to help distinguish AI-generated content from authentic material.^[15] The order was rescinded in January 2025; subsequent federal activity on watermarking has been driven primarily by NIST's AI Safety Institute and by state-level laws in California and Texas requiring labeling of AI-generated political content.

China's Cyberspace Administration issued binding "Measures for Labeling AI-Generated Synthetic Content" effective 1 September 2025, requiring both visible labels and machine-readable identifiers (including watermarks or metadata) on all generative-AI outputs distributed within the country. The measures impose joint responsibility on content platforms for label preservation.^[66][67]

• Digital watermarking
• Coalition for Content Provenance and Authenticity
• Content Authenticity Initiative
• Deepfake
• Generative artificial intelligence
• No-AI label
• Steganography

• Coalition for Content Provenance and Authenticity (C2PA)
• SynthID by Google DeepMind
• SynthID Text on GitHub
• AudioSeal on GitHub (Meta)
• Stable Signature on GitHub (Meta)
• KGW reference implementation on GitHub
• EU Code of Practice on AI-generated content