AI-generated content isn't always easy to spot, which can lead to tricky situations, to put it lightly. As a result, most of the major AI companies now automatically add watermarks to the images, videos, and—increasingly—text their models generate.
If you create an image with ChatGPT or get Claude to write your press release (or do your homework), it may now include a secret sign that it was AI-generated—or, at the very least, that you used AI to assist you. Part of this is because of legal requirements introduced by the European Union, but there's also a strong argument that it's in the AI company's best interests to be able to identify the outputs of their models.
The whole subject is a bit confusing. How the watermarks work is pretty clever, but there are a whole host of caveats and complications. So let's look at how AI watermarks work, what it means for the text and images you generate, and why this all matters.
Table of contents:
What is an AI watermark?
An AI watermark is a marker baked into AI-generated content that indicates that a machine touched it. In some cases, it survives edits, copying, cropping, and screenshotting.
There are three ways AI-generated content can be marked:
Metadata
Visible watermark
Invisible watermark
That last one—the invisible watermark—is what's been causing a fuss lately. Claude announced that it would be adding invisible watermarks to any text it produced, which, expectedly, made everyone lose their minds. So that's what I'll be focusing on in this article, but before I do, let's take a quick look at all three versions.
Metadata AI watermarks
Metadata is the simplest, easiest to evade, and most informative AI watermark: it's just extra information attached to the file. It's the same thing that every document you save on your computer or photo you take on your smartphone includes, which says when it was created, when it was last edited or opened, and what settings were used to make it. Photo metadata, in particular, can include all the camera settings, location, and edit history.
AI-generated image and video metadata is much the same. The standard that everyone uses is C2PA: it adds something called Content Credentials that say which tool generated the image, what edits were made, and when it all happened. It's supported by the likes of Adobe, Amazon, OpenAI, and Microsoft.
The downside of metadata is that it's comically easy to remove if you're trying to hide the fact that something is AI-generated. It only stays attached to the original file, so if you take a screenshot, it'll vanish. Similarly, converting it to a different format or uploading it to a service that strips metadata will all get rid of it.
AI-generated text typically doesn't include metadata, either (though some files with text in them do). If you copy and paste text from ChatGPT or even have it create a Markdown file, there won't be any metadata to suggest it was written by AI.
Visible AI watermarks
Visible watermarks are often added to AI-generated images and videos, particularly on free or cheap plans. The little symbol at the bottom of some AI-generated images and videos is a visible watermark.
Like with metadata, these AI watermarks are easily defeated. Crop the image or use another tool to edit out the watermark, and it's gone. It also doesn't work for text.
Invisible AI watermarks
Invisible watermarks are the most effective way of marking AI-generated content. They're designed to be hard to spot, hard to remove, and have essentially zero negative effect on the generated content.
How AI watermarking works for images and videos
SynthID is an AI watermarking system developed by Google and also used by OpenAI. There aren't a huge amount of details publicly available (for the obvious reason that it would make it easy to defeat), but according to Google, the watermark is embedded when the image or video is generated.
Crucially, SynthID supposedly doesn't affect the quality of the generation, and it's designed to survive edits like cropping and adding a filter, resizing or compressing the image, or changing the video frame rate. It also survives being screenshotted. That means we know there's something going on at a pixel level, but it's not easy to avoid.
In the screenshot below, you can see I've generated an image with ChatGPT.
I used Photoshop to flip the image, crop it, turn it black and white, and increase the contrast. Instead of saving it, I then took a screenshot of it.
And even still, OpenAI's SynthID checking tools correctly identified it as AI-generated.
The big catch is that SynthID is currently provider-specific in how it's implemented. I'll get into watermark detection tools a little later, but that means that Gemini, for example, isn't able to detect that the image is AI generated from OpenAI's embedded SynthID watermark—and vice versa.
How AI watermarking works for text
Watermarking AI text is a bit trickier. You can't hide the information in random extr!a characters or funky capitAlizaTion without it being incredibly obvious and really easy to remove. Similarly, text is inherently transient and transferable. If you copy and paste text from one app to another, it's very different from copying and pasting an image.
Instead, the AI-generated watermark is hidden in how the model chooses what word comes next.
LLMs generate text one token at a time. If you give it "once upon a time" as a prompt, the whole model runs and predicts the single next word: "in." Then it reruns with the prompt "once upon a time in" and predicts something like "a." Then "once upon a time in a" gets you to "once upon a time in a land," and so on and so on until you have a full fairy tale.
But if the LLM chose the same word every time, the story would be crap. Instead, LLMs have a bit of randomness baked in (how much randomness is controlled by a setting called "temperature"). After "once upon a time," there are actually a few options:
in… a land far far away
there… lived a young princess
a… young boy
shut… up and stop interrupting my story
Obviously, "in" is the most common option here. Let's say it occurs 40% of the time. Then "there" and "a" both occur 25% of the time, and something totally different occurs 10% of the time. That gives us a really simple probability ratio of 40:25:25:10.
The way the AI watermark works is by nudging these probabilities. This is done in code with a secret key (basically a really long number), and that gets combined with the preceding few words to skew the next token selection process by a small amount. It's not as if watermarked AI is suddenly trying to banana random strawberries into the text. Instead, the chance of a particular word in any given string of text gets nudged a small amount. If this happens over 1,000 words of generated text, there'll be enough situations where a specific, slightly-lower probability word is featured more frequently than would be expected.
Of course, this only works when there are a couple of legitimate options. Let's say there's something like, "the capital of France is…" Well, there's only one realistic correct answer—Paris—so there's no option to nudge the chosen token. But if the sentence is more like "French cuisine is known for its…" then there are a few good options: "croissants," "pastries," "cheeses," "meats," "stews," and "fine dining" are all realistic, though they'll depend on what the overall thrust of the piece is.
Even better is when there's a situation where the AI has multiple equivalent words to choose from. "It was cold and gray," "It was cold and overcast," "It was cold and dark," and "It was cold and cloudy" are all close synonyms. In situations like this, the word choice ratios can be skewed without it affecting the text too much.
It's also important to note that the word choice isn't consistent. Because of the way the preceding words are incorporated into the probabilities, "On Tuesday it was cold and…," "Last Tuesday it was cold and…," and "This Tuesday it was cold and…," will all have different watermarked word choices. The AI won't keep repeating the word "overcast" instead of "dark" at every opportunity.
Which AI providers are using watermarks?
This is mostly a story because Anthropic announced that, in order to comply with Article 50 of the EU AI Act, it was going to start watermarking text.
Claude is using a version of SynthID-Text that Google developed a few years ago and uses in the Gemini app. OpenAI hasn't announced that it's going to watermark its text yet, but I wouldn't be surprised if that happens soon enough. It's also signed up to the EU AI code of practice.
AI labs like Meta, Microsoft, Mistral, and Black Forest Labs are also committed to the EU's AI transparency principles. Black Forest Labs already watermarks the images its FLUX models generate, and I suspect new models from the other companies will add text watermarking at some point.
Two notable companies that haven't signed up to the EU approach are xAI and Midjourney.
Limitations of AI watermarks
While AI companies might talk like watermarks are a solved problem, the reality is a lot more complicated. Text watermarks in particular have some big caveats:
Short text is hard to watermark. The watermark is built up over patterns in a piece of text. In short chunks of text, there's just less watermark to see.
Code is hard to watermark. AI-generated code doesn't have the same variation, which makes it a lot harder to watermark. It's similar for math, science, and other fact-based fields.
The watermark only shows AI involvement—not the level of involvement. If you ask Claude to edit your work, it will attempt to watermark it. You can steer it by only asking for a light edit pass, which will watermark it less, but there's no way to distinguish between Claude correcting your grammar and Claude doing the work for you.
Rewriting removes the watermark. Unlike image-based watermarks, you can remove it by editing and rewriting the text. It takes a good bit of rewriting, so whether it still counts as AI-generated text or not is more philosophical, but it's still possible to avoid AI detection even if AI wrote it. Image and video watermarks are substantially harder to remove, but substantial edits can still do it.
Checking for AI watermarks isn't simple. There isn't a universal SynthID or watermark tool, so checking for AI-generated images isn't particularly convenient. OpenAI doesn't know anything about FLUX-generated images, for example.
How to check for an AI watermark
There isn't one universal watermark detector. Instead, different companies have different tools with differing levels of availability. This should all be changing quickly as a lot of these tools are in testing or limited release.
To give you an idea of how things stand:
Google allows you to upload an image, video, or audio clip to Gemini, and it'll tell you if it was made by one of its AI products. It can also spot the Content Credentials in AI-generated images and files from other tools.
OpenAI has a public verification tool that checks images, audio, and video for Content Credentials and SynthID. It's also available as an API.
Anthropic's text watermark detection API isn't publicly available. Regulators, the media, some businesses, and similar groups are currently testing it.
Presumably, as these roll out more, services will combine the multiple APIs into a single AI checker that can look for a watermark across the various services. For now though, it isn't simple.
Keep in mind, too, that AI content detectors are a different beast. They're not looking for a watermark; they're analyzing the text for AI tells. Things like the "it's not X, it's Y" structure (I swear I wrote the previous sentence with my human brain), the word "delve," and loads—and loads—of em dashes are examples of the kinds of things they check for.
Though as these stylistic preferences get trained out, the AI detectors have to find new signals. There's a reason that AI content detectors don't actually tell you why they think something is AI: they're picking it up on dozens of small signals that occur together.
Are AI watermarks here to stay?
As AI-generated text and images keep improving, watermarks are likely to become increasingly used. Not only do governments, international organizations like the EU, and regulators want to be able to discern AI-generated content, but it's also in the interest of the AI labs themselves.
Model collapse is a theorized decline in generative AI performance. The idea is that as models get trained on more and more AI-generated data, the AI-ness, data variation, and errors increase, and they lose the human-ness that makes them good. It's been demonstrated with research models, but given how much content OpenAI and Anthropic are pulling in from the internet, they have a strong incentive to be able to spot things their models have generated so they can exclude it from the training set.
All told, it seems AI watermarks are here to stay, though they're likely to be a bit of a battleground for the next while. Some people and companies will be strongly anti-watermark, others will be pro-watermark, and there'll be some shouting.
Related reading:
