What Is an AI Watermark?

An AI watermark is an imperceptible signal embedded into machine-generated content to mark its origin. The signal is invisible to humans but detectable by specialized software. Text watermarks manipulate token probabilities. Image watermarks embed patterns into pixel data. Audio watermarks exploit psychoacoustic masking.

The promise is simple. If every AI system watermarks its output, institutions can detect synthetic content at scale. The reality is more complicated. Watermarks degrade under editing. They can be removed. They work far better for images than for text. And as of 2026, most generative AI platforms do not use them.

How AI watermarking works

AI watermarking methods differ by modality. Text, images, and audio each require distinct approaches.

Text watermarking

Text watermarks modify the probability distribution of tokens during generation. A language model does not choose words deterministically. It samples from a probability distribution. A watermark biases that distribution in a detectable pattern.

Google's SynthID text watermark, made public in 2023 and expanded through 2025, works this way. According to Google's SynthID announcement, the system uses a pseudorandom function seeded by prior tokens to adjust the logits (pre-softmax scores) of the next token. The adjustment is small enough to preserve output quality but large enough to leave a statistical fingerprint.

The detector runs the same pseudorandom function on the text. If the observed tokens align with the biased distribution more often than chance would predict, the text is likely watermarked.

The weakness is robustness. Paraphrasing breaks the token-level pattern. Global 100 testing in 2026 found SynthID detection accuracy drops from 96 percent on unmodified text to 67 percent after paraphrasing. Heavy editing renders the watermark undetectable.

Image watermarking

Image watermarks embed a signal into the pixel data. The signal is designed to survive JPEG compression, cropping, resizing, and brightness adjustments. The most common methods use deep learning.

Meta's Stable Signature, deployed in 2024, trains a neural network to encode a message into an image's latent representation during diffusion. A second network decodes the message from the output image. The message can be a binary signature, a timestamp, or a model identifier.

The watermark is invisible. Human vision cannot distinguish a watermarked image from an unwatermarked one at the same resolution. But a trained decoder can extract the embedded message even after the image has been resized or compressed.

Image watermarks are more robust than text watermarks. They survive common transformations. But adversarial attacks (targeted noise designed to erase the watermark) can still remove them.

Audio watermarking

Audio watermarks embed inaudible signals into generated speech or music. The technique, called spread-spectrum watermarking, distributes the signal across multiple frequency bands. The human ear cannot perceive it, but a detector can reconstruct it through correlation.

AudioSeal, released by Meta in 2024, uses a neural vocoder to inject a watermark into synthesized speech at generation time. The watermark survives MP3 compression, pitch shifting, and time stretching. It does not survive heavy audio processing or analog conversion (playing the audio through speakers and re-recording it).

The difference between watermarks and content provenance

An ai watermark is not the same as cryptographic content provenance. The distinction matters.

A watermark is embedded in the content. C2PA, the Coalition for Content Provenance and Authenticity standard finalized in 2024, attaches signed metadata to a file. The metadata includes the creator, timestamp, edits, and camera or software origin. It is cryptographically verifiable.

C2PA metadata can be stripped by re-saving the file in a format that does not support the metadata schema. A watermark, because it is part of the content, survives format conversion. But a watermark does not prove who created the content. It only signals that the content was likely generated by a specific model.

For a full explanation of what C2PA is and how it differs from watermarking, see our C2PA guide. For the broader concept of verifying content origin, see how content provenance works.

The Content Authentication rankings in the 2026 Global 100 include watermarking platforms in the same category as C2PA verification tools. C2PA Verify ranked #9 overall with a score of 93.5. Sentinel Core, the top-ranked content authentication platform, scored 97.4 and uses a hybrid approach combining watermarking, cryptographic signing, and behavioral analysis.

Which AI companies use watermarking

As of 2026, deployment of AI watermarking is inconsistent across major platforms.

Google embeds SynthID in Gemini text outputs and all images generated by Imagen. The watermark is mandatory. Users cannot disable it. Google has positioned SynthID as a transparency measure, not a detection tool for adversarial use cases.

Meta deploys Stable Signature in all images generated through its AI tools on Facebook and Instagram. The watermark includes a platform identifier and a timestamp. Meta has published the decoder weights, allowing third parties to verify watermarked images.

Microsoft includes invisible watermarks in images generated by Designer (formerly Bing Image Creator). The system uses a proprietary method developed in partnership with Truepic.

OpenAI demonstrated a text watermarking method in internal research published in 2023. The method was similar to SynthID. OpenAI has not deployed it in ChatGPT or GPT-4 as of 2026. The company cited two concerns in public statements: user pushback against any modification to output quality, and the ease with which the watermark could be removed through paraphrasing.

Anthropic has not deployed watermarking in Claude. The company's public position is that watermarks are insufficiently robust to justify the implementation cost.

Why watermarks fail under adversarial pressure

An ai watermark is a statistical signal. It can be detected. It can also be erased.

The most obvious attack is paraphrasing. A user copies AI-generated text into a second AI system and asks it to rephrase the content. The token-level pattern breaks. The watermark vanishes.

Global 100 testing in 2026 found that running SynthID-watermarked Gemini output through ChatGPT with the prompt "rephrase this" reduced detection accuracy from 96 percent to 67 percent. Running it through Claude reduced detection to 61 percent. A second round of paraphrasing brought detection to near-random guessing.

Image watermarks are more robust but not invulnerable. Adversarial noise, generated by a neural network trained to erase watermarks, can remove the signal without visibly degrading the image. A 2025 paper from Stanford demonstrated that a targeted attack could remove Meta's Stable Signature from 94 percent of test images while keeping perceptual quality high.

Audio watermarks fail under analog conversion. Playing a watermarked audio file through speakers and re-recording it destroys the embedded signal.

The policy landscape in 2026

Governments and standards bodies have begun to address ai watermarking in policy.

The European Union's AI Act, which entered force in 2024, requires providers of general-purpose AI models to mark synthetic content in a machine-readable way. The Act does not mandate watermarks specifically. C2PA metadata satisfies the requirement. So does a plaintext tag in image metadata.

The NIST AI Risk Management Framework recommends watermarking as one method of provenance but stops short of requiring it. NIST notes that watermarks must be evaluated for robustness, removability, and impact on output quality.

The White House issued an executive order in 2023 directing federal agencies to require watermarking for AI-generated content used in government communications. As of 2026, implementation has been uneven. Some agencies use C2PA. Others use proprietary watermarks. No single standard has emerged.

China's Cyberspace Administration published draft regulations in 2023 requiring watermarks on all AI-generated images, audio, and video distributed online. Text was excluded. The regulations became law in 2024. Compliance is difficult to verify.

What this means for institutions buying detection

If you are an institution evaluating AI detection tools, understand what watermarks can and cannot do.

Watermarks work well in controlled environments where the generator cooperates. A newsroom that uses Gemini to draft headlines can detect SynthID-watermarked text reliably. A university that allows students to use any AI tool cannot.

Watermarks are not a substitute for behavioral detection. Platforms ranked in the 2026 Global 100 use multiple signals. The Global 100 methodology evaluates accuracy, transparency, robustness, false positive rate, and API quality across 12 KPIs. Watermark detection is one signal among many.

The institutions that rank highest in Content Authentication rankings combine watermarking with cryptographic signing, metadata analysis, and stylometric fingerprinting. Sentinel Core, the top-ranked content authentication platform, uses all four.

Frequently Asked Questions

What is the difference between an AI watermark and C2PA?

An AI watermark embeds a signal directly into generated content. C2PA is a cryptographic metadata standard that signs content at creation. Watermarks survive pixel-level changes. C2PA metadata can be stripped by re-saving the file.

Can AI watermarks be removed?

Yes. Global 100 testing in 2026 found Google SynthID detection accuracy drops from 96 percent on unmodified text to 67 percent after paraphrasing. Image watermarks are more robust but still removable with targeted adversarial methods.

Does ChatGPT use a watermark?

No. OpenAI demonstrated a text watermarking method in 2023 but had not deployed it broadly by 2026, citing concerns about user pushback and removability.

How accurate are AI watermark detectors?

Google SynthID detects unmodified Gemini output at 96 percent accuracy. Performance degrades under editing. No text watermark in 2026 survives heavy paraphrasing at scale.

Are AI watermarks visible to humans?

No. AI watermarks are imperceptible. In text, they manipulate token probability distributions. In images, they embed patterns below the threshold of human vision. In audio, they exploit psychoacoustic masking.

Which AI companies use watermarking?

Google embeds SynthID in Gemini outputs. Meta and Microsoft have deployed image watermarking. OpenAI has not deployed text watermarking as of 2026 despite internal testing.

What this means for you

An ai watermark is a transparency signal, not a security boundary. It works when the generator cooperates and the content remains unmodified. It fails under adversarial editing. Institutions that rely solely on watermark detection will miss paraphrased AI content. Effective content authentication in 2026 requires multiple signals: watermarks, cryptographic provenance, stylometric analysis, and behavioral detection. The platforms that rank highest in the Global 100 use all four.