Here’s How AI-Generated Watermarks Work (and How to Properly Check for Them).

Recently, Anthropic announced that its Claude models will soon begin adding invisible watermarks to text . Meanwhile, Google announced that its own visible Gemini watermark on generated images will now be optional. These are just two controversial examples of the many different methods for watermarking AI output. So, let’s explore how AI watermarks work and how they can be detected, even if they’re “invisible.”

How does an AI-generated watermark work?

The exact method for watermarking AI output depends on the type of media being created, but the principle is generally the same: data is embedded into the generated media that is invisible (or sometimes noticeable) to the human eye or ear, but identifies it as AI-generated. Watermark detection tools can then be used to determine whether the content was created by AI, without guesswork or relying on an unreliable AI “detector.” Here are some examples of how watermarking can be implemented for different types of media content.

• For images: Since image pixels represent mathematical values, they can be slightly modified to embed a digital signature without noticeable changes to the image itself. For example, Google’s SynthID technology distributes an invisible signature throughout any generated image, so even a cropped version will contain detectable portions of the watermark. Note: This is different from the visible gray symbol in the corner of Gemini images. Even if you disable the visible Gemini watermark, the invisible one will remain.

• Regarding audio, embedding a watermark in audio files can be made even easier by including characteristic sounds outside the range of human hearing (typically below 20 Hz or above 20,000 Hz). SynthID has an audio component that is audible to watermark detectors but remains undetectable to the human ear.

• Regarding video: naturally, generated video typically uses a combination of both of the aforementioned watermarking methods, although it’s worth remembering that someone creating fake content could, for example, generate AI-generated audio to accompany a real video, meaning the watermark might appear on one piece of content but not another.

• For text, each subsequent word generated by LLM is assigned a probability score. The sentence “Cat—” could end with the words “fluffy,” “cute,” or “little.” Each of these words is assigned a percentage probability of its occurrence. Text watermarks work by increasing the probability of certain sets of random words. This allows LLM-generated text to be detected without changing its semantic meaning. However, this generally works better for longer text fragments, which provides more opportunities to detect less probable words.

• Regarding metadata: while C2PA isn’t strictly speaking a watermark, it is a framework for adding metadata that can help confirm the origin of a media file. For example, some camera manufacturers have implemented C2PA to provide photographers with traceable information about the origin of an image. This can also include an indication of whether the image was created using artificial intelligence tools.

Although SynthID was originally developed by DeepMind, Google has open-sourced the protocol, and it is now used by other AI companies, including OpenAI. Some companies, however, don’t use a watermark at all, and among those that do, implementation can be inconsistent depending on the toolkit. In other words, the presence of an AI watermark can confirm that something was created or modified by AI, but its absence cannot prove otherwise .

How can you detect AI-generated watermarks?

Although SynthID and C2PA are relatively common, detecting the presence of watermarks or metadata confirming that a media file was created using AI remains quite difficult.OpenAI has a dedicated tool for checking for SynthID or C2PA in a file, and Google provides access to its verification tools through Gemini or, upon request, directly through Google.

However, these tools have limitations. For some reason, the OpenAI detector only seems to detect media files created by OpenAI itself. During testing, I tried uploading images created with Gemini, which could detect its own SynthID watermark, but OpenAI’s tool failed to detect it.

Meanwhile, Google has created a SynthID Detector portal , but it’s currently invite-only, specifically for journalists and verification specialists. You can still access some SynthID detection features through Gemini or Google, although in some cases, this will require appropriate prompts. In my testing, when I asked “Is this real?” for a known AI-generated image through Gemini, the tool launched a verification tool to check for SynthID. However, when running the same process through Google, the LLM result resembled more of a visual analysis. It only ran a SynthID check upon specific request.

Even if you thoroughly check for every version of the SynthID watermark or C2PA metadata, it’s still possible that a media file may contain a different type of watermark that will require a different detector to detect. Unfortunately, unless you have precise information about the tool used to create the media file, thoroughly checking for all watermark types can be challenging.

As for text watermarks like those used by Claude or even Gemini, detecting them can still be very challenging. Firstly, neither of these companies currently offers a publicly accessible way to check for a text watermark (Google’s SynthID Detector portal can do this, but it’s not publicly available).

Is it possible to bypass watermarks generated by artificial intelligence?

With enough effort, any watermark can technically be removed, though SynthID, in particular, is quite resistant to most common forms of modification. An AI-generated image containing a SynthID watermark that has been cropped, filtered, or altered may still retain enough of its original watermark to be detectable. Removing it isn’t impossible, but it’s generally difficult to do by accident.

On the other hand, removing metadata like C2PA is much easier. For images, it’s as simple as taking a screenshot. Taking a screenshot of an image essentially creates a new image file based on the pixels visible on the screen. This means that any watermark affecting those pixels may remain, but an entirely new set of metadata is created, removing all C2PA data along with it.

This means that if you want to maintain a chain of metadata that allows you to verify the authenticity of an image, it is important to download or upload the specific source files and ensure that the editing tools you use support preserving this metadata.

Text watermarks are among the easiest to circumvent. Since they work by simply changing the probability of certain words appearing, processing the text with another AI tool that rephrases the words without using a watermark, or even manually rewriting a block of text, can potentially remove the watermark.

Does the presence of a watermark always mean that media content was created using artificial intelligence?

It’s important to remember that a watermark can also be added to a genuine media file. If someone uploads a genuine photo to a tool like Gemini to perform simple edits, the resulting image will also have a SynthID watermark. This doesn’t mean the entire image is fake, but it will still be flagged by watermark detectors.

Similarly, an image of an object can be generated, cropped, and added to the image using traditional processing methods such as Photoshop to create a non-authentic image that is essentially created from the original. Whether the watermark will remain on the AI-generated portion of the image can only be determined on a case-by-case basis.

As mentioned, the absence of a watermark does not prove the authenticity of an image. Even the presence of a watermark does not prove that the image itself is not genuine. Watermarks and metadata are merely tools to help determine the likely origin of a given media file and how it may have been altered. Ultimately, it remains your responsibility to verify what you see and hear online .

More…