Textbook of AI

Watermarking AI content refers to techniques that embed a persistent, machine-detectable signal in the outputs of generative models, with the goal of allowing downstream tools to determine whether a piece of content was machine-generated. Watermarking is one component of a broader content authenticity stack (alongside provenance metadata such as C2PA and ex-post detection classifiers).

Approaches

• Statistical text watermarking (Kirchenbauer et al. 2023), at each token-generation step, randomly partition the vocabulary into "green" and "red" lists conditioned on the prior token; bias the model towards green tokens. The bias is imperceptible to readers but produces a green-token excess detectable by anyone with the keying function.

• Generative-model-side image watermarking (Google SynthID, 2023), modify the diffusion model's output to embed a pattern in the pixel statistics that survives common transformations (compression, cropping, resizing).

• Audio watermarking, embed signals in inaudible spectral regions (Meta AudioSeal, 2024).

• Post-hoc / fingerprint-based, record cryptographic hashes of every generated image at the source and check candidate images against the database.

Goals and limitations

The standard goals are soundness (low false-positive rate on human content), completeness (high detection rate on AI content), robustness (survives editing and re-encoding) and non-degradation (the watermark does not visibly harm output quality). All of these are in tension.

Known limitations:

• Removability, published attacks (Zhang et al. 2024) remove or forge text watermarks at modest cost; image watermarks similarly vulnerable to strong adversarial post-processing.

• Open-weights problem, open-source models can be modified to remove watermarking entirely.

• Cross-model false positives, a watermark from model A can be detected as model A even if the content is human.

• Coverage, watermarking only covers content from cooperating producers; bad actors using non-cooperating models are unaffected.

Status

As of 2026, SynthID is deployed across Google's image, audio and text generation products; Meta's AudioSeal is integrated into Voicebox; OpenAI has implemented watermarking research but resisted deployment in production text models, citing user-experience and removability concerns. The Biden 2023 EO and the EU AI Act (Article 50) both contain watermarking-related provisions for synthetic media.

Watermarking is best understood as one layer in a defence-in-depth approach to content authenticity, complementary to C2PA content credentials and synthetic-content detection.

References

• Kirchenbauer, Geiping et al. (2023). A Watermark for Large Language Models.

• Google DeepMind (2024). SynthID.

• Zhang et al. (2024). Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models.