🔍 How AI watermarking works

A lot of AI output now carries fingerprints you cannot see. Sometimes you can, like a C2PA badge in a photo app. Usually you cannot. This piece walks through how that marking works, in four layers, and what each layer means if you need to detect or remove a mark from content you own.

Why mark AI content at all?

Providers and regulators want provenance: proof of where a piece of content came from. Three things are pushing this:

• Transparency laws. The EU AI Act (Article 50) and California's SB 942 require AI-generated content to carry machine-readable marks in many cases.
• Platforms. Social networks want to label AI media at scale, which needs a signal in the file itself.
• Accountability. If a model is used to spread misinformation, a watermark can help trace the output back to the generator.

Watermarking is a technical compromise. To judge it you have to see the four layers where a provider can hide a signal.

Layer 1: file metadata and C2PA

The usual approach is to attach provenance to the file container: EXIF fields, XMP packets, document properties (docProps in DOCX/ODT), or a full C2PA manifest. C2PA (Coalition for Content Provenance and Authenticity) embeds a signed, tamper-evident manifest, often as JUMBF data inside PNG or JPEG chunks, describing the generator, the toolchain, and edits.

This layer survives casual re-saving, but it is still metadata, and metadata can be stripped. Removing it is deterministic and verifiable. That is why metadata cleaning is the most reliable part of any watermark-removal pipeline.

Layer 2: invisible Unicode

Text has a hidden channel: Unicode control characters that render as nothing. Zero-width spaces (U+200B), zero-width joiners, bidi override characters, tag characters, exotic space variants, and homoglyph look-alikes (Cyrillic letters that mirror Latin ones) can all be injected into text without a reader noticing.

• Edit-based marks: a provider (or a wrapper tool) sprinkles zero-width characters through the text according to a secret pattern. A detector counts them and compares them against the pattern.
• Weakness: any Unicode sanitizer, including the Layer A scrub in this project, removes them losslessly. No rewording needed.
• Why they still exist: they are cheap to add, invisible, and they beat naive copy-paste checks. They are not a serious defense against someone who actually tries to remove them.

Layer 3: statistical token watermarks

The strongest text watermarking does not hide anything invisible. It biases the model's token choices. The landmark scheme (Kirchenbauer et al., 2023) splits the vocabulary into a green list and a red list, seeded by the previous tokens. The model is nudged to pick green-list tokens, so the output carries a statistical signal that a detector holding the same secret seed can verify with a z-score.

Google's SynthID-Text (Dathathri et al., Nature 2024) is the deployed version of this idea, used in Gemini. The signal is spread across every sentence, which makes it hold up to light edits, translation, and summarization. The catch: the detector needs the secret key. Vendors do not publish that key, so nobody else can verify the mark.

Because the signal lives in the wording itself, you cannot delete a character and be done. You have to rewrite a large share of the text, sentence by sentence. That is why statistical-text removal is honestly described as best-effort, and why it costs quality.

Layer 4: pixel, audio, and video watermarks

For media, providers can embed tiny perturbations in the content itself. SynthID for images and video changes pixels in ways you cannot see but a model can detect. Audio marks hide signals in frequency bands. These are the strongest marks. They survive re-encoding and cropping. Removal needs the original generator (or a serious signal-processing attack), and detection needs the vendor's detector.

The robustness triangle

Academic work (notably Zhang et al., "Watermarks in the Sand," ICML 2024) shows a hard limit: for generative models, you cannot have a watermark that is robust, high quality, and undetectable by adversaries all at once. In the worst case, an attacker who knows the scheme can distort the output just enough to break the signal. In practice every watermark is a statistical bet, not a cryptographic guarantee.

Short version

So: metadata and Unicode marks come off with certainty. Statistical text marks come off only by rewriting, and you pay for that. Pixel-level marks are currently out of reach for third parties. The next article looks at which providers actually use which layer.