Add as a preferred source on Google
Table of Contents
Recently, Anthropic announced that its Claude models will soon begin marking its text output with invisible watermarks. At the same time, Google revealed that its own visible Gemini watermark on generated images will now be optional. These are just two contradictory examples of the wildly varied methods of watermarking AI output. So, let’s break down how AI watermarks work, and how you can detect them even when they're "invisible."How does AI watermarking work?The exact method for watermarking AI output will depend on the type of media being generated, but the principle is generally the same: The generated media is embedded with data that is undetectable (or occasionally detectable) to the human eye or ear, but which identifies it as AI-produced. Watermark-detecting tools can then be used to identify if something was made with AI, without guessing or using an unreliable AI “detector”. Here are some examples of how watermarks may be implemented for various media types.For images: Since the pixels of an image are mathematical values, they can be slightly modified to embed a digital signature, without perceptible changes to the image itself. Google’s SynthID, for example, distributes an invisible signature across any generated image, so even a cropped version will still contain detectable portions of the watermark. Note: This is distinct from the visible gray symbol in the corner of Gemini images. Even if you turn off the visible Gemini watermark, the invisible one remains.For audio: Embedding a watermark in audio files can be even easier, placing signature sounds outside the range of human hearing (typically below 20Hz or above 20,000Hz). SynthID has an audio component that can be heard by watermark detectors, but remains imperceptible to the ear.For video: Naturally, generated video tends to use a combination of both of the above watermarking methods, though it’s worth keeping in mind that someone making fake content could, for example, generate AI audio to accompany real video, meaning the watermark might appear in one piece of the content, but not another.For text: Every next word an LLM generates comes with a probability score. The sentence “The cat is” could end with “fluffy,” “cute,” or “small.” Each one of those words is given a percentage likelihood that it will appear. Text watermarks work by inflating the chances that certain sets of random words will appear. This can make it possible to detect LLM-generated text without changing its semantic meaning. However, this tends to work better for longer pieces of text, which provides more chances to detect the presence of less-likely words.For metadata: While not strictly a watermark, C2PA is a framework for adding metadata that can help verify the origin of a piece of media. Some camera manufacturers, for example, have implemented C2PA to give photographers a traceable record of where an image came from. This can also include noting whether an image was generated with AI tools.While SynthID originated with Google’s DeepMind, the company open-sourced the protocol, and now it’s also used by other AI companies, including OpenAI. Some companies. conversely, do not use a watermark at all—and among those that do, the implementation can be inconsistent between tools. In other words, the presence of an AI watermark can confirm something was made or modified with AI, but the absence of one can’t prove it wasn’t.
