Skip to main content
AI Watermark Removal

Provider tracker

Meta AI Watermark: Content Seal, Audio, and Shelved Research

Meta runs two separate watermarking product lines that most write-ups conflate into one. Content Seal invisibly marks images made with Muse Image, while a completely different system, the Llama Defenders Program's audio watermark detector, has been guarding against voice fraud since April 2025, more than a year earlier. Neither marks Llama or Meta AI chat text, and Meta's own model cards confirm that gap directly. The nuance almost everyone misses: Meta has open-sourced a Content Seal framework that does span text, but that text component is a preprint Meta never claims to have deployed.

By Rowan ValePublished Revised Sources verified Confirmed

Key takeaways

  • Confirmed: Meta AI's photorealistic images carry visible markers, invisible pixel-level watermarks, and file metadata, a three-layer system Meta has documented since February 2024.
  • Confirmed: Content Seal, launched July 7, 2026 alongside Muse Image, invisibly watermarks images from the Meta AI app and meta.ai, engineered to survive cropping, compression, resizing, and screenshotting. Meta says video support is coming, and nothing has shipped yet.
  • Confirmed and widely missed: a separate Llama Defenders Program audio watermark detector launched in April 2025, over a year before Content Seal, aimed at voice-fraud detection, with Zendesk, Bell Canada, and AT&T as early adopters.
  • Research only, not shipped: Meta's Stable Signature roots a watermark inside a diffusion model's decoder and stays over 90% accurate at a false-positive rate below one in a million even after an image is cropped to a tenth of its size. Meta's separate radioactivity research shows text from a watermarked model leaves detectable traces in any smaller model later fine-tuned on it.
  • A targeted patent search across assignee, keyword, and inventor queries found zero Meta-assigned watermarking patents, consistent with Stable Signature living only in an academic paper.
  • Checked directly: Meta's Llama 3.1 and Llama 4 model cards contain no mention of watermarking, and Meta refused the EU's general-purpose-AI Code of Practice in 2025 while still signing the separate code covering AI-generated content transparency, which explicitly covers text, without ever addressing text watermarking in its own announcement.
  • Open-sourced but not deployed: Meta has released Content Seal as an MIT-licensed framework spanning audio, image, video and text. Its text component, TextSeal, was published as an arXiv preprint in May 2026 and Meta makes no claim that it runs in any product. The framework's README does say the image component is "deployed at scale for Muse Image" (using a custom proprietary implementation rather than the released code), so "Meta open-sourced it" and "Meta ships it" are not the same statement, and TextSeal is on the wrong side of that line.
  • Why TextSeal cannot be a retrofit: it is a generation-time method, meaning it has to be applied while the model is producing tokens. That rules it out as something anyone could bolt onto text after the fact, and it is the same structural reason open-weight models cannot be watermarked by their publisher.

Media watermarking

How image, audio, and video marking differs from text

Embedded in the signal, not the sampling

Image, audio, and video watermarks (SynthID, Content Seal, Stable Signature) are embedded directly into pixels, audio samples, or frames after generation. This is a different mechanism from statistical text watermarking, which biases token choice during generation.

Designed for robustness, not guaranteed

Providers describe these signals as surviving common transformations such as cropping, compression, or resizing better than file metadata does. That is a robustness design goal, not a claim that the signal is unremovable.

Why this matters for removal tools

A tool that strips file metadata does not touch an embedded pixel, audio, or video watermark, and vice versa. Claims of "AI watermark removal" for media should specify which of these signals (metadata, embedded signal, or visible mark) a tool actually addresses.

How does Meta watermark AI-generated images?

Confirmed

Three signals dating to 2024, one new system launched July 2026, and which Meta product each of them actually belongs to.

Since February 2024, Meta has said photorealistic images made with Meta AI carry three separate signals:

  • A visible marker on the image itself
  • An invisible watermark embedded in the pixels
  • Metadata written into the file

Each layer fails differently, which is the point. Crop away the visible mark and the invisible one can still be there; strip the metadata during a re-upload and the pixel-level signal might survive.

Meta's Muse Image announcement, dated July 7, 2026, introduced Content Seal: invisible watermarking specifically for images created in the Meta AI app and on meta.ai.

Meta built it to survive:

  • Cropping
  • Compression
  • Resizing
  • Screenshotting

Meta says it plans to extend Content Seal to video. As of this update, no shipped video launch has been announced, only that standing promise.

Does Meta watermark AI-generated audio?

Confirmed

Meta shipped an audio watermark detector in April 2025, a year ahead of Content Seal, to stop cloned voices clearing identity checks on phone calls.

Long before Content Seal existed, Meta's Llama Defenders Program shipped an audio watermark detector in April 2025. Different branding, different purpose: catching AI-generated voice used in fraud, not disclosing ordinary AI content.

Its early adopters were:

  • Zendesk
  • Bell Canada
  • AT&T

Content Seal is the newer of two distinct product lines, not the whole story.

What is Meta's Stable Signature watermarking research?

Research/proposal

Stable Signature stays above 90% accurate on an image cropped to a tenth of its size. A targeted patent search found zero Meta filings behind it.

Fernandez and colleagues, a Meta and Inria research team, published Stable Signature in 2023. It roots a watermark inside a latent diffusion model's own decoder, so every image the model generates carries a recoverable signature by construction.

In a broad academic sweep it turned out to be the single most-cited image-watermarking paper found, at roughly 428 citations. It stays over 90% accurate at a false-positive rate below one in a million even after an image is cropped down to a tenth of its original content.

That is a research result, not a description of what Content Seal actually runs. Meta has never claimed the two are the same thing.

Meta's FAIR team, led by Sander and colleagues, has separately published on watermark radioactivity: fine-tune a smaller model on text a watermarked model produced, and the contamination stays statistically detectable in the smaller model's own output. FAIR has also published post-hoc, rephrasing-based text watermarking applied after generation.

Does Meta watermark Llama or Meta AI text?

Official announcement

Meta signed an EU code that explicitly covers text, then announced only image tooling. The open-weights reason that silence may be structural rather than evasive.

Nothing Meta has published says whether Llama or Meta AI text carries a watermark. In 2025, Meta refused the EU's general-purpose-AI Code of Practice, with Chief Global Affairs Officer Joel Kaplan citing legal uncertainties and calling its measures far beyond the scope of the AI Act.

Then on July 28, 2026, Meta signed a different, more specific code: the EU Code of Practice on Transparency of AI-Generated Content, alongside roughly 190 signatories in total, including Anthropic, Google, Microsoft, and OpenAI. That code explicitly covers text output.

Meta's own announcement of the signature discusses only image-detection tooling and never mentions text. Meta's Llama 3.1 and Llama 4 model cards, checked directly, contain no mention of watermarking either.

That absence stands out against the rest of the field. Anthropic and Google have each published a specific position on their own text watermarking, contested in Google's case but at least stated, while Meta has published neither a yes nor a no.

There is a real engineering constraint underneath it, worth naming rather than leaving on Llama's page alone. Once Meta releases a model's weights, it no longer controls how that model gets decoded downstream, so a watermark applied at Meta's own inference time would not travel with a self-hosted copy.

That is exactly the gap Christ, Gunn, Malkin, and Raykova's 2024 proposal for weight-embedded watermarking is trying to close. It remains a proposal.

FAQ

Does Meta document text watermarking for Llama outputs?

No. Meta's watermarking documentation and research cover images and, less visibly, audio, while nothing in its model cards, the Content Seal announcement, or its EU transparency-code signature claims that ordinary Llama or Meta AI chat text carries a watermark.

Is Content Seal the same system as Meta's audio watermark?

No, they are unrelated products. Content Seal covers images generated with Muse Image and launched in July 2026, while the audio watermark detector is part of the Llama Defenders Program, launched in April 2025 for voice-fraud detection under different branding.

Has Meta patented its image watermarking technology?

Not that a targeted search found. Stable Signature, Meta's most-cited watermarking research, appears to exist only as an academic paper, and no Meta-assigned watermarking patent turned up across assignee, keyword, and inventor-name queries.

Could a self-hosted Llama deployment ever carry a text watermark?

Only if whoever runs inference adds one themselves. Meta releasing a model's weights means Meta no longer controls decoding downstream, so a scheme applied at Meta's own inference time would not follow the model into someone else's deployment.

Next steps

  • Take the text-specific question on its own terms, including the primary sources that were checked and came back empty. Is Llama watermarked?
  • Find out which image watermarks actually survive real-world edits like cropping, screenshots, and re-compression. How image watermarking holds up
  • Look at audio watermarking as its own field, since Meta's oldest watermarking product lives there and almost nobody covers it. Audio AI watermarking
  • Understand the metadata layer Meta writes into image files, and why it is the easiest of the three layers to lose. C2PA Content Credentials

Sources and citation status