What Is AI Watermarking?

Three genuinely different approaches sit under one term, and mixing them up is the root of most confusion in this space.

• Visible marks: an obvious label rendered into the content itself. Easy to spot, easy to crop out.
• Invisible media watermarks: a signal hidden inside the pixels, audio samples, or video frames. A viewer never notices it, and it is designed to survive ordinary handling.
• Provenance records: a signed description of where content came from and what changed, attached alongside the file without touching a single pixel.

C2PA calls that signed record a Content Credential. Its steering committee includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok, and Truepic, which gives it real cross-industry weight.

Because the record is cryptographically signed, tampering with its contents can be detected. But it is still metadata riding alongside a file rather than embedded in it.

Strip that metadata during an upload or a screenshot and the record disappears completely, even though the image or video looks exactly the same.

Text watermarking happens during generation, not after the fact, which makes it structurally different from a media watermark or a metadata tag. When an AI news account posted on August 10, 2026 that new Claude models embed an invisible watermark in every piece of text they generate, the post cleared 1.3 million views and one of the top replies asked whether that just meant em dashes.

That reply missed the mechanism entirely. The mark goes into token statistics as the model writes, not into a punctuation habit a reader can point to, and the em dash theory itself traces to a viral February 2025 post claiming humans rarely use the character.

As the model writes, it slightly favors certain word and token choices over others. The pattern is too subtle for a reader to notice, but a matching detector can measure it statistically.

Google's SynthID Text works exactly this way. It is a logits processor applied after the model's usual top-K and top-P sampling step, and Google's Nature paper describes a "tournament sampling" method plus a live deployment test across a very large volume of real Gemini conversations that found no detectable drop in output quality.

The mechanism is unusually open for a shipped safety feature. A production-grade implementation has been in Hugging Face Transformers since version 4.46.0, complete with a reference detector that returns one of three verdicts: watermarked, not watermarked, or uncertain.

Anthropic makes a comparable claim for Claude without publishing an algorithm, saying a supported model "weaves an imperceptible watermark directly into the text itself."

• Documented strength: SynthID Text holds up against cropping a passage and changing a few words.
• Documented weakness: confidence drops under thorough rewriting or translation into another language.
• Documented weakness: reliability falls on short factual answers, where there is little room to shift word choice without damaging accuracy.

Checked directly as of 2026-08-11, GPTZero, Originality.ai, and ZeroGPT contain no mention of SynthID, C2PA, or watermarking anywhere in their own descriptions of how they work.

• GPTZero: purely statistical and stylistic scoring of the text itself.
• ZeroGPT: a method it brands DeepAnalyse, also statistical and stylistic.
• Originality.ai: a modified BERT model performing classification.

All three infer origin from patterns in the writing rather than from a signal a provider actually placed there. That is an outside party's statistical guess about content it never touched at creation time.

It can be wrong in both directions. On a 2023 Hacker News thread about one detection service, commenters reported a Wikipedia article scoring 91 percent AI-generated and 1990s academic papers scoring 97 to 100 percent, alongside GPT-4 responses scoring under 5 percent.

The founder replied in that same thread acknowledging that short texts carry a much weaker signal. Another commenter named the misreading that does the most damage in academic-integrity cases: a "27% AI" score treated as though 27 percent of the text was AI-written.

A watermark or provenance signal answers one narrow question: did this system produce or touch this content?

It says nothing about whether the content is true, whether it was edited afterward, who owns it, or whether it is being shown in a context that matches its original meaning. OpenAI states this plainly, describing provenance signals as "not a guarantee that content is accurate, unedited, legally owned, or presented in the correct context."

The negative case is weaker still. OpenAI's framing for its own image-verification tool is that finding a provenance signal is a good indicator of OpenAI origin, but not finding one proves nothing either way.

The image could still be OpenAI-generated with the signal stripped along the way, or never applied to begin with. As OpenAI's own documentation puts it: "No detection method is foolproof."