# AI watermarking

> Hidden marks placed in AI-generated content so software can recognize it later.

- Level: Intermediate
- Topics: AI, Security
- URL: https://tidbit.legios.com.ar/ai-watermarking/
- In Spanish: [Marca de agua de IA](https://tidbit.legios.com.ar/es/ai-watermarking/)

**AI watermarking** means hiding a signal inside content while an AI creates it: an image, a video, a voice, even text. People cannot see or hear it, but a matching detector can find it later and say "this came from that model". The goal is to tell synthetic content from real content at a time when deepfakes and text-to-image tools make them hard to tell apart.

For images and audio, the generator changes pixels or sound in tiny, patterned ways designed to survive cropping, compression or a screenshot. For text it is subtler: while choosing each next token, the model slightly favors some words over others following a secret key, and the detector checks whether a text leans that way more than chance would explain. Google DeepMind's **SynthID** works across images, audio, video and text, and Google released the text version as open source in 2024.

A related approach is **provenance metadata**, like the C2PA standard behind "Content Credentials": a signed label attached to the file that says who made it and with which tools. It is precise, but it lives beside the content rather than inside it, so a re-upload or a screenshot can strip it.

Watermarks have limits too. Each company's mark only works with its own detector, open-weights models can be run with no mark at all, and heavy edits or rewording can wash a mark out. So finding no watermark proves nothing. Even so, rules like the EU AI Act ask providers to mark AI-generated content in a machine-readable way, which is pushing watermarks into more products.

## An analogy

The security thread inside a banknote. You never notice it while paying, but the right lamp at the bank reveals it. And a forger who does not bother with it simply prints bills without one.

## Keep in mind

- An invisible signal added at creation, readable by a matching detector.
- Text watermarks nudge word choices in a statistically detectable way.
- Metadata labels like C2PA are precise but easy to strip.
- Finding no watermark does not mean a person made it.

## Go deeper

- [SynthID (Google DeepMind)](https://deepmind.google/models/synthid/)
- [C2PA: Coalition for Content Provenance and Authenticity](https://c2pa.org/)
- [Digital watermarking on Wikipedia](https://en.wikipedia.org/wiki/Digital_watermarking)

## Related terms

- [Artificial intelligence](https://tidbit.legios.com.ar/artificial-intelligence/): Getting computers to do things that, until recently, only people could do.
- [Deepfake](https://tidbit.legios.com.ar/deepfake/): A fake video, photo or voice made with AI to look and sound like a real person.
- [Text-to-image](https://tidbit.legios.com.ar/text-to-image/): AI that draws a brand-new picture from a written description.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.
- [Open source](https://tidbit.legios.com.ar/open-source/): Software whose code anyone can read, use, change and share.
- [Metadata](https://tidbit.legios.com.ar/metadata/): Data that describes other data: who made it, when, where and what it contains.
- [Open-weights models](https://tidbit.legios.com.ar/open-weights-models/): AI models whose trained numbers anyone can download and run on their own machines.