How AI Watermarking Actually Works: Text, Image, Audio and Video

At a glance

An AI watermark is not a logo in the corner of an image and not a field in a metadata block. It is a deliberate statistical bias, keyed to a secret, that the generating system injects into its own output — into which token it picks, into which pixel values it emits, into the shape of a spectrogram. The bias is imperceptible by design and detectable only by someone who holds the key.

That single design decision explains almost everything that follows: why watermarks survive screenshots when metadata does not, why they carry almost no information, why they need entropy to exist at all, why nobody outside the provider can verify them, and why they are so much easier to remove than the press coverage suggests.

This article explains the mechanisms precisely — with the actual formulas — and then explains what each one can and cannot establish.

What a watermark is, and what it is not

Three different things get called "AI detection", and conflating them is the single most common error in this field.

Post-hoc classification looks at finished content and guesses. Text classifiers measure perplexity and burstiness; image classifiers look for generation artefacts. Nothing was embedded — the detector is inferring from statistical fingerprints of the generation process. This is guessing, and it fails in ways that harm people. OpenAI launched an AI Text Classifier in January 2023 and withdrew it in July 2023 "due to its low rate of accuracy".

Provenance metadata attaches a signed record to a file: who created it, with what tool, what was edited. C2PA Content Credentials is the dominant standard. This is verifiable and informative, but it is a separate data structure that travels alongside the content and is trivially removed.

Watermarking modifies the content itself at generation time so that a specific statistical property is present. It is not a guess — either the keyed signal is there or it is not. It is not metadata — you cannot strip it with exiftool.

Only the third is watermarking. This article is about the third.

The anatomy of a text watermark

The Nature paper describing Google's SynthID-Text gives the cleanest general framing: any generative text watermark has three components.

1. A random seed generator. At each generation step, derive a pseudorandom seed from the preceding tokens and a secret key:

r_t = h(x_{t−H}, …, x_{t−1}, k)

where h is a hash function, H is the context window size, and k is the secret watermarking key. The critical property: because the seed depends only on tokens that are visible in the final text, anyone who holds the key can recompute the seed afterwards. That is what makes detection possible without access to the model.

2. A sampling algorithm. Use r_t to bias which token gets emitted. This is where the schemes differ, and it is the only place they differ substantively.

3. A scoring function. Given a candidate text and the key, recompute every seed, measure how strongly the text conforms to the bias, and compare against what unwatermarked text would score.

Everything below is a variation on these three parts.

Scheme 1: the green list (Kirchenbauer et al., 2023)

The foundational scheme, and still the one most implementations are built on.

At step t, hash the preceding token to seed a random number generator. Use that RNG to partition the entire vocabulary V into a green list G of size γ|V| and a red list of size (1−γ)|V|. Then add a constant bias δ to the logit of every green-list token before the softmax:

p(green token k) = exp(l_k + δ) / [ Σ_{i∈red} exp(l_i) + Σ_{i∈green} exp(l_i + δ) ]

The model is now slightly more likely to pick green tokens. Not certain — just biased. Over hundreds of tokens the bias accumulates into a measurable excess of green tokens.

Detection is a one-proportion z-test. Under the null hypothesis "this text was written without knowledge of the green lists", each token is green with probability γ, so the green count is Binomial(T, γ):

z = (|s|_G − γT) / sqrt(T · γ · (1−γ))

At z > 4, the one-sided p-value is about 3 × 10⁻⁵. The paper reports that with γ = 0.5, δ = 2.0 and multinomial sampling, 98.4 % of 200-token generations are detected at the z = 4 threshold.

Two variants matter. The hard watermark forbids red tokens entirely — guaranteed detection, destroyed quality. The soft watermark described above degrades gracefully: in high-entropy positions the bias flips the choice, in low-entropy positions the model still emits the "correct" red token, sacrificing signal to preserve quality.

The scheme is distortionary by construction: the bias is applied whether or not the token would have been chosen anyway, so the output distribution is genuinely shifted away from the model's.

One caution that is frequently missed: Fernandez et al. showed that the Gaussian approximation underlying the z-test produces empirical false-positive rates that "vastly exceed" the predicted ones, because repeated n-grams violate the independence assumption. Their corrected approach uses the exact binomial null and de-duplicates repeated context/token pairs. Any p-value quoted from the original formula should be treated as optimistic.

Scheme 2: Gumbel sampling (Aaronson / the scheme OpenAI never shipped)

A more elegant construction that avoids distorting the distribution at all.

Derive pseudorandom values r_{t,i} ∈ (0,1) for every vocabulary token from a keyed function of the preceding k tokens. Then emit:

i(t) = argmax_i  r_{t,i}^{1/p_{t,i}}

Detection sums a simple transform of the realised randomness:

S = Σ_t ln( 1 / (1 − r_{t,i(t)}) )

Under the null, each term is Exponential(1), so S follows a Gamma(n, 1) distribution — a clean analytic null with no normal approximation needed. Watermarked text pushes S upward.

Why this is "distortion-free." The expression argmax r_i^{1/p_i} is an exact reparameterisation of categorical sampling: if the r_i are uniform and independent, the argmax is distributed exactly as p. Marginalised over the secret key, the watermarked model's output distribution is identical to the unwatermarked model's. Nothing is degraded.

There is a real cost, though, and it is rarely mentioned: because r is a deterministic function of the preceding tokens, the same context always produces the same token. Response diversity across repeated identical prompts collapses. Distortion-free at the level of a single response is not the same as behaviourally identical.

This is the scheme OpenAI built and never shipped. Reported in August 2024, it had been working for roughly a year, with claimed reliability around 99.9 % on sufficiently long text. It was held back for reasons worth listing, because they are commercial and social rather than technical: OpenAI's own survey found that 69 % of ChatGPT users believed cheating-detection technology would lead to false accusations, and nearly 30 % said they would use ChatGPT less if OpenAI watermarked and a competitor did not. OpenAI also cited the risk of stigmatising non-native English speakers, and conceded the mark was trivially defeated by translation or by asking the model to insert a character between every word and then deleting it.

As of August 2026, OpenAI has deployed provenance for images and audio only — C2PA plus SynthID — and no text watermark.

Scheme 3: tournament sampling (SynthID-Text — the one in production)

Google DeepMind's contribution, published in Nature in October 2024 and running in Gemini today.

Instead of biasing logits or transforming the sampling rule, tournament sampling samples honestly and then selects among honest samples.

1. Draw N^m candidate tokens independently from the model's true distribution p_LM.
2. For each tournament layer ℓ = 1…m, pair the survivors and let the winner of each match be whichever token scores higher under a keyed pseudorandom function g_ℓ.
3. Emit the final survivor.

The paper's defaults are m = 30 layers, N = 2 competitors per match, and a context window of H = 4 preceding tokens.

The g-function is defined as:

g_ℓ(x, r) = F_g^{-1}( h(x, ℓ, r) / 2^{n_sec} )

typically with g ∈ {0,1} drawn Bernoulli(0.5). Each layer has an independent g.

The non-distortion claim, stated precisely. With exactly two competitors per match, averaged over the random seed, the emitted token's distribution equals p_LM. This is a marginal, seed-averaged, single-token guarantee — not a per-sample one. Conditioned on a specific seed, the distribution is skewed, and that skew is exactly what detection measures. Stronger sequence-level non-distortion requires repeated context masking: watermarking is skipped when an identical context window has already occurred recently, which costs real detectability on repetitive text.

Detection is where SynthID-Text diverges most sharply from its predecessors. The paper defines three scorers — a mean g-value, a weighted mean, and a Bayesian scorer which is the default and best-performing. The Bayesian scorer is a trained classifier computing the posterior probability that the text is watermarked. Consequently there is no closed-form p-value in the deployed configuration. Thresholds are set empirically against a held-out unwatermarked corpus, and results are reported as true-positive rate at a fixed false-positive rate of 1 %. Reports that describe SynthID as using a z-test are describing the wrong scheme.

Two production facts from the paper are worth quoting because they answer the obvious objection that watermarking degrades output. In a live experiment across roughly 20 million Gemini responses, the thumbs-up rate between watermarked and unwatermarked models differed by 0.01 % and the thumbs-down rate by 0.02 % — both statistically insignificant. Latency overhead was 0.57 %.

The entropy problem — the hard limit nobody can engineer around

Every scheme above depends on there being more than one reasonable next token. If there is only one, there is nothing to bias.

The green list can only steer when a red token and a green token are both plausible. Gumbel sampling can only vary the argmax when several tokens have comparable probability. Tournament sampling draws N^m candidates from p_LM — if p_LM is nearly a point mass, all N^m candidates are the same token and the tournament is vacuous. Zero signal is deposited, by construction.

The Nature paper is blunt about it: if the distribution is very low entropy, "Tournament sampling cannot choose tokens that score more highly under the g functions."

Kirchenbauer et al. formalise the same thing through spike entropy, and prove a lower bound on expected green tokens that scales with it.

The practical consequences:

Two further effects push the same direction: lower sampling temperature and top-k truncation both sharpen the distribution and reduce watermark strength, and — uncomfortably — so do better models and RLHF, which make output distributions more confident.

The uncomfortable conclusion, which vendors do not advertise: the content where provenance matters most is the content that watermarks handle worst. A fabricated factual claim, a generated code snippet in a supply-chain attack, a short defamatory sentence — all sit precisely in the low-entropy regime where no statistical mark can be embedded.

Image, audio and video watermarking

The media modalities work on a completely different principle, and the difference is instructive.

Images

Modern systems do not hand-design a transform. They train two neural networks jointly: an encoder that perturbs the image to embed a payload, and a decoder that recovers it. The training objective balances two terms — imperceptibility (the perturbation must not be visible) and robustness (the decoder must still recover the payload after realistic distortions are applied during training).

Google's SynthID for images follows exactly this pattern: two deep learning models, one for watermarking and one for identifying, trained together, embedding the mark directly into the pixels rather than as an overlay or metadata layer.

Because the mark lives in pixel values, it survives things metadata cannot: screenshots, re-encoding, upload to a platform that strips EXIF. Google claims robustness against colour filters, brightness and contrast changes, JPEG compression, rotation, resizing and cropping — while conceding the system "isn't perfect" against extreme manipulation.

The older academic lineage — least-significant-bit embedding, spread-spectrum methods in the DCT or DWT domain — is still in use commercially but is much easier to attack.

An important asymmetry to note: unlike SynthID-Text, there is no peer-reviewed paper for SynthID's image, audio or video watermarks. No published architecture, no bit capacity, no ROC curves, no independent robustness benchmark. Every robustness claim rests on the vendor's own unaudited testing. The modality with the strongest published science (text) has the least public accountability in deployment; the modalities with the weakest published science are the ones the public can actually query.

Audio

The waveform is converted to a spectrogram — a two-dimensional representation of how the frequency spectrum evolves over time — the watermark is embedded there, and the spectrogram is converted back to audio. Google reports the mark is inaudible and survives noise addition, MP3 compression, and speed changes, and that it can localise which portions of a track are synthetic rather than only flagging the whole file.

Video

In practice, the image technique applied per frame. This gives natural redundancy: an attacker must defeat the mark in enough frames to matter, and the decoder can aggregate evidence across frames.

How much does it take to remove a watermark?

This is where the marketing and the literature diverge most sharply. The honest answer, synthesised from published attack research:

Three of these deserve emphasis.

The emoji attack is embarrassing in its simplicity. Prompt the model to emit an emoji after every token, then delete the emojis. Each deleted emoji was part of the hash input for the following token, so removing them randomises every subsequent seed. It is a context-corruption attack, not a statistical one, and it costs nothing.

Dilution is not really an attack. Copy-paste dilution — where the watermarked text is a small fraction of a longer document — is the single most effective technique in published benchmarks, and it is also the normal way people use text. Quoting, excerpting and mixing are ordinary behaviour. A scheme that fails at 10 % watermarked content fails on ordinary quotation.

Watermark stealing inverts the entire threat model. Jovanović et al. showed that an attacker with only API access can approximately reverse-engineer the watermark rules for under $50, then achieve over 80 % success at both scrubbing and spoofing — making arbitrary text, including defamatory or harmful text, test as having been generated by the provider. The risk is not only that guilty content escapes detection; it is that innocent parties can be framed.

For images, UnMarker (IEEE S&P 2025) is a universal black-box attack operating in the spectral domain that requires no knowledge of the watermarking scheme. Its authors report defeating several state-of-the-art systems; a figure reported for SynthID has been publicly disputed by Google DeepMind, which says its own testing found a significantly lower success rate. Both positions should be cited together — the dispute itself is informative about how little independent verification exists.

Underlying all of this is a theoretical result. Zhang et al., "Watermarks in the Sand" (ICML 2024) argue that strong watermarking is impossible, given two assumptions: the attacker can evaluate output quality, and can perturb outputs in a way that preserves quality. Under those conditions a generic random walk through the space of high-quality outputs drifts out of the watermarked region — with no knowledge of the scheme or the key. Both assumptions are satisfied by simply using a second language model. A published rebuttal argues the empirical instantiation is weaker than the theory implies, so the result is contested rather than settled — but the direction of travel is clear.

The verification problem

Here is the structural issue that shapes the entire field, and the one that matters most for anyone trying to use watermarks rather than build them.

In every deployed scheme, the detector needs the key. And the key that verifies is the key that forges. Give a third party the ability to check whether text carries the mark, and you have given them the ability to stamp the mark on anything they like.

There is no public-key watermarking in production — no construction where verification and forgery are separable the way they are in ordinary digital signatures. This is not corporate reticence; it is a real cryptographic constraint on symmetric schemes.

The consequences as of August 2026:

• Google open-sourced the SynthID-Text method and released the logits processor and an untrained detector class in Hugging Face Transformers. It did not release its production keys or a trained detector for Gemini output. You can watermark and detect your own model's output. Nobody outside Google can detect Google's text.
• Anthropic announced on 11 August 2026 that Claude weaves "an imperceptible watermark directly into the text itself", and attaches C2PA metadata to generated .svg, .png and .jpg files. The mechanism is undisclosed; detection tools are described as planned. The C2PA file metadata is independently verifiable today. The text mark is not.
• OpenAI has shipped no text watermark at all.

So for text, the current state of the art in third-party verification is: ask the provider, and trust the answer. That is a meaningfully different epistemic situation from a cryptographic signature, which anyone can check independently.

What a result actually means

If you take one thing from this article, take this: watermark detection is asymmetric, and the negative case is nearly worthless.

A positive result — a mark found, with the right key, at a sound statistical threshold — is strong evidence. It means content passed through a specific provider's system. Note that even this is weaker than "AI-generated": Anthropic's own documentation makes the point that a detected mark means content "may have been processed by Claude", since models are widely used to proofread and edit human writing.

A negative result means one of: the content was not AI-generated; or it came from a provider that does not watermark; or it came from an open-weight model run locally with the watermarking turned off; or it was too short or too low-entropy to mark; or it was translated, paraphrased, or diluted; or the mark was there and your detector does not hold the right key.

Google's own help text concedes the point directly: SynthID "only detects content watermarked with SynthID. Content from AI tools that don't use it may not be identified."

Coverage, not accuracy, is the binding constraint. Watermarking only ever governs API-served generation from cooperating providers. Anyone running open weights locally omits the sampling-time intervention entirely, and no amount of algorithmic improvement changes that.

Where this leaves verification in practice

Watermarking is a useful signal in a layered system and a poor foundation on its own. A defensible approach reports what is actually checkable and refuses to convert absence into a verdict:

• Cryptographic provenance (C2PA manifests) where present — verifiable by anyone, informative, fragile.
• Watermark support status per provider — being explicit about which marks are checkable by third parties and which are not, rather than implying coverage that does not exist.
• Deterministic content signals — embedded metadata, Unicode anomalies, structural inconsistencies — which are facts about the file, not inferences about its author.
• Explicit gaps — naming what cannot be checked at all, because a tool that silently omits its blind spots is worse than one that names them.

What such a system should never do is convert the absence of a signal into a probability of authorship. That step is where the field's documented harms come from, and no amount of confidence in the model justifies it.

Provenance Lens is an independent project. It is not affiliated with, endorsed by, or sponsored by Anthropic, Adobe, Google, OpenAI, or any other provider whose signals it inspects.