In plain words
As AI-made photos, voices and articles get harder to tell from real ones, people want a way to check. A watermark is a hidden mark added when the content is created. You cannot see or hear it, but a detector can find it.
For images and audio, the mark is a tiny pattern spread across pixels or sound that survives cropping or compression. For text it is cleverer: while writing, the AI is nudged to pick words from a secret list a little more often than chance. A person cannot notice, but a detector that knows the list can count them.
A second approach, content credentials, attaches a signed label to the file recording how it was made, like a receipt. Watermarks and labels are useful, but neither is foolproof: heavy editing, rewording or screenshots can weaken or strip them.
Everyday example
The security thread in a banknote
A ₹500 note has a security thread and a watermark you only see against the light. Most people never check, but a bank's machine does, in seconds. AI watermarks work the same way: invisible in normal use, easy for the right detector to check, and designed to be hard to copy or remove.
Where the example breaks: A banknote's thread is physical and very hard to fake. An AI watermark is just a pattern in data, so rewriting text or reshooting an image can wash it out, and content from AI tools that never added one carries no mark at all.
How it actually works
There are three main techniques, often used together.
Text: tilting word choices
A language model picks each next token from a list of likely options. A 2023 method splits the vocabulary into secret "green" and "red" lists before each word, then slightly favours green. Human text lands on green only at the chance rate (half, in a common setting); watermarked text far more often. A statistical test can tell the difference in a short passage, without access to the model.
Google's SynthID
Google DeepMind's SynthID marks images, video, audio and text from Google's models. Its text method, published in Nature in October 2024 and released openly, was tested on nearly 20 million Gemini replies without hurting quality.
Content credentials (C2PA)
The C2PA standard, started in February 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic, attaches cryptographically signed information to a file saying which tool made or edited it. It is precise, but the label can be stripped, for example by taking a screenshot.
How they get removed
Paraphrasing text, especially with another AI, dilutes text watermarks. Researchers disagree on how much: one 2023 study said repeated paraphrasing defeats detectors, another found watermarks often stay detectable in longer passages. Images survive light edits better than heavy ones.
Laws asking for it
The EU AI Act requires AI-generated content to be marked in a machine-readable way from 2 August 2026 (2 December 2026 for systems already on sale). India's IT Rules, amended from 20 February 2026, require labels plus permanent metadata on AI-generated content shared on platforms.
- Text watermark paper
- "A Watermark for Large Language Models", Kirchenbauer and colleagues, January 2023
- Why detectors alone fall short
- OpenAI withdrew its AI-text classifier in July 2023 for low accuracy: it caught 26% of AI text and wrongly flagged 9% of human text
- Covers
- Text, images, audio and video, with different methods for each
- Parent topic
- Deepfakes, which watermarks are meant to help identify
Can AI watermarks be relied on?
One view
Yes, as one useful signal
Studies show text watermarks often survive human and machine paraphrasing in longer passages, and image marks survive common edits. At scale, they make honest labelling cheap and automatic.
The other view
No, too easy to remove
Determined people can paraphrase, edit or use a tool with no watermark at all. Researchers showed in 2023 that repeated paraphrasing can defeat many detectors, so a missing watermark proves nothing.
Most likely: Both are partly right. Watermarks reliably flag content from cooperating tools when it is lightly edited, but cannot catch everything. Most experts see them as one layer alongside content credentials, platform labels and media literacy.
Questions people ask
Can you tell if text was written by AI?
Not reliably by reading it, and general AI detectors make many mistakes, including flagging human writers. A watermark can be checked only if the AI tool added one and the checker has the right detector. No watermark found does not prove a human wrote it.
What is SynthID?
Google DeepMind's watermarking system for content made by Google's AI models, covering images, video, audio and text. Google offers a detector, and released the text version openly in October 2024 for others to use.
What are content credentials?
Signed information attached to a photo, video or document recording where it came from and how it was edited, including whether AI was used. They follow the C2PA standard. Some cameras, editing apps and AI tools add them.
Do watermarks stop deepfakes?
No. They help label content from tools that add them. A deepfake made with a tool that skips watermarking, or edited heavily, may carry no mark. Watermarks support checking; they do not prevent misuse.