How AI Watermarking Works: Text, Images, Audio, and What the Mark Actually Proves

Since August 2, 2026, providers of generative AI systems serving the EU have been under Article 50(2) of the AI Act, which requires synthetic audio, image, video and text to be “marked in a machine-readable format and detectable as artificially generated or manipulated.” California’s AI Transparency Act became operative the same day. Anthropic now marks the text of every Claude model launched since that date with a version of Google DeepMind’s SynthID-Text; Google has marked Imagen output since 2023 and Gemini text and Veo video since 2024; OpenAI embeds SynthID in supported images alongside C2PA Content Credentials and, per secondary coverage of its July 31 update, in supported audio. We covered what Article 50 requires of ordinary businesses and what Anthropic’s rollout does and does not claim as news. This piece is about mechanism: how the marks go in, how they are read out, what breaks them, and what a positive result proves.

Three different technologies get called “watermarking” and they prove different things. A watermark is a signal embedded in the content itself, at generation time or just after, that a party holding the right key or detector model can test for later. Provenance metadata, of which C2PA Content Credentials is the dominant form, is a signed statement about the content that travels with it or sits in a repository; it is tamper-evident while present, but it is not in the pixels or the tokens. A post-hoc detector is a classifier that needs neither: it looks at arbitrary content and guesses whether a model produced it. The regulation is written around the first two, while the public conversation is mostly about the third, which is the weakest of them by a wide margin.

The threat model has three actors. A remover wants marked content to test negative: crop, recompress, paraphrase, translate, or regenerate through another model. A forger wants unmarked content to test positive for someone else’s mark, so a human’s photograph or a rival’s output gets attributed to a provider. An oracle attacker uses a public detector as a feedback loop, perturbing until the score drops below threshold. Every design decision below trades among those three and the cost of the mark itself.

Text: watermarking the sampler

A language model turns a context into a distribution over its vocabulary (see tokens, logits and sampling) and samples one token from it. Every production text watermark lives in that sampling step. Nothing is appended and no hidden characters are inserted. The mark is a statistical bias in which of the plausible tokens got picked, recoverable only by a detector that knows the key.

The reference construction is Kirchenbauer et al. (ICML 2023, arXiv:2301.10226). Before each token, a keyed pseudorandom function of the preceding $h$ tokens seeds a partition of the vocabulary into a “green” subset $G_t$ of size $\gamma|V|$ and a red remainder. The logits of green tokens are raised by $\delta$ before sampling:

Source: logit'(v) = logit(v) + delta * [v in G_t], G_t = PRF_k(previous h tokens), |G_t| = gamma * |V|

Here $\ell_t(v)$ is the model’s raw logit for token $v$ at position $t$, $\gamma$ is the green fraction of the vocabulary $V$, $\delta$ is the boost, and $\mathrm{PRF}_k$ is the keyed function. Softmax and sampling follow. The detector does not need the model. It re-derives each position’s green list from the key and the preceding tokens, counts how many of the $T$ scorable tokens landed in green, and compares to the $\gamma T$ expected by chance:

Source: z = (|s|_G - gamma*T) / sqrt(T*gamma*(1-gamma))

$|s|_G$ is the observed green count. Under the null hypothesis that the text was written without the key, $z$ is approximately standard normal, so a threshold of 4 corresponds to a one-sided false-positive probability near $3 \times 10^{-5}$ per test. The authors’ repository suggests $\gamma = 0.25$ and $\delta = 2.0$ as defaults and uses $z = 4.0$ as the example threshold.

Two properties of this construction matter for everything that follows. The signal accumulates with length: at the same mild per-token bias a 30-token answer will rarely reach $z = 4$, while a 500-token one will reach it comfortably (at $\gamma = 0.25$ even an all-green sequence needs at least six tokens, and real excess-green rates are far lower). And the boost only matters where the model is uncertain. If the model already puts almost all its probability on one token (the closing brace of a function, the capital of France), adding $\delta$ elsewhere barely moves the distribution, the sampled token is the one an unwatermarked model would have produced, and there is no excess green. That is the mechanical reason every vendor says the same thing about factual answers, short outputs and code: low-entropy text has nowhere to hide a mark without corrupting it.

Distortion-free sampling

Kuditipudi et al. (TMLR 2024, arXiv:2307.15593) remove the bias instead of tuning it. Their schemes, inverse-transform sampling and exponential-minimum sampling, draw each token from the model’s unmodified distribution, using a keyed pseudorandom sequence in place of the sampler’s usual randomness. Averaged over the key, the output distribution is exactly the model’s; the watermark is the correlation between emitted tokens and key sequence, and the detector recovers it by aligning one against the other, which gives the method its tolerance for insertions and deletions. On OPT-1.3B and LLaMA-7B, the paper reports detection at $p \le 0.01$ from 35 tokens even after 40 to 50 percent of tokens were corrupted by random edits. On Alpaca-7B, an instruction-tuned model with lower-entropy answers, only about a quarter of responses (median roughly 100 tokens) were detectable at that level, and the scheme is weaker against automated paraphrase than against random edits. “Distortion-free” is a specific claim, that the marginal distribution over the key’s randomness is unchanged; it says nothing about robustness, and reusing one key across many generations weakens it. SynthID-Text’s “non-distortionary” is a related but distinct definition.

SynthID-Text and what production looks like

The Nature paper on SynthID-Text (Dathathri et al., Nature 634, 818–823, October 2024) is the one piece of peer-reviewed evidence about a text watermark running at scale, and it is the basis of what Google and now Anthropic ship. The core is tournament sampling: the sampler draws several candidate tokens, scores each with keyed pseudorandom g-functions of the recent context, and runs them through a bracket; the winner is emitted, and stacking keys gives layers. The paper defines distortionary and non-distortionary configurations and reports that the non-distortionary version outperforms Gumbel-sampling baselines, especially in low-entropy settings, where the green-list family struggles. Detection needs the tokenized text and the key, not the model.

The production figures explain why this scheme is the one being deployed. In a live experiment across roughly 20 million Gemini responses, the watermarked and unwatermarked arms differed by 0.01 percent in positive-feedback rate; a 3,000-question ELI5 preference study found no significant difference; and integrating the watermark into speculative sampling cost a 0.57 percent latency increase. Google’s developer guide adds the operational parameters: keys is a list of random integers, one per layer; ngram_len trades robustness against detectability, with 5 a good default; the sampling table should have at least $2^{16}$ entries; the processor runs after top-k and top-p with no retraining; and the configuration “should be stored securely and privately, otherwise your watermark may be trivially replicable.” Detection is a Bayesian classifier returning watermarked, not watermarked, or uncertain, and ships in Hugging Face Transformers.

Anthropic’s August 14 post says Claude’s text watermark “is a version of the SynthID-Text approach,” adds no tokens and no hidden characters, has negligible effect on speed, and is weak on short samples, factual passages and code and is removed by a complete rewrite. It applies to models launched on or after August 2, 2026, worldwide, with C2PA signed metadata on the image files Claude produces; earlier models fall under the AI Omnibus transition, which runs to December 2, 2026. As of August 18, Anthropic has only announced that a detection API is coming, so no one outside the company can test a document or measure the false-positive rate.

Paraphrase, translation, and the impossibility result

Every vendor’s documented limitation, thorough rewriting and translation, follows from the mechanism. A paraphrase replaces most of the token choices that carried the bias; a translation replaces all of them. The keyed context window ($h$, or ngram_len) is what lets the detector resynchronize after local edits, and shortening it helps against edits at the cost of making the pseudorandom structure easier to estimate.

Zhang et al. (ICML 2024, arXiv:2311.04378) turn that into a theorem whose assumptions should travel with it. Grant the attacker a quality oracle (a check that a candidate output still answers the prompt well) and a perturbation oracle (a way to modify an output with non-trivial probability of keeping quality, so that repeated perturbations form an efficiently mixing random walk). Under those two assumptions no “strong” watermark exists: the attacker can always walk to an unwatermarked output of comparable quality, even when the detection key is secret. They instantiate the attack against three schemes, Kirchenbauer et al., Kuditipudi et al., and the Unigram scheme of Zhao et al., and report removal “with only minor quality degradation.” The theorem does not say watermarks are useless. The oracles cost compute, the attack is a deliberate act, and a mark that survives copy-paste and light editing still catches the population that was never trying to evade it, which is most of it. What a detector returns is a statistic about whether a sequence was sampled under key $k$; Anthropic’s phrasing is that the mark shows Claude “was likely involved with the content at some point.”

Images: five places to put the mark

Modern image schemes differ mainly in where in the pipeline the mark is inserted, and five placements cover the field.

The transform-domain classics add a keyed pseudorandom spreading sequence, scaled by a payload bit, to mid-frequency DCT or wavelet coefficients, and detect by correlation. They are cheap and interpretable, and they were designed against JPEG and resizing rather than inpainting or regeneration.

Learned post-hoc encoders and decoders are the second family: a neural encoder takes an image and a message and emits a perturbed image, and a decoder reads the message back. Between them during training sits an attack layer simulating JPEG, crops, blur, noise, colour shifts and combinations, so the decoder survives exactly the transforms it was trained on; no robustness claim is meaningful without the list. Google’s SynthID for images is this family: two jointly trained models, launched in beta with Imagen on August 29, 2023, described as surviving filters, colour and brightness changes and lossy compression and “not foolproof against extreme image manipulations.” The October 2025 SynthID-Image paper (arXiv:2510.09263) reports over ten billion images and video frames watermarked. Google’s SynthID Detector portal, announced May 20, 2025, is still a waitlist for journalists and researchers, not a public tool.

Decoder-integrated marks move the watermark into the generator. Stable Signature (Fernandez et al., ICCV 2023, arXiv:2303.15435) fine-tunes the decoder of a latent diffusion model so that every image it produces decodes, under a frozen pre-trained extractor, to a fixed 48-bit signature. The mark is a property of the weights. The paper reports detecting the origin of a generated image cropped to keep 10 percent of its content with over 90 percent accuracy at a false-positive rate below $10^{-6}$. The cost is coupling: changing the signature means fine-tuning again, and for open-weight models a downstream user can swap the decoder and the mark is gone.

Initial-noise marks go in even earlier. Tree-Ring (Wen et al., NeurIPS 2023, arXiv:2305.20030) puts a keyed ring pattern into the Fourier transform of the initial noise vector rather than into the output. The pattern is structured to be invariant to convolution, crops, dilation, flips and rotations. Detection inverts the diffusion process (DDIM inversion) to estimate the noise and tests for the ring. It is zero-bit with negligible FID cost, and detection needs the model and a full inversion, far costlier than a decoder.

Localized extraction changes what the detector outputs. The Watermark Anything Model (Sander et al., ICLR 2025, arXiv:2411.07231) treats detection as segmentation: the extractor labels which regions are watermarked and recovers distinct 32-bit messages from several small regions, each no larger than 10 percent of the image, with under one bit of error, even at 256×256. That is the right shape for the composite case, a real photograph with a generated object pasted in.

The attack surface maps onto those choices. Crop and compression are what the attack layers are trained against. Regeneration, running the image through an image-to-image model at low strength, keeps the semantics and replaces the low-level residual a learned mark lives in; no output-level scheme has a general answer to it. Forgery targets the residual directly: with enough marked samples an attacker can estimate and transplant it, which is why a key-dependent mark resolving through a registry beats one global signal. And a public detector returning a fine-grained score is an oracle, which is why Google documents private, semi-private (API) and public deployment options and has its detector report three states (watermarked, not watermarked, uncertain) rather than a raw score.

Audio and video

Audio follows the image template with the perceptual model swapped: the constraint is the psychoacoustic masking threshold, and the attack set is codecs, resampling, noise, speed and pitch change, mixing and trimming. AudioSeal (San Roman et al., ICML 2024, arXiv:2401.17264) is the open reference. A generator produces an additive residual under a perceptual loss inspired by auditory masking; a jointly trained detector outputs a watermark probability at every time step, localized to the sample (the repository gives 1/16,000 s), with an optional 16-bit message. Localization is what that buys: a cloned-voice sentence spliced into a real recording shows up as a marked interval rather than a diluted clip-level score. The code is MIT-licensed. Google’s product page says SynthID audio in Lyria and NotebookLM output is robust to noise, MP3 compression and speed changes. Voice conversion, resynthesizing speech through another model, is the audio form of regeneration and no better solved.

Video adds temporal consistency, codec resilience, and cost, because running a megapixel encoder on every frame dominates generation time. Meta’s VideoSeal (Fernandez et al., arXiv:2412.09492, December 2024; a preprint, unlike AudioSeal) trains an embedder and extractor jointly with video codecs and geometric transforms inserted between them, then uses temporal watermark propagation so an image model’s residual is carried across frames rather than recomputed for each. The paper reports its largest margin over baselines on combined geometric-plus-compression distortions, the realistic case of a phone re-encoding a cropped clip. Capacity went from 96 bits at release to 256 bits in v1.0 (March 2025), with 256-bit PixelSeal and 1024-bit ChunkySeal variants added in December 2025, all MIT-licensed. For long video, a payload spread over the whole clip dies to a trim, so the practical pattern is a short identifier repeated every few seconds that resolves to a record held elsewhere. Google describes SynthID for Veo as embedded “directly into the pixels of every video frame” and robust to cropping, filters, frame-rate changes and lossy compression.

Three-dimensional content has techniques but no ecosystem. Deep3DMark (Zhu et al., AAAI 2024, arXiv:2307.11628) embeds bits in mesh vertex distributions and generalizes from simplified training meshes to ones 190 times larger; WateRF (Jang et al., CVPR 2024, arXiv:2405.02066) fine-tunes a NeRF so its rendered views carry a binary message. A mesh mark and a rendered-view mark are different objects, conversion between representations is an effective laundering step, and Article 50(2) names audio, image, video and text, not native 3D files.

Provenance: what C2PA adds and what it cannot

A C2PA manifest is a set of signed assertions about an asset: actions (created, edited), the c2pa.ai-disclosure assertion added in version 2.4, ingredients (the assets this one was made from), and the software or model involved. They are gathered into a claim, the claim carries a cryptographic hash of the asset (the hard binding), and the whole is signed with a certificate that validators check against the C2PA trust list, with a trusted timestamp so the manifest stays verifiable after the certificate expires or is revoked. Validation proves that a holder of that signing key made these statements and that neither the statements nor the bound bytes have changed since. It does not prove the statements are true. A provider can sign a manifest saying “camera capture” on a generated image; the manifest is valid and the claim is false.

The limit the specification states about itself is the one that matters for design. Per the Security Considerations document, “C2PA does not offer any protection against the complete removal of C2PA manifests from assets.” A save-as, a screenshot, a metadata-stripping platform or a deliberate attacker all leave an asset with no manifest. The answer inside the standard is the soft binding: a watermark or perceptual fingerprint that identifies the asset and can be used to look its manifest up again. The Soft Binding API defines a registry of fingerprint and watermark algorithms and a resolution service that returns a manifest given a soft-binding value or an uploaded asset. Version 2.4 (April 2026) recommends that c2pa.watermarked.bound actions reference their soft-binding assertion, adds routes for publishing manifest stores to a repository with a receipt, and extends embedding to HTML and structured text. The pairing is what the ecosystem calls a durable credential: full cryptographic assurance while the manifest is intact, and a path back to it when it is not.

The two technologies are therefore complements rather than rivals. A watermark survives transformations but carries a few dozen bits at most and is a statistical claim. A manifest carries as much as you like and is a cryptographic claim, and dies on stripping. The watermark is what lets you find the manifest; the manifest is what tells you what the watermark means. The open tooling for the C2PA half is the Content Authenticity Initiative’s c2pa-rs SDK and c2patool CLI.

The standards around this are less finished than vendor material implies. ISO/IEC 21617-3, JPEG Trust Part 3 on media asset watermarking, reached Committee Draft at the January 2026 JPEG meeting and is at DIS stage as of mid-2026; it is the effort that would let watermarks be signalled interoperably rather than each vendor shipping a private detector, and it is a draft. ISO 22144 on content credentials is likewise at DIS stage. On the W3C side, PROV-O (Recommendation, 2013) models provenance graphs outside the file and Verifiable Credentials 2.0 (Recommendation, May 15, 2025) gives an issuer-holder-verifier model for signed claims about the organisation or device behind a manifest; neither makes pixels or tokens identifiable.

Reading an evaluation

A watermark is a detector, and detectors are reported badly. “95 percent accurate” is meaningless without the base rate and the operating point, for the same reason a 1 percent false-positive rate swamps a rare signal in any screening problem (the same arithmetic as in our benchmarks piece). Ask for true-positive rate at a fixed, low false-positive rate, at the sample sizes you will actually see; Stable Signature’s “90+ percent at FPR below $10^{-6}$” is the right form, and a single AUC is not enough. A service scanning billions of items at a $10^{-4}$ false-positive rate produces hundreds of thousands of false accusations.

Robustness has to be stated against a named transform at a named severity while the detector’s clean-data operating point is held fixed:

Source: R_A(q; alpha) = P( D(A_q(y)) = 1 | y watermarked, FPR = alpha )

$A_q$ is the transform (JPEG at quality $q$, a crop keeping fraction $q$), $D$ is the detector thresholded at false-positive rate $\alpha$, and $y$ is a watermarked output. For multi-bit schemes, report the raw bit-error rate and whole-message recovery after error correction; a 256-bit payload at 1 percent bit error will often fail an exact decode without an ECC layer. Measure perceptual cost against the same output without the mark: feedback and latency deltas for text, PSNR, SSIM and LPIPS for images, a masking-aware metric for audio, since equal-energy perturbations differ wildly in audibility.

What the law asks for and what the vendors ship

Article 50(2) binds providers of generative systems: mark the output machine-readably and make it detectable, with solutions “effective, interoperable, robust and reliable as far as this is technically feasible.” Article 50(4) binds deployers: disclose deep fakes, and disclose AI-generated public-interest text unless it went through human editorial control under someone’s responsibility. The provider duty applied from August 2, 2026; the AI Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) deferred it to December 2, 2026 for generative systems already on the market before August 2 and left the deployer duties undeferred. Breaches carry fines of up to €15 million or 3 percent of worldwide annual turnover, whichever is higher (Article 99(4)). The Commission’s Code of Practice on Transparency of AI-generated Content was published in final form on June 10, 2026, assessed as adequate by the Commission and the AI Board on July 8 and 9, and by the Commission’s July 31 count had about 190 signatories, 82 on the provider section and 152 on the deployer section; final Article 50 Guidelines followed on July 20. The Code is voluntary and the obligations are not.

Against the mechanics above, the word doing the most work in 50(2) is “interoperable.” Every deployed scheme today is detectable only by its own vendor’s detector holding its own keys. That satisfies “machine-readable” and “detectable”; whether a field of mutually unreadable marks is “interoperable” is the question JPEG Trust Part 3 and the C2PA soft-binding registry exist to answer, and neither is finished.

California is more prescriptive. The AI Transparency Act (SB 942 as amended by AB 853, which moved the operative date from January 1 to August 2, 2026) applies to a covered provider: a producer of a publicly accessible generative system with more than 1,000,000 monthly visitors or users. A covered provider must offer a free, publicly accessible AI detection tool for its image, video and audio output, with an API, returning system provenance data and no personal provenance data. It must offer users a manifest disclosure (“easily perceived, understood, or recognized by a natural person”) as an option, and must include a latent disclosure (“present but not manifest”) where technically feasible, conveying the provider’s name, the system’s name and version, the time and date of creation, and a unique identifier, detectable by the provider’s own tool and “consistent with widely accepted industry standards.” From January 1, 2027, large online platforms (more than 2,000,000 unique monthly users) must detect compliant provenance data, surface it, and not knowingly strip it; capture-device duties begin in 2028. The penalty is $5,000 per violation, each day a discrete violation.

Mapped onto what ships: Google’s image, audio and video marks are latent disclosures of the kind California describes, but its Detector portal is a waitlist, not a free public tool with an API. OpenAI’s POST /v1/content_provenance_checks endpoint is the shape the statute asks for; it checks C2PA and SynthID for images and SynthID for audio, returns an outcome and a C2PA validation_state of trusted, valid, invalid or not_present, and states in its own documentation that it “isn’t a general-purpose AI detector” and that a negative result is consistent with stripped metadata, a degraded mark, a legacy model or content made before the signals existed. Video is not covered by that API. (OpenAI joined the C2PA steering committee in May 2024; its May 19, 2026 announcement added SynthID to images and previewed a public Verify tool, and the July 31 update, which we have only through secondary coverage, extended SynthID to supported audio and opened API verification.) Anthropic’s text mark is outside California’s image/video/audio scope, its C2PA signing of files is inside it, and its detector does not yet exist. Whether any of that amounts to compliance with either statute is a legal judgment; the engineering facts are as stated. Meta’s AudioSeal, VideoSeal and Stable Signature are research releases, not product policy.

The layered architecture

No single layer defends against all three attackers, which is why serious deployments, OpenAI’s documented one included, stack them. The diagram below shows the arrangement that falls out of the threat model.

Each layer covers a named failure of the others: the sampling mark survives the paste buffer, the media mark survives the screenshot, the manifest carries the meaning, the repository recovers it after stripping, and the keys decide whether any of it can be trusted.

The sampling-time mark (SynthID-Text or a green-list scheme) costs almost nothing, requires control of the sampler, and defends the copy-paste case. It is lost to paraphrase and translation, and for open-weight models it is lost the moment a downstream user runs their own inference server without the logits processor; anyone shipping weights has to treat that as the expected case. The server-side media mark (a learned encoder for images and audio, a propagated one for video, or a decoder-integrated mark when you own the model) survives metadata stripping, re-encoding and screenshots within its trained transform set, and it is the layer the C2PA soft binding depends on. It must run before the manifest’s hard binding is computed, since otherwise the watermark pass changes the signed bytes, and it creates an internal boundary, the raw unwatermarked artifact, that needs the same access controls as the keys.

The C2PA signing step carries the provenance the watermark cannot: model and version, time, ingredients, the AI-disclosure assertion, and a signature that makes forgery a matter of stealing a certificate rather than estimating a residual. It is lost to stripping, which is why the manifest is also published to a repository keyed by the soft binding, so a verifier holding a stripped asset can extract the watermark and fetch the manifest it was issued with. The verification service is where the oracle problem lives. It should return coarse outcomes (detected, not detected, uncertain) with a separate high-trust interface for forensic use, rate limits on the public one, a result per signal rather than a single boolean, a consistency check between watermark payload and manifest, and a stated limitation that absence is uninformative. OpenAI’s response schema is a reasonable template.

The last layer, key management, decides whether the rest is worth anything, and it is the part most likely to be done badly. Google’s own guide says a leaked SynthID configuration makes the watermark “trivially replicable”: anyone with the keys can mark human text as Claude’s or Gemini’s and can strip a mark by resampling against it. The C2PA signing certificate is a separate secret with a separate failure (forged provenance for arbitrary content), and the two must never be the same key or live in the same place. We wrote up last week how a single provider-wide key, rather than a per-session one, broke the encrypted reasoning blocks at three vendors; the lesson transfers directly. Keys should be per modality and versioned, with the version recoverable by the detector so rotation does not orphan old content; they belong in an HSM or KMS with least-privilege detector access and audited use; and the retention horizon is the life of the published content, which means decades and outlasts the model and possibly the vendor. C2PA’s trust list, timestamping and revocation machinery cover the signing half; the watermark half has no equivalent standard and has to be built.

On cost, text is effectively free, images pay one encoder pass per output unless the mark is in the decoder, and video is the expensive case. Verification should be tiered: manifest check first, lightweight watermark second, expensive localized or inversion-based analysis only for ambiguous, high-stakes items.

Three profiles cover most cases. A provider with its own model should run a sampling-time mark for text, a decoder-integrated or server-side mark for media, C2PA signing with repository publication, a gated verification API with coarse public outcomes, and visible disclosure where Article 50(4) or California’s manifest option calls for it. A platform receiving third-party content should preserve and validate C2PA, run the vendor detectors it can obtain, surface the results (the 2027 California duty), and not try to train one universal “AI detector” in their place. An enterprise generating content internally should embed a random issuance identifier that resolves to a private audit log rather than a user identifier, which gives source tracking for a leak without making every artifact linkable to an employee; California’s separation of system from personal provenance data is the same instinct.

What the mark proves

A positive watermark result proves that a keyed party’s generation process was applied to this content at some point, with a confidence that depends on the size of the sample, the entropy the model had to work with, and the transformations since. With a valid manifest beside it, it also proves that a holder of the signing certificate asserted a specific provenance for a specific asset. That is the whole of the claim.

It does not prove the content is false, or that a named person prompted it, or that a model rather than a human authored the ideas in it: a proofread paragraph carries Claude’s mark and a translated one may not. Nor does a negative prove that content is human, since the absence of a mark is exactly what a stripped manifest, a paraphrased draft, a pre-August-2026 model, an open-weight model without the processor, or a competitor’s model looks like. Once the keys have leaked it proves nothing in either direction.

The design posture that follows is to build the stack so that each layer’s failure is covered by another, to publish detector outcomes as calibrated evidence with the operating point attached, to treat a negative as uninformative in every downstream policy, and to spend the engineering attention on keys and their lifecycle rather than on another point of encoder robustness. The regulation asks for marks that are effective, robust and reliable as far as technically feasible. What is technically feasible is a durable record that a cooperating system generated something, recoverable by the party that holds the keys. That is worth having, but it is not a truth oracle, and systems built as if it were will produce confident wrong answers at scale.

Sources

• Regulation (EU) 2024/1689, Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems — artificialintelligenceact.eu
• Regulation (EU) 2024/1689, Article 99: Penalties — artificialintelligenceact.eu
• Gibson Dunn, EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes (27 May 2026) — gibsondunn.com
• Legalithm, The EU AI Act on 2 August 2026: What Actually Applies (Omnibus entry into force, Regulation (EU) 2026/1744) — legalithm.com
• European Commission, Guidelines on transparency obligations for providers and deployers of AI systems (20 July 2026) — digital-strategy.ec.europa.eu
• European Commission, Code of Practice on Transparency of AI-generated Content — digital-strategy.ec.europa.eu
• European Commission, Strong backing for the Code of Practice on Transparency of AI-generated Content — digital-strategy.ec.europa.eu
• California Business and Professions Code, Division 8, Chapter 25, California AI Transparency Act (SB 942 as amended by AB 853) — leginfo.legislature.ca.gov
• Coalition for Content Provenance and Authenticity, C2PA Technical Specification, Version 2.4 — spec.c2pa.org
• C2PA, Security Considerations — spec.c2pa.org
• C2PA, Soft Binding API, Version 2.4 — spec.c2pa.org
• JPEG Committee, 110th JPEG Meeting press release (JPEG Trust Part 3 reaches Committee Draft) — jpeg.org
• ISO/TC 171/SC 2, ISO 22144, Authenticity of information — Content credentials (draft; status listing) — genorma.com
• Lebo, Sahoo, McGuinness (eds.), PROV-O: The PROV Ontology, W3C Recommendation — w3.org
• Sporny et al. (eds.), Verifiable Credentials Data Model v2.0, W3C Recommendation — w3.org
• Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein, A Watermark for Large Language Models (ICML 2023) — arXiv 2301.10226
• Kirchenbauer et al., lm-watermarking reference implementation — github.com
• Kuditipudi, Thickstun, Hashimoto, Liang, Robust Distortion-free Watermarks for Language Models (TMLR 2024) — arXiv 2307.15593
• Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 634, 818–823 (2024) — nature.com
• Google AI for Developers, SynthID Text — ai.google.dev
• Hugging Face, Introducing SynthID Text — huggingface.co
• Zhang, Edelman, Francati, Venturi, Ateniese, Barak, Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models (ICML 2024) — arXiv 2311.04378
• Fernandez, Couairon, Jégou, Douze, Furon, The Stable Signature: Rooting Watermarks in Latent Diffusion Models (ICCV 2023) — arXiv 2303.15435
• Wen, Kirchenbauer, Geiping, Goldstein, Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust (NeurIPS 2023) — arXiv 2305.20030
• Sander, Fernandez, Durmus, Furon, Douze, Watermark Anything with Localized Messages (ICLR 2025) — arXiv 2411.07231
• San Roman, Fernandez, Défossez, Furon, Tran, Elsahar, Proactive Detection of Voice Cloning with Localized Watermarking (ICML 2024) — arXiv 2401.17264
• Meta FAIR, AudioSeal repository — github.com
• Fernandez, Elsahar, Yalniz, Mourachko, Video Seal: Open and Efficient Video Watermarking — arXiv 2412.09492
• Meta FAIR, VideoSeal repository — github.com
• Zhu, Ye, Luo, Wei, Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking (AAAI 2024) — arXiv 2307.11628
• Jang, Lee, Jang, Kim, Yang, Kim, WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights (CVPR 2024) — arXiv 2405.02066
• Google DeepMind, SynthID — deepmind.google
• Google DeepMind, Identifying AI-generated images with SynthID (29 Aug 2023) — deepmind.google
• Google DeepMind, Watermarking AI-generated text and video with SynthID (14 May 2024) — deepmind.google
• Gowal et al., SynthID-Image: Image watermarking at internet scale — arXiv 2510.09263
• Google, SynthID Detector: a new portal to help identify AI-generated content (20 May 2025) — blog.google
• OpenAI, Content provenance (developer guide and API reference) — developers.openai.com
• Anthropic, How Claude’s text watermarking works (14 Aug 2026) — anthropic.com
• Anthropic Help Center, How Claude marks AI-generated content — support.claude.com
• Content Authenticity Initiative, c2pa-rs (Rust SDK and c2patool CLI) — github.com