How AI Watermarks Work and How to Spot Them

Anthropic recently announced that its Claude models will soon begin marking text output with invisible AI watermarks, while Google revealed that its own visible Gemini watermark on generated images will become optional. These two contradictory moves highlight just how varied AI watermarking methods have become across the industry. Here’s a breakdown of how these systems work and how you can detect them, even when they’re designed to stay invisible.

How AI watermarking works

The exact method for embedding AI watermarks depends on the type of media involved, but the underlying principle stays consistent: generated content carries hidden data, undetectable to the human eye or ear, that identifies it as AI-produced. Specialised detection tools can then confirm whether something was AI-generated, without relying on guesswork or unreliable AI detectors.

For images, pixel values can be slightly adjusted to embed a digital signature without visibly altering the picture. Google’s SynthID, for instance, distributes an invisible signature across generated images, meaning even a cropped version retains detectable traces. This differs from the visible grey Gemini symbol, which remains separate from the invisible watermark underneath.

For audio, watermarks can be embedded even more easily, using signature sounds placed outside the range of human hearing, typically below 20Hz or above 20,000Hz. Video generally combines both image and audio watermarking methods, though inconsistencies can arise if AI-generated audio is paired with genuine video footage.

For text, every word an AI model generates carries a probability score. AI watermarks in text work by subtly inflating the likelihood that certain word combinations appear, without changing the sentence’s meaning. This method tends to work more reliably on longer text passages, since more words provide greater opportunity to detect statistically unlikely word choices.

Metadata frameworks like C2PA aren’t technically watermarks, but serve a similar purpose by helping verify a piece of media’s origin, including whether AI tools were involved in its creation. While SynthID originated within Google’s DeepMind, the protocol has since been open-sourced and adopted by other companies, including OpenAI. However, implementation remains inconsistent across the industry, meaning the presence of a watermark can confirm AI involvement, but its absence can’t prove the opposite.

How to detect AI watermarks

Despite the relative popularity of SynthID and C2PA, reliably detecting watermarks or metadata remains difficult. OpenAI offers a standalone tool for checking SynthID or C2PA presence, while Google provides verification access through Gemini or, with the right prompting, directly through its own search tools.

These tools carry notable limitations, though. OpenAI’s detector appears to only recognise media generated by OpenAI itself, failing to detect SynthID watermarks from Gemini-generated images during testing. Meanwhile, Google’s dedicated SynthID Detector portal remains invite-only, reserved specifically for journalists and verification professionals. Some detection functions remain accessible through Gemini, though results can vary depending on how questions are phrased.

Even with careful checking, other watermark types requiring different detection tools may still go unnoticed, particularly when there’s no clear indication of which platform generated the content. Text-based watermarks used by tools like Claude and Gemini remain especially difficult to verify, since no public detection tool currently exists for either.

Can AI watermarking be circumvented?

With sufficient effort, virtually any watermark can be removed, though SynthID proves fairly resistant to typical modifications like cropping or filtering. Removing metadata like C2PA, however, is considerably easier, often as simple as taking a screenshot, which generates an entirely new file and erases the original metadata trail.

Text watermarks remain among the easiest to circumvent. Since they rely on subtly shifting word probabilities, running text through another AI tool for rephrasing, or manually rewriting content, can effectively remove the watermark altogether.

Does a watermark always confirm AI generation?

It’s worth remembering that watermarks can also appear on authentic media. If someone uploads a genuine photo to a tool like Gemini for minor edits, the resulting image will still carry a SynthID watermark, despite the original content being real. Similarly, an AI-generated element could be inserted into an otherwise authentic image using traditional editing techniques, with watermark presence varying case by case.

Ultimately, neither the presence nor absence of an AI watermark can definitively prove whether content is authentic or artificially generated. These tools simply offer clues about a piece of media’s origin, leaving final verification up to the viewer.

Do you think AI companies should be required to use consistent, publicly detectable watermarking standards across the industry?