AI watermarking
In plain wordsHiding an invisible signal in AI-generated text, images, audio or video so that software can later tell the content was made by AI — like a banknote's watermark, but undetectable to the eye.
- 1
Generated content
The embedding of a hidden, machine-detectable signal in content produced by a generative model, so that it can later be identified as AI-generated and often traced to the system that made it. For text the signal is usually inserted during samplingdecoding, n.: The method a language model uses to turn its predictions into actual text — for example, always picking the most likely next word, or choosing somewhat at random among the likely ones.: a secret key pseudorandomly favors a subset of tokenstoken, n.: The small chunk of text an AI language model reads and writes — often a word, part of a word or a punctuation mark. AI usage, limits and prices are counted in tokens. at each step (a 'green list') or steers the sampler's randomness, and a detector holding the key tests whether a passage contains improbably many favored tokens. For images, audio and video, signals are added to pixels or waveforms, built into generation (for example, a diffusion model's starting noise) or inserted by a trained encoder and read by a decoder. Good schemes are imperceptible, survive cropping, compression and light editing, and have very low false-positive rates. Paraphrase, translation and regeneration can strip text watermarks, watermarks can be forged, and they cover only cooperating providers, so they complement provenance metadataContent Credentials, prop. n.: A tamper-evident 'nutrition label' attached to a photo, video or document recording where it came from — which camera or AI tool made it and how it was edited — that anyone can inspect. and detectiondeepfake detection, n.: Using software, often itself AI, to tell whether a video, photo or voice recording has been faked or generated by AI rather than captured from reality..
The detector found the watermark in 98% of the generated essays but in few of them after paraphrasing.
- 2
Model ownership
Embedding a verifiable signature in a model's weightsweights, n.: The learned numbers inside a neural network that set how strongly each part influences the next. The finished set of weights is, in effect, the trained model itself. or behavior to prove ownership or detect unauthorized copies of the model itself, rather than marking its outputs; see model fingerprintingmodel fingerprinting, n.: Ways to recognize a particular AI model — to prove that a copy was taken from it, or to tell which model is behind a product — from its internal makeup or its behavior..
Origin
Digital watermarking of media dates to the 1990s. Sahar Abdelnabi and Mario Fritz watermarked language-model text with a learned transformer in 2021; Scott Aaronson described a cryptographic scheme for OpenAI in 2022, and John Kirchenbauer and colleagues' 'A Watermark for Large Language Models' (January 2023) popularized green-list watermarking. Google DeepMind's SynthIDSynthID, prop. n.: Google's system for hiding an invisible watermark in pictures, video, audio and text made by its AI tools, so they can later be recognized as AI-generated. (2023) brought it to large-scale deployment.
Usage note
Law is catching up: the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models. requires providers of generative AI systems to mark outputs in a machine-readable, detectable format (Art. 50(2)), an obligation scheduled to apply from 2 August 2026, and China's rules on labeling AI-generated content took effect in September 2025. See also AI-generated content labelingAI-generated content labeling, n.: Marking text, images, audio or video as made by AI — with a visible notice, hidden data in the file, or both — so that people and platforms can tell synthetic content from real..
Related
- SynthIDSynthID, prop. n.: Google's system for hiding an invisible watermark in pictures, video, audio and text made by its AI tools, so they can later be recognized as AI-generated.
- Content CredentialsContent Credentials, prop. n.: A tamper-evident 'nutrition label' attached to a photo, video or document recording where it came from — which camera or AI tool made it and how it was edited — that anyone can inspect.
- C2PAC2PA, abbr.: An industry group, and the technical standard it publishes, for attaching tamper-evident records of origin and editing history to digital photos, video, audio and documents.
- deepfake detectiondeepfake detection, n.: Using software, often itself AI, to tell whether a video, photo or voice recording has been faked or generated by AI rather than captured from reality.
- AI detectorAI detector, n.: Software that scores how likely it is that an AI, not a person, produced some text or media; for writing, its verdicts are wrong often enough that many schools no longer trust them.
- AI-generated content labelingAI-generated content labeling, n.: Marking text, images, audio or video as made by AI — with a visible notice, hidden data in the file, or both — so that people and platforms can tell synthetic content from real.
- model fingerprintingmodel fingerprinting, n.: Ways to recognize a particular AI model — to prove that a copy was taken from it, or to tell which model is behind a product — from its internal makeup or its behavior.
- synthetic mediasynthetic media, n.: Images, video, audio or text created or substantially altered by AI rather than recorded or written directly by people, whether for art, entertainment, business or deception.
- AI detectorAI detector, n.: Software that scores how likely it is that an AI, not a person, produced some text or media; for writing, its verdicts are wrong often enough that many schools no longer trust them.
Sources
- Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I. & Goldstein, T. (2023). A Watermark for Large Language Models. ICML 2023. arXiv:2301.10226.
- Dathathri, S. et al. (2024). Scalable watermarking for identifying large language model outputs. Nature 634.
Mentioned in
deepfakedeepfake, n.: A fake but realistic video, photo or voice recording made with AI that puts words in a real person's mouth or shows them in a scene that never happened., misusemisuse, n.: People deliberately using AI to cause harm — for scams, harassment, propaganda, hacking or weapons — as opposed to harm from AI making mistakes or pursuing goals of its own., voice cloningvoice cloning, n.: Using AI to copy a specific person's voice from recordings, so a computer can say new things that sound like them — useful for dubbing and accessibility, and abused in scams., AI detectorAI detector, n.: Software that scores how likely it is that an AI, not a person, produced some text or media; for writing, its verdicts are wrong often enough that many schools no longer trust them., AI-generated content labelingAI-generated content labeling, n.: Marking text, images, audio or video as made by AI — with a visible notice, hidden data in the file, or both — so that people and platforms can tell synthetic content from real., Content CredentialsContent Credentials, prop. n.: A tamper-evident 'nutrition label' attached to a photo, video or document recording where it came from — which camera or AI tool made it and how it was edited — that anyone can inspect., content moderationcontent moderation, n.: Checking what people post, or what an AI produces, and removing, limiting or labeling whatever breaks the rules or the law — done by people, by AI, or by both together., deepfake detectiondeepfake detection, n.: Using software, often itself AI, to tell whether a video, photo or voice recording has been faked or generated by AI rather than captured from reality., disinformationdisinformation, n.: Deliberate falsehoods or distortions dressed up as fact, for example from a government or campaign trying to sway an election or sow distrust., G7 Hiroshima AI ProcessG7 Hiroshima AI Process, prop. n.: An effort begun by the G7 group of wealthy democracies in Japan in 2023 that sets voluntary rules for companies building the most advanced AI, which now report publicly on how they follow them., influence operationinfluence operation, n.: An organized, often secret campaign to sway public opinion — fake accounts posting propaganda, for instance — which AI can make cheaper by writing posts, translating them and inventing fake personas., liar's dividendliar's dividend, n.: The advantage dishonest people gain once everyone knows fakes are easy to make: they can wave away real evidence against them by claiming it was made by AI., Pause Giant AI ExperimentsPause Giant AI Experiments, prop. n.: A 2023 open letter, signed by tens of thousands of people including prominent technologists, that asked AI labs to halt the training of any AI more capable than GPT-4 for at least half a year., synthetic mediasynthetic media, n.: Images, video, audio or text created or substantially altered by AI rather than recorded or written directly by people, whether for art, entertainment, business or deception., SynthIDSynthID, prop. n.: Google's system for hiding an invisible watermark in pictures, video, audio and text made by its AI tools, so they can later be recognized as AI-generated., transparency obligationstransparency obligations, n.: EU rules requiring that people be told when they are dealing with AI: chatbots must say they are bots, AI-made content must be marked, and deepfakes must be labeled., AI handsAI hands, n.: The tendency of early AI image generators to draw hands badly — extra or missing fingers, twisted joints — which became a running joke and a quick way to spot fake images., Balenciaga PopeBalenciaga Pope, prop. n.: A 2023 AI-generated photo of Pope Francis in a stylish white puffer coat that fooled many viewers, becoming a landmark example of how convincing fake images had become., C2PAC2PA, abbr.: An industry group, and the technical standard it publishes, for attaching tamper-evident records of origin and editing history to digital photos, video, audio and documents., model fingerprintingmodel fingerprinting, n.: Ways to recognize a particular AI model — to prove that a copy was taken from it, or to tell which model is behind a product — from its internal makeup or its behavior., personhood credentialpersonhood credential, n.: A digital pass that lets you prove online that you are a real human, not an AI or a bot, without having to reveal who you are., steganographysteganography, n.: Hiding a secret message inside something that looks ordinary. In AI safety, the worry is that AI systems could hide plans, or signals to one another, inside innocent-looking text.