Every major AI lab now hides an invisible signature inside what its models generate, and the European Union now requires it. Google's SynthID, the most widely deployed system, marks images, video, audio, and text in ways humans cannot see but machines can detect. Yet the same technology that survives cropping, compression, and screenshots fails against the simplest attack of all: running the output through another AI model. Watermarking works, and watermarking does not work, and both statements are true at the same time.
The direct answer is this: AI watermarking embeds a machine-readable signal during generation, not after it, and under the EU AI Act's Article 50 transparency obligations, which took effect on August 2, 2026, providers of generative AI systems must mark synthetic outputs so they can be detected as AI-generated. But detection only proves a watermark is present. It can never prove a file is human made, because most AI-generated content carries no detectable mark at all.
How the mark gets in
Watermarking is not metadata. Metadata is a label stuck on a file, and it falls off the moment the file is resized, re-saved, or screenshotted. A watermark is woven into the content itself, during generation, so it survives the ordinary handling that strips metadata away. The method depends on the medium, and SynthID is the clearest example because Google DeepMind built one system for all four.
| Medium | Where the mark lives | How detection works |
|---|---|---|
| Images | Subtle adjustments to pixel values, made during generation | Statistical tests look for the pixel pattern, even after edits |
| Video | The image mark applied across frames, plus the audio mark | Frame-by-frame pattern analysis over the sequence |
| Audio | Small modifications to the audio signal itself | Spectral analysis finds the embedded pattern in playback |
| Text | Tiny, patterned shifts in the probabilities of word choices during sampling | A Bayesian detector scores how closely the text matches the pattern |
Text watermarking deserves a closer look, because it is the most counterintuitive. When a model picks its next word, it does not simply take the most likely one. It samples from a distribution of plausible words. SynthID Text nudges those probabilities in a secret, keyed pattern: at each step, some words become slightly more likely and others slightly less, in a way that is statistically invisible to a reader but detectable to anyone holding the key. Google has embedded SynthID Text in Gemini's consumer products since 2024 and published an evaluation on nearly twenty million live responses. Anthropic followed the same approach: every Claude model released after August 2, 2026 embeds a watermark based on SynthID Text, enabled by default, with no option for users to disable it, and a public detection API promised to follow.
What the law actually requires
The EU AI Act's Article 50 does not say the word watermark. It requires providers of generative AI systems to mark synthetic outputs in a machine-readable format and ensure they can be detected as artificially generated or manipulated. Watermarking is one acceptable way to meet that bar, and the European Commission's AI Office Code of Practice on Transparency of AI-Generated Content treats it as such. Around 190 organisations, including OpenAI, Anthropic, Meta, Google, and Microsoft, signed that voluntary code.
The timeline matters, because it explains why watermarking suddenly went from research project to shipping feature in 2026. Article 50's transparency obligations took effect on August 2, 2026. Systems already on the market before that date received a transition period, with the machine-readable marking obligation applying from December 2, 2026. Systems placed on the market from August 2 onward had to comply from the start. That deadline is why Anthropic's August watermark announcement reads like a compliance notice: it is one.
OpenAI's move fits the same timeline from a different direction. In May 2026, OpenAI announced it would embed SynthID in all images generated by ChatGPT, joining Nvidia and other adopters of Google's system. The notable part is not that a rival adopted a rival's technology. It is that the industry is converging on one watermark standard instead of fragmenting into incompatible ones, which is the only way a detector can ever be useful across providers.
What survives, and what breaks it
Hands-on testing, including Ars Technica's examination of SynthID, gives a consistent picture. The signal itself is durable inside the generation pipeline. Ordinary edits barely dent it: cropping, added filters, color changes, resizing, lossy compression, and even a screenshot all leave the mark detectable. That durability is the whole point, and it is why watermarking beats metadata for provenance.
| Treatment | Effect on the watermark | Why |
|---|---|---|
| Cropping, resizing, compression, filters, color changes | Survives | The pattern lives in the content values, not the file container |
| Screenshot or re-save | Survives for SynthID; C2PA metadata is lost | Re-encoding drops the manifest but keeps the pixel pattern |
| Running the image through another AI model | Breaks | The pixels are rebuilt from scratch, so the old pattern is gone |
| Extreme manipulation or adversarial removal | Breaks, by DeepMind's own admission | DeepMind states SynthID is not foolproof against extreme manipulation |
| Heavy paraphrasing or translation (text) | Degrades sharply | Rewriting destroys the statistical word-choice pattern |
The re-generation attack is the crack that matters most, because it is also the most ordinary thing a user can do. Ask one model to "improve" another model's image, and the output is a new image with no watermark, made by a tool that any user can access. The same applies to text: paraphrase a watermarked passage thoroughly enough, and the statistical signature dissolves. Watermarking was designed to survive editing, not to survive being remade, and the distinction decides what it can honestly promise.
The detector's catch
Google opened its SynthID Detector to the public in 2026, and hands-on tests quickly found the catch. The tool detects watermarks from Google and its partners, including Nvidia, OpenAI, and Kakao, and nothing else. Upload a video of a puppy nuzzling a baby, get "no AI watermarks detected," and you have learned exactly one thing: no partner watermark was found. The video could still be AI-generated by any model outside that partnership, or by a model whose output was re-generated, or by a model that never watermarked at all.
That limitation is not a bug in the detector. It is the structure of the whole system. A watermark detector can only ever return two answers, "mark found" or "mark not found," and only the first is informative. The second is routinely misread as "real," by users and by news coverage alike. The honest reading, and the one every detection tool should print on its results page, is that a clean result means "unknown," not "human."
Scale does not fix this either. Google reported at the October 7, 2026 SynthID Detector launch that SynthID had labeled over 180 billion images and videos, plus 240,000 years of audio. That is meaningful coverage of the biggest generation stacks, and it is nowhere near total coverage of AI-generated content. Nobody publishes a firm estimate of what share of everyday AI content carries a detectable mark, or how detectors behave on lightly retouched human photos. Until that denominator exists, "we watermarked 180 billion items" is a numerator in search of a meaning.
What to use instead, and what comes next
Watermarking is one layer, and the honest systems treat it that way. Content Credentials (C2PA) attach a signed history to a file, showing where it came from and what was done to it, but the manifest drops on re-encode, which is exactly where SynthID survives. Fingerprinting matches content against a database of known items, which works for copies but not for novel generations. Human judgment, provenance from a trusted source, and corroboration across outlets remain the backstop for anything that matters. No single method solves provenance, and any vendor claiming otherwise is selling something else.
The next test is the December 2, 2026 deadline for pre-existing systems, when the transition period ends and the marking obligation applies across the board in the EU. Watch three things: whether detection APIs actually open to the public as promised, whether independent researchers can verify detection rates on real-world content rather than lab samples, and whether any regulator enforces the obligation against a provider whose watermark is trivially removable. The answers will decide whether watermarking becomes infrastructure, like HTTPS, or remains a press-release feature.
For readers, the practical rule is simple. A detected watermark is strong evidence that content is AI-generated, from a specific provider's system. An undetected watermark is no evidence at all. And for publishers, the rule is simpler still: if you generate it, mark it, and say so in plain language. The technology for honest labeling exists. What is missing is not a better watermark. It is the habit of telling the truth about where content came from, with or without one.
This explainer is distinct from our earlier news coverage of OpenAI's EU-only ChatGPT text watermarking, which reported one company's announcement. What you just read is the underlying technology, the law behind it, and the test results that show where it breaks.
By ByteHerald Staff. Google DeepMind's SynthID, embedded in Gemini consumer products since 2024 with an evaluation on nearly twenty million live responses, marks images in pixel values, video across frames, audio in the signal, and text through patterned token-probability shifts. The EU AI Act's Article 50 transparency obligations took effect on August 2, 2026, with the marking obligation for pre-existing systems applying from December 2, 2026, and around 190 organisations signed the AI Office Code of Practice on Transparency of AI-Generated Content in late July 2026. Anthropic announced in August 2026 that every Claude model released after August 2 embeds a SynthID-Text-based watermark by default with no user opt-out, and OpenAI announced in May 2026 that it would embed SynthID in all ChatGPT-generated images. Google's public SynthID Detector, tested by PCWorld in October 2026, detects watermarks only from Google and partners including Nvidia, OpenAI, and Kakao, so a negative result does not establish that content is human made. Ars Technica's October 2026 hands-on testing found SynthID survives cropping, compression, resizing, and screenshots but breaks when an image is rebuilt through another AI model, and DeepMind states the system is not foolproof against extreme manipulation.
Comments
Post a Comment