Intermediate · ~5 min read #watermarking #provenance #transparency

AI Watermarking & Content Labeling

Watermarks, C2PA Content Credentials and visible labels

Techniques that make AI-generated or AI-manipulated images, audio, video and text recognisable to people and machines: invisible watermarks embedded in the content, signed provenance metadata, and visible labels shown to the audience.

Definition

Generative model output is getting harder to tell apart from human-made content. AI watermarking and content labeling is the umbrella term for the signals that show a piece of content was generated or manipulated by AI. There are three layers, and none replaces the others:

1. Invisible watermark. The signal is embedded in the content itself; people don't notice it, a detector reads it.

Image, audio, video: a statistical pattern is added to pixels or to the audio signal. Google DeepMind's SynthID is a system that adds such watermarks to images, audio, video and text. According to the SynthID-Image paper (arXiv 2510.09263, October 2025), more than ten billion images and video frames across Google's services have been watermarked this way. The robustness target is common transformations such as resizing, cropping, compression and popular photo filters; deliberate removal attacks are treated as a separate threat model. The paper states plainly that watermarking alone does not solve provenance and has to work alongside tools like C2PA.
Text: text has no "pixels", so the signal goes into token choice. The method by Kirchenbauer et al. (arXiv 2301.10226, 2023) uses a secret key to mark part of the vocabulary as a "green list" at each step and nudges sampling towards it; the detector tests whether the share of green tokens is higher than chance. SynthID- Text (Nature, October 2024) brought the idea to production: it only changes the sampling step, and the paper reports no quality loss in a live experiment covering nearly 20 million Gemini responses. SynthID-Text is open source (Hugging Face Transformers v4.46.0+).

2. Provenance metadata. A cryptographically signed record travels with the content and states who made or edited it, with what tool and when. The common standard is C2PA (Coalition for Content Provenance and Authenticity), and its user-facing form is Content Credentials. The signature shows whether the record was tampered with. C2PA also defines "soft binding", which uses a watermark or fingerprint to re-link content to its record if the metadata is stripped.

3. Visible label. An "AI-generated" caption, an icon, or a notice at the start of a video. It is the only signal people see directly. The European Commission has published a free-to-use set of EU icons for labelling deepfakes and AI-generated text that informs the public.

Legal context. EU AI Act Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Recital 133 lists watermarks, metadata identifications, cryptographic provenance methods, logging and fingerprints as examples. Article 50(4) requires deployers who publish deepfakes to disclose them visibly. The obligations apply from 2 August 2026; systems placed on the market before that date have until 2 December 2026 for Article 50(2) (Article 111(4), added by the Digital Omnibus). Details in the Article 50 guide.

Detection limits. No layer is reliable on its own:

Metadata is easily lost through screenshots, re-encoding or uploading to many social platforms.
Text watermarks are weak on short text; paraphrasing with another model dilutes the signal. A follow-up study by Kirchenbauer et al. (arXiv 2306.04634) shows detection needs longer passages after human or machine rewriting. Google's own documentation says SynthID-Text is less effective on factual responses and that detector confidence drops sharply when text is thoroughly rewritten or translated.
Zhang et al. (arXiv 2311.04378, "Watermarks in the Sand") argue that, under certain assumptions, a determined attacker can remove strong watermarks.
Today a watermark can usually only be read by the detector of the provider that embedded it (the code commits signatories to an interoperability solution by 2 February 2027). "No watermark found" does not mean "a human wrote this".
Non-watermark "AI text detectors" (classifiers that guess from style) don't read a signal, they estimate; they produce false positives and should never be used alone to accuse someone.

So the practical approach is layered: signed metadata + invisible watermark + a visible label where required. The final Code of Practice on Transparency of AI-Generated Content, published by the Commission on 10 June 2026 (Section 1, Measure 1.1), asks for the same:

For audio, images, video and containerised text, at least two machine-readable layers: digitally signed, time-stamped metadata plus an imperceptible watermark.
For free-form text, which can't carry metadata, a single layer (the watermark) is enough. "Very short text" under 200 tokens is exempt from watermarking; longer text must be watermarked even if reliability is lower.
Fingerprinting or logging is an optional extra and is not sufficient on its own.
The code doesn't name C2PA; it asks signatories to adopt "established standards" for metadata marking (Measure 3.4).
Signatories must make their detection tool available to the audience exposed to the content (the public, where relevant); access to free-form text watermark detection may be limited to verified experts because of its lower reliability (Sub-measure 2.1.2).

Analogy

Like banknote security. The watermark you see against the light is inside the paper and hard, though not impossible, to fake (invisible watermark). The serial number matches the central bank's records (signed provenance record). The printed name of the issuing bank is the label anyone can read. A cashier doesn't trust any single feature; they check them together.

Real-world example

An e-commerce company creates product photos with an image-generation feature and also offers the tool to sellers in the EU:

As provider (Article 50(2)): it offers the tool under its own name, so every generated image gets a C2PA manifest ("generator: X, AI-generated"), and the model vendor's invisible watermark stays switched on. It sets up an endpoint for its own detector or the vendor's verification tool.
Test: re-compressing the image as JPEG and cropping to 70% drops the C2PA manifest, but the watermark still reads. A screenshot carries no metadata either. The finding is logged: "metadata alone is not enough".
Deepfake check: as long as a product photo doesn't resemble a real person or event, no Article 50(4) deepfake label is needed; but if marketing generates a face resembling a real celebrity, whoever publishes that image must add a visible label.
Communication: the product page voluntarily shows "Images created with AI", which also helps with consumer complaints.

Code examples

                                            Green-list text watermark: detector logic (simplified)
                                            python
                                        
# A toy version of the Kirchenbauer et al. (2023) idea.
# Real systems use more elaborate key/context schemes.
import hashlib, math

GAMMA = 0.25            # green share of the vocabulary per step
KEY = b"secret-key"     # stays with the provider

def is_green(prev_token: int, token: int) -> bool:
    h = hashlib.sha256(KEY + prev_token.to_bytes(4, "big")
                       + token.to_bytes(4, "big")).digest()
    return h[0] / 255 < GAMMA

def z_score(tokens: list[int]) -> float:
    n = len(tokens) - 1
    green = sum(is_green(a, b) for a, b in zip(tokens, tokens[1:]))
    # in unwatermarked text the expected green share is GAMMA
    return (green - GAMMA * n) / math.sqrt(n * GAMMA * (1 - GAMMA))

# z > ~4 means "watermarked". On short text n is small, so the
# z-score is unreliable; paraphrasing lowers the green share.

                                            Inspecting an image's C2PA record (c2patool)
                                            bash
                                        
# Read the manifest with the open-source c2patool (contentauth/c2patool)
c2patool product-image.jpg

# A re-compressed copy or a screenshot usually has no manifest:
c2patool screenshot.png
# → something like "No claim found": the metadata is gone

When to use

You offer a feature that generates images, audio, video or text to users in the EU (Article 50(2))
You publish synthetic content resembling real people, places or events (Article 50(4) deepfake disclosure)
You want to stop your own content being confused with fakes made in your name (signed provenance)
You publish AI-generated text informing the public, such as news or public notices, without human editorial control

When not to use

As sole 'proof' that a student or employee used AI — a watermark is only readable by the embedding provider's detector, and non-watermark detectors are guessing
Standard editing tools that don't substantially alter the input or its meaning, like spell-check or colour correction, don't need Article 50(2) marking
Replacing machine-readable marking with a visible label — they are separate obligations for separate parties

Common pitfalls

Treating metadata as permanent

A C2PA manifest can be wiped by a screenshot, re-encoding or many platforms' upload pipelines. Back it with an invisible watermark and find the steps in your own publishing pipeline that strip metadata.

Reading 'no watermark' as 'human-written'

A detector only recognises its own scheme. Text from another model, or text that was paraphrased, can look clean. Don't decide on a negative result.

Trusting statistics on short text

A text watermark is a statistical test; a few sentences don't give a reliable signal. For short content like product blurbs or chat replies, rely on metadata and interface notices, not text watermarks.

Not legal advice

This page is informational. For the scope and exceptions of Article 50, go to the AI Act text, the Commission's Article 50 guidelines and a lawyer.