Watermark for AI Content

Programs today can generate images, texts, voices, and videos that look and sound real. So that such creations can later be recognized, manufacturers embed a hidden feature. It is called a watermark because it works similarly to the embedded pattern on a banknote: for the normal observer it is inconspicuous, but visible with the right verification method. In an image, for example, these are tiny, systematic changes to the color values. Anyone looking at the image notices nothing. A matching detection software reads out the pattern and reports: this content comes from a machine. The watermark is therefore not a warning for humans, but a marker for programs.

What helps against forgery and fraud

Machine-generated content is cheap and finished in seconds. That is exactly what makes it attractive for deception. There are cases where criminals recreated the voice of a company CEO and used it to trigger money transfers. Fake photos of politicians or fabricated news images also spread quickly. A reliable marker would make it easier to expose such content before it causes harm.

A second reason is legal in nature. The European Union's AI Act requires that artificially generated or altered content be marked in a machine-readable way. For providers of large text generators and image programs, this is therefore not a voluntary extra, but a requirement. Anyone who ignores it risks fines.

Third, it concerns the models themselves. New AI systems learn from huge amounts of text from the internet. If more and more machine-written texts end up there, the models increasingly learn from themselves. Experts consider this dangerous, because errors can compound in the process. Marked content can be sorted out before training.

How the marking gets into image and text

For images and audio recordings, the limits of human senses are exploited. The program distributes a fixed, randomly appearing pattern across the pixels or across the sound frequencies. The deviations are so small that the eye and ear do not notice them. The verifier knows the pattern and calculates how strongly it is embedded in the image. A well-known method of this kind is SynthID from Google.

With text it is more difficult, because words cannot be altered slightly. Here a trick in word selection comes into play. A language model has several suitable words to choose from at each step. The method divides these words into two groups according to a secret rule and slightly favors one group. The text remains meaningful, but over a hundred words a statistical imbalance emerges. A check afterward counts how often the favored group occurs.

Both are vulnerable. Anyone who significantly shrinks, re-compresses, or crops an image can destroy the pattern. With texts, often thorough rewriting is enough. That is why a watermark counts as an indication, not as proof. It is easily confused with metadata, i.e. the additional information in a file: that stands openly visible alongside and can be deleted with one click. The watermark, by contrast, is embedded in the content itself.

Markings in apps, cameras, and search engines

The visible variant is encountered most often. Social networks like Instagram or TikTok display notices such as "AI-generated" for recognized content. Such labels are based partly on hidden watermarks, partly on user input. Google Image Search now also shows when origin information is available for an image.

A related approach is called C2PA and works with digitally signed proofs of origin. Camera manufacturers like Nikon and Leica are building this into professional cameras so that genuine photos can prove their origin. Watermarks and proofs of origin thus complement each other: one marks the artificial, the other confirms the authentic.

In business news, the topic usually comes up in connection with regulation and liability. When authorities tighten labeling requirements, providers must rebuild their systems, and that costs money. For school and university use, the benefit is limited: there are detection tools for AI texts, but they are often wrong. An honestly written essay can be falsely classified as machine-generated. That is why a watermark alone is never sufficient as proof.