Invisible watermarks on AI images: what they can prove

Two different ideas: pixels and metadata

Provenance for images comes in two forms. Content Credentials, described in Content Credentials on shared images, are signed records attached to the file; they are readable by anyone with a C2PA tool, but they vanish when the file is re-encoded. Invisible watermarks are hidden in the pixels themselves; they survive many ordinary edits, but only the company that made them can usually check for them.

How pixel watermarks work

Systems such as Google DeepMind's SynthID adjust generated images in ways that are imperceptible to people but detectable by a matching model, and are designed to survive common changes such as cropping, filters and compression. The detector then reports whether the pattern is present, sometimes with a confidence level. The EU AI Act requires providers of generative systems to mark synthetic output in a machine-readable way, which is pushing more generators towards watermarks, metadata or both.

What a watermark result proves

• Watermark found: strong evidence the image, or the part carrying the pattern, came from that generator.
• No watermark found: almost nothing. The image may come from a generator that does not watermark, may have been heavily edited, or may be a photograph.
• Either way: nothing about who made it, why, or whether what it depicts happened.

That asymmetry matters for anyone sharing images. A positive result is useful; a negative one should never be presented as proof that an image is real. The guide to spotting AI images in your feed covers the checks to combine it with, and checking Content Credentials covers the metadata side.

AI image watermark checks: a worked example

Suppose a publisher takes 10 images from a generator that watermarks its output and puts them through a chain of ordinary changes: a crop to 1200 by 630, a WordPress resize, an optimiser's WebP conversion and a share to two networks, then submits the resulting copies to the maker's checker. The counts are invented for this example. All 10 crops are recognised, 9 of 10 optimised WebP copies are recognised, and 7 of the 10 preview images downloaded from the networks are recognised. Two images that were screenshotted from a phone at 40 percent scale are recognised in 1 case out of 2.

Alongside them, 10 photographs with no generator involved are submitted as a control, and none is reported as watermarked. The example illustrates the shape of the claim: a found watermark survives common edits often enough to be useful, a missing one is uninformative, and the rate of recognition falls with each destructive step. The specific rates belong to the tool and the day, so the log matters more than the memory. In the example the publisher keeps the 10 original exports at a stable address, because those are the copies a checker recognises every time, and a reader who doubts a preview image can be pointed at them.

AI image watermark pitfalls

• Announcing an image as real because a checker found nothing. Most generators do not watermark, and heavy edits remove marks that were there.
• Assuming one maker's checker can see another maker's watermark. Each system reads its own pattern.
• Confusing a visible logo with an invisible watermark. The logo is cropped off in seconds; the pixel pattern is designed to survive that.
• Treating a found watermark as an edit history. It says which generator, and nothing about what happened afterwards.
• Relying on a watermark to satisfy a disclosure duty. Readers cannot see it; the caption still has to say what the image is.
• Testing a downloaded preview and concluding the generator does not watermark. Test the original export first; the preview has been through at least two re-encodes.

What to record

When you check an image against a watermark detector, note which copy you tested, because the answer differs between the original, the optimised file and a downloaded preview. The example rows below use the share test log format from the provenance section, with the detector's answer in the last column.

For publishers using generated images

If your images come from a generator that watermarks them, that is a quiet safety net: platforms and fact checkers who can read the mark will recognise the image even after your CDN recompresses it. It does not replace a caption. Readers cannot see a watermark, and the labelling habits in the provenance section still apply.

Sources

• Google DeepMind: SynthID watermarking
• Regulation (EU) 2024/1689, the AI Act (EUR-Lex)
• C2PA, the Coalition for Content Provenance and Authenticity

Questions

Related reading

1. 01Checking Content Credentials before you share an imageHow to check an image's Content Credentials before you share or publish it: what a C2PA manifest shows, what a missing one means, and what to record.5 min read
2. 02Spotting AI images in your feed: checks that hold upWhich checks for AI-generated images in a social feed actually hold up: platform labels, provenance data, earlier copies and the source, and which tells fail.5 min read
3. 03Content Credentials on shared images: what survives a shareWhat C2PA Content Credentials are, why WordPress image sizes and social uploads often strip them, and how to keep provenance on the images you share.6 min read
4. 04How platforms label AI content, and what triggers the labelHow major platforms decide to label AI-generated or altered media: creator disclosure, provenance metadata, detection, and how publishers avoid mistakes.6 min read