An AI watermark is a signal hidden inside a piece of AI-generated content — text, an image, audio, or video — that lets software confirm the content came from a particular AI system, even though a person reading or looking at it would never notice anything unusual. Unlike a visible label stamped in the corner of a photo, the watermark lives inside the content itself: in the exact sequence of words a chatbot chooses, or in tiny, imperceptible adjustments to pixel values. That is what lets it survive being copied, cropped, or reposted in ways a visible tag or a file’s metadata usually cannot. The underlying idea, known as digital watermarking, predates AI by decades — it was originally used to protect copyrighted photos and audio — but generative AI models adapted it to mark their own output automatically, at the moment of creation.
How text watermarking works
When a large language model generates a reply, it doesn’t just pick one “correct” next word. At each step, it computes a probability score for thousands of possible next tokens and samples from that distribution. A text watermark works by quietly reweighting those scores: using a hidden, pseudorandom pattern seeded by the words generated so far, it nudges a particular subset of plausible next tokens to be slightly more likely — without ever forcing a word choice that would sound unnatural. Do this across a few hundred words, and a statistical fingerprint builds up: nothing a human would notice while reading, but a pattern a detector that knows the seed can recognize with high confidence. Google DeepMind’s SynthID and Anthropic’s Claude both mark text with variations on this approach; Anthropic began embedding an invisible watermark in every Claude response it generates, across its chat app, developer API, and coding tools.
How image and video watermarking works
Image and video watermarks work on a similar idea but at the level of pixels rather than words. During generation, the system adds a pattern of imperceptible noise to the image’s underlying representation — small enough that no human eye can perceive a difference, but structured enough that a detector model can recognize it later. Because the signal is spread across the whole image rather than confined to one visible corner, it is built to survive common edits: cropping, resizing, filters, and the recompression that happens when an image is re-saved or uploaded to social media.
Watermarks vs. Content Credentials
Watermarking is often confused with Content Credentials, the C2PA standard that attaches a tamper-evident record of who created a file and how it was edited. The two are complementary, not the same thing. Content Credentials are metadata that travels alongside a file and can carry rich detail — creator, tool used, edit history — but metadata is fragile: it is routinely stripped by screenshots, social platforms, and format conversions. A watermark carries far less information, typically just “an AI model produced this,” but because it’s embedded in the content itself, it survives many of the transformations that strip metadata away. That’s why platforms increasingly use both together rather than choosing one.
Why it matters
Watermarking gives platforms, researchers, teachers, and regulators a low-friction way to check whether a piece of content passed through an AI system, without relying on a creator to disclose it honestly. That matters for catching AI-assisted cheating, flagging synthetic media used in scams or disinformation, and — increasingly — meeting legal requirements. Some jurisdictions now mandate it directly: certain AI image, audio, and video systems with large user bases must embed machine-readable provenance data in their output. It’s also part of why AI companies extend the practice globally rather than only where it’s legally required — a single, consistent watermarking policy is simpler to build and to defend than a patchwork of regional exceptions.
Can a watermark be removed?
Yes — and that’s the technology’s biggest limitation. Text watermarks weaken or disappear if the output is heavily edited, paraphrased, translated, or blended with other writing, and short passages may not contain enough tokens for a reliable statistical signal. Image watermarks can degrade under aggressive re-editing or dedicated removal tools, though they tend to survive routine sharing and compression. None of this makes watermarking pointless — it raises the cost and lowers the reliability of passing AI content off as entirely human-made — but it’s a probabilistic signal, not a cryptographic guarantee. A watermark also only proves that a specific model generated or touched the text; it says nothing about whether a person also wrote, edited, or submitted parts of it as their own. Treat it as one clue among several, not final proof.
In the news
This explainer was prompted by Anthropic’s rollout of invisible text watermarks across every Claude product worldwide — one of the clearest recent examples of a major AI lab building this kind of detection directly into its models rather than leaving disclosure up to users.