Watermarking
In short
Watermarking is a way of hiding a mark inside an image, a sound, a video or a piece of text so a later check can tell an AI system produced it. A person reading or watching does not see the mark.
- Also called
- AI watermark, Digital watermark, LLM watermark
- Topic
- Using AI tools
- Level
- Some background helps
- First described
- Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein at the University of Maryland, posted 24 January 2023 as "A Watermark for Large Language Models", later published at ICML 2023. NIST notes that marks in pictures and broadcasts are much older. This paper is the one that set out the green-list method for language-model text21.
The US standards body NIST describes digital watermarking as embedding information in the content itself, in the pixels or the words, rather than in a separate channel such as a metadata file. A covert watermark is a small change a person is not meant to notice. A detector has to read it, and NIST says that detector will sometimes miss a real mark and sometimes report a mark that is not there1.
For chatbot text, a method set out by John Kirchenbauer and colleagues at the University of Maryland in January 2023 works like this. Before each word, the scheme randomly splits the vocabulary into a "green" list and the rest, then softly promotes the green tokens while the model samples. The sentences still read normally. A statistical test can ask whether green tokens show up more often than chance, without calling the model. They tried it on a multi-billion-parameter OPT model and reported a negligible effect on quality2.
Google's SynthID is built into its products. DeepMind says it embeds an imperceptible mark in AI-generated images, audio, text and video as the content is made. For pictures and video the mark is meant to survive cropping, filters and compression. For text, it adjusts the probability of the next word. Gemini, Search and Chrome can check an upload, and the public SynthID Detector, after a 2025 trial with journalists, checks images, video and audio from Google and partners including OpenAI, Nvidia and Kakao3. A 2024 Nature paper on the text method says it changes only how words are sampled, not how the model is trained, and that a live test of nearly 20 million Gemini replies found no change in text quality4.
A watermark is not a guarantee, and it is not a caption stored beside the file. NIST notes that watermarks can often be removed, and that a covert mark helps only if a detector can still find it1. The EU AI Act's Article 50 requires providers of systems that generate synthetic audio, image, video or text to mark those outputs in a machine-readable format and make them detectable as artificially generated, as far as that is technically feasible. The consolidated text says that article came into force on 2 August 20265.
Example
DeepMind's illustration is the unfinished sentence "My favourite tropical fruits are mango and". SynthID shifts the probability of the next word so a checker can look for a pattern. The finished sentence still reads as ordinary text3.
Why it matters
Newsrooms, schools and platforms want a label that survives a screenshot or a copy-paste. A missing watermark does not prove a person made the file. It only proves that this particular check found no mark.
Questions people ask
Can you see an AI watermark?
Not if it is a covert one. NIST defines a covert watermark as a subtle change that is hard for a person to detect and that a machine has to read1. Google says SynthID marks in images, audio, text and video are imperceptible, and that the image mark is not meant to change picture quality3.
If there is no watermark, was a human the author?
No. A watermark is only present if the system that made the content embedded one. NIST also says watermarks can often be removed, and that detectors have false positives and false negatives1. Absence of a mark is not proof of human authorship.
Is watermarking the same as content credentials?
Not in NIST's definition. A watermark is written into the pixels or the words. Metadata uses a separate channel. NIST treats the two as different techniques that can be used together1.
Does the law require AI watermarks?
In the EU, Article 50 of the AI Act requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable way and make them detectable as AI-made, as far as that is technically feasible. That article came into force on 2 August 2026. It does not name one technology5.
Related terms
Tools that use it
Sources
- NIST AI 100-4 (November 2024), Reducing Risks Posed by Synthetic Content, section 3.1.1
- Kirchenbauer et al. (2023), A Watermark for Large Language Models, arXiv:2301.10226
- Google DeepMind, SynthID product page
- Dathathri et al. (2024), Scalable watermarking for identifying large language model outputs, Nature
- Regulation (EU) 2024/1689, Article 50, consolidated text via artificialintelligenceact.eu (EUR-Lex blocked automated access)