Michael H

Posted on Aug 19 Originally published at agent5.news

How AI Watermarks Work: Gemini, Claude, and Can You Remove Them?

#ai #policy #aipolicy #aiwatermarking

Originally published on agent5.news.

Every time you generate an image in Gemini or ask Claude to draft a memo, there is a good chance an invisible signature is now woven into the output before it reaches you. You cannot see it, hear it, or read it. But a machine can. As AI-generated content floods every corner of the internet, watermarking has moved from an academic curiosity to a regulatory requirement and a genuine infrastructure challenge. Understanding how it works, who controls it, and what it cannot do is quickly becoming a basic form of AI literacy.

What an AI Watermark Actually Is

The word "watermark" conjures a faint logo stamped on a stock photograph. AI watermarks are different in kind. Instead of a visible overlay, they are statistical or cryptographic signals embedded in the very structure of the content at the moment of generation. For images, that means subtle, imperceptible adjustments to pixel values. For audio, it means tiny modifications to waveform patterns. For text, it means nudging the probability that the model selects one word over a near-synonym, creating a detectable pattern spread across hundreds of choices.

The goal in every case is the same: a trained detection system can later find the signal and confirm the content came from a specific AI system, while a human reader, viewer, or listener notices nothing at all.

There are also two distinct families of marking technology. The first is the embedded or statistical watermark, baked into the content itself. The second is provenance metadata, a cryptographically signed record attached to a file but separate from its pixels or words. Both approaches are in active use, and as you will see, they have different strengths and different failure modes.

How Google's SynthID Works

Google DeepMind began developing SynthID in 2023, initially for AI-generated images. The system has since expanded to cover audio, video, and text, making it one of the broadest watermarking deployments in the industry. As of 2025, Google reported that SynthID had been used to watermark over 10 billion pieces of content, including images created with Imagen, audio from Lyria, videos from Veo, and text generated through the Gemini app.

For images and video, SynthID embeds its signal directly into the visual or audio data. The watermark is designed to persist through compression, resizing, cropping, re-encoding, and ordinary post-production work, and it can even survive screenshots and image format conversions. It does not change the appearance or sound of the content.

For text, SynthID uses a more sophisticated approach called tournament sampling. The model runs a multi-round pairwise elimination process among candidate tokens, weighting choices by pseudorandom scores. The result is that the model's word selections carry a hidden statistical fingerprint. Google published this method in the journal Nature in 2024 and later open-sourced the watermarking code through its Responsible Generative AI Toolkit. The technique embeds an imperceptible watermark without impacting the quality, accuracy, creativity, or speed of the text generation process.

Detection works in reverse: SynthID's algorithm scans a piece of content for the statistical pattern it would have left. For images and video, users can now upload files directly to Gemini and ask whether they were created or edited by Google AI. Google also launched a dedicated SynthID Detector portal for journalists and researchers who want to verify content at scale. Crucially, the system can only confirm the presence of Google's own watermark. If a SynthID watermark is not detected, it means the content was not created by Google AI, but it may still have come from another AI system entirely.

How Claude's Watermarking Works

Anthropic announced in August 2026 that supported Claude models would embed imperceptible watermarks in generated text and attach signed provenance metadata to supported files. The move was triggered by the EU AI Act's transparency requirements, but Anthropic chose to apply the marking globally rather than limit it to European users, citing the practical difficulty of scoping it by region.

For text, Claude weaves an imperceptible watermark directly into the words it generates. The watermark travels with the text when it is copied and pasted elsewhere, and it may persist through some light editing. A complete rewrite where every word is replaced will remove it, and the detection signal becomes less reliable with very short passages because there are fewer word choices for the detector to analyze.

For files, Anthropic takes a different approach. Generated PNG, JPG, and SVG files receive cryptographically signed C2PA provenance metadata rather than an in-file statistical mark. This metadata records that the file was created or processed by Claude and can indicate whether it has been tampered with afterward.

The marking applies across Claude's full product surface: the consumer apps, the API, and developer surfaces like Claude Code, as well as versions of Claude accessed through AWS, Google Cloud, and Microsoft Foundry, though signed file metadata may not be available on every platform. Anthropic says the watermarking is designed to have no practical impact on the quality or readability of Claude's output. Notably, Anthropic has not published the specific technical method it uses for text watermarking, and independent observers have noted that without technical documentation it is difficult to assess how robust the marks will be against removal attempts.

The C2PA Standard: A Shared Language for Provenance

Both Anthropic's file metadata and a growing number of other AI tools rely on the C2PA standard, which stands for Coalition for Content Provenance and Authenticity. C2PA is an open technical standard that attaches cryptographically signed provenance metadata to digital media, and it is supported by Adobe, Microsoft, Google, OpenAI, Sony, and many other industry members.

The core data structure is called a C2PA Manifest, or Content Credential. It records who created the content, when, what tools were used, whether AI was involved, and every meaningful edit since capture. Assertions within the manifest are cryptographically signed using public key infrastructure, so any compliant viewer can verify authenticity. Tampering with the file breaks the signature and is immediately detectable.

The C2PA approach has been compared to a nutrition label for digital media: it does not make a value judgment about whether content is good or bad, only whether the provenance record is well-formed and has not been modified. The standard's major limitation is that it lives in the file container, not in the content itself. Strip the metadata, convert the file to a different format, or upload it to a social platform that discards metadata, and the provenance record disappears. The watermark is gone but the content looks identical.

The EU AI Act: Why Regulation Is Driving Deployment

The EU AI Act's transparency obligations under Article 50 took effect on August 2, 2026. They require that AI-generated synthetic images, videos, and audio be marked with watermarks or AI symbols, and that users be informed when they are interacting with AI. Non-compliance can trigger fines of up to 15 million euros or 3 percent of total global annual turnover, whichever is higher.

The regulation is deliberately technology-neutral. It requires machine-readable marking but does not mandate any single technique, which is why the European Commission has indicated that a multi-layered approach combining metadata and embedded watermarks is likely necessary to meet the standard. There are narrow exemptions, for example for AI systems that only perform an assistive or standard-editing function.

Generative AI systems already on the market before August 2, 2026, have until December 2, 2026, to meet the machine-readable marking requirement under Article 50(2). Systems launched on or after that date must comply immediately. The EU's enforcement posture is already reshaping global practices: Anthropic's decision to apply Claude's watermarking worldwide rather than only in Europe is a direct example of what regulators call the "Brussels effect," where one jurisdiction's standards ripple outward across the entire market.

Can You Turn AI Watermarks Off?

This is the question most people want answered, and the honest answer is: it depends on what you mean.

As a user, you generally cannot opt out. For Gemini, watermarks are applied automatically to images and videos generated on AI Plus, Pro, and Ultra plans with no user-facing toggle. For Claude, the marking applies at the model level, meaning it is present regardless of which product interface or API endpoint you use. There is no setting to disable it.

As a developer building on top of these models, the situation is similar. The watermarking happens inside the model itself, before output reaches your application layer.

However, "turning off" and "removing" are not the same thing. A determined actor can degrade or destroy a watermark after the fact through several known methods. For text watermarks, heavy paraphrasing or a complete rewrite will eliminate the statistical signal. For image watermarks, certain adversarial image processing techniques, including regeneration through a second AI model, can strip embedded signals while preserving visual quality. Research published in 2024 demonstrated that strong robustness against ordinary distortions does not preclude removal by a sufficiently capable adversary with access to quality and perturbation testing tools.

The practical takeaway is that watermarks are not locks. They are signals designed to survive accidental or casual modification, not determined adversarial attack. Google's SynthID for images is designed to survive compression, resizing, and format conversion. Claude's text watermark is expected to survive light editing. Neither is designed to be undefeatable by someone who knows what they are doing and has the right tools.

Deliberate removal of an AI watermark is, however, a legally distinct act under the EU AI Act. The regulation prohibits deliberately removing or altering a watermark, so even if the technical act is possible, the legal risk associated with doing it intentionally is real and growing.

What Watermarks Cannot Do

It is tempting to treat watermarking as a solution to the AI-content problem. It is not, and the organizations building these systems say so directly. Google DeepMind has stated that SynthID is not a silver bullet for identifying AI-generated content but is an important building block for developing more reliable identification tools.

Several genuine limitations are worth knowing. First, the absence of a watermark does not prove content is human-made. It could mean the content was created by an AI system that does not watermark, was created before watermarking was deployed, or had its watermark successfully removed. Second, watermarks are proprietary by design. SynthID can only detect Google's own mark. Claude's detector will only find Anthropic's mark. There is no universal cross-platform reader today, though interoperability frameworks are under development. Third, short content is harder to mark reliably because the statistical signal depends on accumulating enough word or pixel choices. Fourth, academic research has found that metadata-based provenance and machine-learning watermarking each have weaknesses the other does not: metadata is publicly detectable but fragile to accidental stripping, while embedded statistical marks are more robust to ordinary transformations but harder to verify without access to the original key.

There is also a fairness concern worth watching. Research has documented that statistical AI-detection systems, the predecessor to watermarking, show systematic bias against non-native English speakers. Watermarking schemes are theoretically less vulnerable to this problem because they depend on a keyed signal rather than writing style, but the field is still young and real-world performance across diverse languages and writing contexts deserves scrutiny.

The Agent5 Angle: Thinking in Probabilities About What Comes Next

Getting smart about AI means treating watermarking not as a solved problem but as an evolving system with known failure modes, regulatory tailwinds, and significant open questions. Here is a useful framework for thinking about what is likely to happen.

The probability that watermarking becomes a baseline expectation across major AI platforms is high and rising. The EU AI Act is already law, Anthropic is deploying globally, and Google has been building SynthID infrastructure for years. The trend line is clear.

The probability that watermarks alone will solve the problem of AI-content authenticity is low. Every technical standard creates a corresponding incentive to circumvent it, and the research literature on watermark removal is substantial and active. The more credible prediction is that watermarks will become one layer in a multi-signal system, combined with platform-level disclosure, human content policies, and forensic tools that no single actor controls.

The probability that interoperability will improve is moderate, with regulators providing the pressure and industry coalitions like C2PA providing the mechanism. The EU has already set a February 2027 deadline for watermark-detection interoperability requirements, which means the ecosystem is not static.

The most intellectually honest position is this: AI watermarks matter, they are being deployed at scale right now, and they are a meaningful step toward transparency. They are also imperfect, circumventable by motivated actors, and not yet standardized across the industry. The people building this infrastructure say the same thing, and that candor is itself a useful signal about where the technology actually stands.

DEV Community