AI watermarking and content provenance: detecting AI-generated content

AI watermarking groups the set of techniques that allow marking AI-generated content (text, image, audio, video) and verifying its origin afterwards with some degree of confidence. The discipline has moved from niche academic topic to operational requirement in 2026, driven by three converging forces: the maturity of generative models that produce content nearly indistinguishable from human work, the rise of deepfake-based fraud against companies and electoral processes, and the application of Article 50 of the EU AI Act, which introduces explicit marking and information obligations for providers and deployers of generative AI systems. For any organization that produces or consumes digital content in critical workflows, understanding what can be marked, with what guarantees and where the real limits lie has become a governance issue, not just a technical one.

Key points

• AI watermarking marks AI-generated content with recoverable signals that allow verification of origin and tampering.
• The leading standards in 2026 are C2PA (cryptographic signing of metadata) and Google SynthID (imperceptible perturbations in pixels, audio and text tokens).
• EU AI Act Article 50 requires marking generative AI output and informing users when they interact with chatbots or see synthetic content.
• Removal techniques are trivial in many cases (recompression, paraphrasing, cropping), so watermarking does not solve the trust problem on its own.
• A reasonable strategy combines preventive marking, forensic AI detection, chain of custody and clear internal policies on synthetic content usage.

Why AI watermarking matters in 2026

Three forces have moved watermarking from academic curiosity to operational obligation.

The first is deepfake-based fraud. Wire transfers authorized through fake video calls, voice impersonations of executives and disinformation campaigns with synthetic images and audio have gone from striking exceptions to recurring patterns documented by incident response teams. When an attacker can produce a believable video of a CFO ordering an operation, structural defense relies on verifying content authenticity at source, not only the identity of whoever sends it.

The second is information and electoral integrity. In 2024 and 2025, election cycles documented incidents of synthetic audio and deepfakes that circulated for hours or days before being debunked. Regulatory concern has pushed industry coalitions and governments to accelerate the adoption of content credentials and mandatory marking in sensitive contexts.

The third is brand authenticity and intellectual property. Companies with strong visual identity, news agencies and ecommerce platforms need to distinguish their own signed content from images generated by third parties that imitate their aesthetic.

To this we add regulatory fit. The EU AI Act, in Article 50, sets specific obligations: providers of generative AI systems must ensure that output is markable as synthetic, and deployers showing AI-generated content to users must inform them of its nature.

Main standards in 2026

The ecosystem is converging around two complementary approaches.

C2PA (Coalition for Content Provenance and Authenticity) is an open initiative led initially by Adobe, Microsoft, BBC, Intel and others, joined by OpenAI, Google, Meta and a growing number of camera manufacturers and platforms. Its model relies on cryptographically signed metadata that travels with the file: each actor in the chain (the capturing camera, the editing software, the publishing platform) adds an attestation signed with its key, forming a verifiable history. C2PA does not detect tampering on its own: it detects absence or breakage of the credential chain.

Content Credentials is the commercial brand under which Adobe and partners deploy C2PA in end user tools (Photoshop, Firefly, Leica and Sony cameras with compatible firmware, platforms such as LinkedIn).

Google SynthID is Google's own marking system, introduced in 2023 for images generated with Imagen and later extended to audio (Lyria), video and text generated by Gemini models. SynthID introduces imperceptible perturbations in pixels, audio spectrum or statistical distribution of tokens, recoverable by a trained detector. Unlike C2PA, it does not require metadata: the watermark lives in the signal itself and survives part of the usual transformations.

IPTC Photo Metadata is the historical industry standard for descriptive metadata in press images. It has incorporated specific fields to indicate synthetic or AI-assisted origin, complementary to C2PA in editorial workflows.

There are also experiments by OpenAI, Anthropic and Meta with statistical watermarking for text, without mass deployment yet in public production.

Technical approaches by content type

Each modality has different physics and tolerates different techniques.

Statistical watermarks in LLM text

The most studied technique slightly modifies the probability distribution over the vocabulary before sampling. Tokens are pseudo-randomly split into "green" and "red" sets based on a seed derived from context, and the model is biased to prefer green tokens. A detector with the same seed counts the proportion of green tokens in a suspect text and, if it exceeds the expected baseline by chance, declares synthetic origin with a given p-value. It works reasonably on long, clean text, but degrades with heavy paraphrasing, translation and significant human editing.

Pixel-level perturbation in images

SynthID and equivalent techniques embed in the image a low amplitude pattern spread across the frequency spectrum. It is not visible to the eye and survives moderate JPEG recompression, resizing and partial cropping. A trained detector recovers it with statistical probability, not deterministic certainty, which translates to responses with confidence levels.

Spectral audio watermarks

In synthetic audio, the techniques modulate inaudible spectrum components or introduce imperceptible psychoacoustic patterns. SynthID Audio, AudioSeal by Meta and other proposals use variants of this idea. Robustness against re-encoding (transcoding to low bitrate MP3, analog conversion and recapture) is limited and depends on the specific design.

Cryptographic metadata signing

C2PA does not touch the content signal. It computes a hash of the image, audio or video, combines it with descriptive metadata (author, tool, date, transformations applied) and signs the resulting block with an X.509 certificate issued by a trusted authority. The chain is embedded in the file (XMP for images, dedicated containers for video and audio). Any later modification breaks the signature unless the editor adds its own attestation, preserving traceability.

Robustness against removal attacks

No current watermarking is robust against a motivated and technically competent adversary.

In text, paraphrasing with another model, sentence reordering or light human editing reduce the statistical signal to undetectable levels. Translating the text to another language and back is usually enough.

In images, recompression to low quality JPEG, aggressive resizing, significant cropping and regeneration with image-to-image models degrade the watermark. An image passed through a second generative model usually loses the marks of the first.

In audio and video, recapture (playing the content and recording it with a microphone or camera), format transcoding and creative processing remove or severely degrade watermarks. Perceptual techniques have better robustness than purely steganographic ones, but the ceiling remains low against a determined attacker.

The cryptographic C2PA signature is robust at its core (the signature cannot be forged without the private key), but is trivial to remove: metadata stripping or re-encoding on a platform that does not preserve the chain is enough. Its value lies in proving authenticity when the chain is present, not in guaranteeing detection when someone deliberately removes it.

The honest conclusion is that current watermarking reduces opportunistic fraud and accidental confusion, but does not stop an actor with clear objectives.

Detection without watermark: forensic analysis

When content arrives unmarked, the forensic path remains: analyzing the file itself for indicators of synthetic generation.

In images, detectors look for texture anomalies (repetitive patterns on skin, eyes, backgrounds), geometric inconsistencies (perspectives, shadows, reflections that do not match), artifacts in specific frequencies that generative models tend to introduce and statistical signatures of sampling. Tools such as Hive Moderation, Deepware Scanner and the line of work behind Intel FakeCatcher (analysis of physiological signals such as visible pulse in pixels) offer probabilistic detection.

In video, temporal analysis is added: unnatural blinking, imperfect lip sync, missing or inconsistent facial micromovements between frames. The operational challenge is latency: deep analysis of a long video is not feasible in real time for mass moderation.

In audio, detectors look for spectral artifacts typical of neural synthesis, lack of micro variations of real human voice and mismatches in breathing or pauses. Precision varies by generator model family and degrades when the attacker uses post-processing to mask traces.

In text, AI-based detection has a significant false positive and false negative rate. Commercial tools often fail both at classifying edited human text as synthetic and at letting through carefully prompted text from recent models. Academically it is considered an unsolved problem in the general case.

EU AI Act Article 50: actual obligations

Article 50 introduces two distinct obligations that should be read carefully.

The first is transparency towards the user. When an AI system interacts with natural persons (chatbots, voice assistants), the deployer must ensure those persons know they are interacting with AI, except for narrowly defined exceptions (systems authorized by law for detection, investigation, etc.). This applies regardless of technical watermarking: it is an obligation of explicit information.

The second is marking of synthetic content. Providers of generative AI systems must ensure outputs (text, image, audio, video) are markable as artificially generated or manipulated in a machine-readable format and, where technically feasible, detectable. Deployers that generate or manipulate deep fakes must inform the public of the synthetic nature of the content, with exceptions for clearly identified artistic use and legally authorized cases.

The precise technical definitions (what counts as valid marking, what robustness level is required, how "technically feasible" is established) are developed through implementing acts and harmonized standards, where C2PA and equivalent proposals are natural references. For general purpose AI models with systemic risk, the AI Act adds broader obligations of risk management, adversarial evaluation and reporting.

Penalties may reach significant percentages of the operator's total worldwide annual turnover, depending on the type of breach and the size of the organization. Exact figures and tiers are set in the regulation itself.

Enterprise implementation: where it really applies

Beyond compliance, there are three families of cases where watermarking provides concrete operational value.

Corporate brand content. Images, videos and materials generated by internal teams or agencies are signed with C2PA on export, embedding author, tool and, if applicable, an indication of generative AI usage in some phase. The credential chain travels with the file and lets partners, clients and platforms verify authenticity.

Customer support chatbots and assistants. The transparency obligation in Article 50 materializes through explicit disclosure on the first interaction and marking of transcripts when delivered to users or authorities.

Marketing assets, editorial content and official communications. Images generated with models such as Imagen, DALL-E or Midjourney can be marked at source through SynthID where the provider supports it, and additionally signed with C2PA when integrated into the editorial chain.

In all cases, implementation involves process decisions: internal policy on when and how to use generative AI, training of the team on correct disclosure, configuration of tools to preserve C2PA chains on export and periodic verification that pipelines do not lose metadata through aggressive reencoding.

Defensive use cases

Brand protection. Companies with recognizable visual identity use SynthID and forensic detectors to identify external content that imitates their aesthetic or combines their logo with synthetic materials. Detection is not perfect, but it accelerates response and helps prioritize takedown.

News and press verification. Agencies such as AFP, BBC and other newsrooms that have adopted C2PA in their workflows can sign their own content and verify credentials on third party material before publishing.

Legal chain of custody. In internal investigations and judicial procedures, C2PA signing applied when collecting evidence (screenshots, videos, photographs) reinforces traceability. It does not replace formal digital evidence procedures, but adds a verifiability layer.

Election monitoring and institutional communication. Governments and observers monitor deepfake circulation in sensitive periods and sign official communications with verifiable credentials, so that the absence of a signature on a piece attributed to an institution is already an indicator of tampering.

Honest limitations worth assuming

Current watermarking is not robust against a motivated adversary. Removal techniques are trivially accessible and an attacker with intent can neutralize the marks with public tools. Pretending otherwise leads to misguided governance decisions.

Watermarking does not solve the fundamental trust problem. Even if a detector confirms an image contains no known watermark, that does not imply authenticity: it may have been generated with a model that does not watermark, captured with a real camera or had marks removed. Absence of mark is not proof of human authorship.

Watermarking in text works poorly in the general case. The loss of signal under paraphrasing and the difficulty of applying marking without degrading quality keep it in an experimental state. The commercial APIs of the major providers do not mark text by default in 2026.

Interoperability between standards is still limited. Not all platforms and CDNs preserve metadata in their pipelines. Images published on social networks frequently lose their credentials.

A reasonable strategy combines preventive marking where it adds value, complementary forensic detection, clear internal policies on generative AI usage and out-of-band verification processes for critical decisions (confirmation via independent channel before wire transfers, authorizations using agreed keywords).

Frequently asked questions

Is SynthID 100% effective?

No. It offers probabilistic detection on content generated with Google models that apply it. It does not detect content produced with other models, its robustness degrades under aggressive transformations and an attacker can neutralize it with additional processing. It is useful as an extra layer, not as definitive forensic proof.

Is C2PA really adopted?

Adoption is growing but uneven. Adobe, Microsoft, Google, Meta, OpenAI, BBC, Leica, Sony and a growing number of platforms and manufacturers integrate it. Many social networks and CDNs do not preserve metadata in their pipelines, so the chain is frequently lost on publishing. Broader effective coverage is reasonable to expect over the next few years.

Does my chatbot need a legal watermark?

Article 50 of the EU AI Act requires informing the user that they are interacting with an AI, except in narrow cases. Technical marking applies more to synthetic content (images, audio, video, long form text) than to interactive conversation itself. For chatbots, what is critical is explicit disclosure and recording the synthetic nature of the exchange when delivered to third parties.

Is deepfake detection viable today?

Tools with reasonable accuracy exist for controlled scenarios and known generator models. It is not a foolproof solution: the error rate remains significant, especially when the attacker uses recent models and post-processing. Better treated as a probabilistic signal than as proof.

Does text LLM watermarking work in production?

In its current state, not in a general way. Published statistical schemes degrade under paraphrasing and human editing. No major provider applies watermarking by default in its text API in 2026.

What is the fine for breaching EU AI Act Article 50?

The AI Act's sanctioning regime contemplates fines as percentages of total worldwide annual turnover, scaling by type of breach. Exact figures are set in the regulation itself and apply together with complementary national sanctions defined by each Member State.

Related resources

• ChatGPT security in business and risks 2026
• OWASP Top 10 for LLM explained
• AI agents security and autonomous risks
• AI red teaming: evaluating the security of AI models
• What is PKI: public key infrastructure

Content provenance strategy with Secra

At Secra we help organizations design and implement content provenance strategies that combine preventive marking (C2PA in editorial and brand workflows, SynthID where the provider allows it), forensic detection for external content and internal verification processes adapted to sectors with deepfake fraud exposure (banking, insurance, media, public sector). We cover the fit with EU AI Act Article 50, integration with corporate generative AI policies and training teams on disclosure and verification.

If your organization is defining generative AI governance or needs an assessment of exposure to synthetic content fraud, you can reach us at secra.es/contact for an initial conversation and to define scope.