AI watermarking is a signal, not a verdict

Google announced in May 2025 that SynthID had watermarked "over 10 billion pieces of content." It is almost certainly the most widely deployed AI watermark in existence, it covers images, audio, text and video, and it is engineered to survive the things that normally destroy a mark — cropping, filters, frame-rate changes, MP3 compression.

Now try to use it. Google's SynthID Detector portal went out to early testers, and access is still a waitlist: "journalists, media professionals and researchers can join our waitlist to gain access." Consumer checking runs through asking Gemini about an upload.

That gap — ten billion marked artifacts, gated detection — is the shape of the whole problem with AI watermarking. Not that it fails. That it produces a signal which is strong when present, meaningless when absent, and readable by almost nobody. Which makes it excellent evidence and a terrible verdict.

What watermarking is genuinely good at

Start with the case for it, because the skepticism only earns its keep afterward.

A watermark is a statistical pattern deliberately embedded in generated output — a bias in token selection for text, an imperceptible perturbation for images and audio. It rides inside the content rather than beside it, which means it does something metadata cannot: it survives the strip. Upload an image to a platform that discards every EXIF and XMP field and the pixels still carry the mark.

The engineering is real. Google states SynthID for images and video is "designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression," and for audio that it "can't be altered by common modifications like adding noise, MP3 compression, or changing the speed." Independent analysis backs the design intent: attacks that do not specifically target the encoder's learned perturbation — generic noise, filters, transforms — tend to fail, because those are precisely what the encoder was trained against.

It has also stopped being one vendor's feature. SynthID has been extended beyond Google's own products, and the EU AI Act's Article 50 obliges providers of generative systems to mark outputs in a machine-readable format and make them detectable — which is why the technique is now table stakes rather than a differentiator. We wrote about what that obligation actually demands in Article 50 is live, marking was the easy half.

Use it. The argument here is not that watermarking is theater. It is about what you may conclude from it.

The asymmetry that breaks the verdict

A watermark check has two outcomes and they are not symmetrical.

Mark found: strong evidence. Someone went to the trouble of embedding a specific statistical pattern, and the odds of it appearing by chance are vanishingly small. Treat it as near-conclusive that the content came from the marking system.

No mark found: almost nothing. The content could be human-made. Or made by a model that marks nothing — and most open-weight models mark nothing. Or made by a marking model and then edited past the detector's threshold. Or cropped below the surviving area. Or transcoded through a pipeline the encoder was not trained on. Or marked with a scheme this particular detector cannot read.

Every deployed system shares this profile, and it is fatal to "is this AI?" as a question a watermark can answer. The affirmative branch is reliable and the negative branch is empty, so the test can only ever confirm, never clear. Any product that renders a missing watermark as "no AI detected" and lets a user read that as "authentic" has converted the absence of evidence into evidence — the same error that makes AI detectors dangerous, wearing better cryptography.

Removal is not hypothetical, and for one class it is proven impossible to prevent

The robustness claims are about incidental damage — the compression and cropping of ordinary circulation. They are not claims about an adversary, and the literature on adversaries is not encouraging.

The foundational result is Zhao et al., Invisible Image Watermarks Are Provably Removable Using Generative AI, published at NeurIPS 2024. The attack is simple: add random noise to destroy the mark, then reconstruct the image with a diffusion model. Against RivaGAN, a scheme built for resilience, their regeneration attack removed 98% of watermarks while holding PSNR above 30 — visually, the same picture.

The word "provably" is the important one. The paper proves removal is guaranteed for any watermark that perturbs an image within a bounded L2 distance, whether or not that scheme has been invented yet. That is a result about a category, not a product. Their own suggested direction is semantic-preserving watermarking rather than imperceptible perturbation, which is a real research avenue and not a shipped defense.

Text watermarks face their own analysis. In March 2026, Omidi, Dong and Wang published the first theoretical treatment of SynthID-Text, proving that its mean detection score "is inherently vulnerable to increased tournament layers" and constructing a layer inflation attack that exploits it — concatenating a watermarked model with a copy of itself to push the detection metric into a range where it stops discriminating. Notably, the paper also shows the Bayesian scoring variant is more robust, with detection non-decreasing in layers. That is how this field should work: a specific weakness, a specific mitigation. But it means the strength of a text watermark depends on which scoring function the verifier happens to run, which is not a detail an end user will ever see.

None of this makes watermarking worthless. It makes it a signal with an adversarial ceiling, and honest systems state the ceiling.

The part nobody designs for: who can actually read it

Robustness gets the research attention. Readability is the operational failure.

A watermark is only useful to someone holding a detector for that specific scheme. SynthID detection sits behind a waitlist and a Gemini prompt. Other vendors' schemes need other vendors' detectors. There is no universal reader, and for good reason — publishing a detector broadly hands attackers an oracle to iterate against, so vendors gate access. The security incentive and the public-verifiability incentive point in opposite directions, and there is no clean resolution.

Follow that through. A watermark's usefulness is contingent on a private relationship with the marking vendor. A journalist on the waitlist gets an answer. A court in a jurisdiction the vendor does not serve does not. A regulator enforcing Article 50 detectability has to ask the regulated party for the detector. And when a company retires a product or a scheme, the marks already in the wild become unreadable.

Compare it to a public log. An append-only transparency log is published on purpose: anyone can fetch an entry, check an inclusion proof, and reach the same conclusion without permission from anybody. Publicity is the whole security model rather than a liability — which is why Certificate Transparency looks the way it does. A watermark is a private channel between generator and vendor. A log is a public record. Only one of them lets a stranger check your claim.

Hard binding, soft binding, and why Article 50 needs both

The standards world has vocabulary for this, and it clarifies the argument.

A hard binding ties a record to content cryptographically — a hash over the bytes. It is exact and unforgeable, and it breaks the instant anything re-encodes the file. A soft binding ties a record to content by something derived from the content itself: a watermark embedded in it, or a perceptual fingerprint computed from it. Soft bindings tolerate the transformations of real distribution, which is exactly why they are the interesting half.

Watermarking and fingerprinting are both soft bindings, and they differ in one respect that decides everything about who can use them. A watermark is written into the content, so reading it requires the vendor's detector. A fingerprint is derived from the content, so anyone can recompute it from the file in front of them and look it up. Same tolerance to re-encoding; opposite access model. One needs permission, the other needs arithmetic.

That distinction is why the EU's Article 50 obligation is harder than it reads. The requirement is not only that outputs be marked, but that they be detectable as artificially generated — and detectability is a property of the verifier's situation, not the generator's. A mark that only its issuer can read satisfies the letter of "machine-readable" while leaving the person who needs to check with nothing. We took that apart in marking was the easy half; the soft-binding distinction is the mechanism underneath it.

How to compose the signals honestly

The right architecture is not choosing between these mechanisms. It is refusing to let any single one produce the verdict.

Each covers a different failure. A C2PA manifest carries rich, signed, detailed assertions — and gets stripped by the first platform that re-encodes, which is the gap we described in Content Credentials solve half the problem. A watermark survives stripping but is unreadable without the vendor's detector and silent on the negative. A registry match keyed to a perceptual fingerprint survives the strip and is publicly checkable, but only for content someone chose to stamp.

So a verification result should report what it found, per source, and stop:

• The manifest, if one survived, and what it claims, and whether its signature validates and its certificate chains anywhere you have reason to trust.
• The registry match, if the fingerprint matches a logged entry, with the inclusion proof.
• The watermark, if a readable signal is present.

Three evidence lines, each independently checkable, none of them collapsed into a number. When they agree, the case is strong. When they conflict, the conflict is the finding — a valid manifest with no registry entry and no watermark is a specific, informative situation, and flattening it into "84% authentic" destroys the only useful thing about it.

This is why 0byte's verdicts are evidence-only. A model's estimate of whether content looks AI-generated is available, but it is opt-in and sits outside the verdict, because folding a probability into a statement of evidence contaminates the evidence. Run a verification and you get the record, or you get the honest absence of one.

A signal, not a verdict

Ten billion watermarked artifacts is a genuine achievement, and the mark does something no metadata field can: it lives inside the pixels and rides through the strip.

It still cannot tell you that something is real. It cannot be read by whoever happens to need the answer. And for an entire class of imperceptible schemes, removal is not a race against better attacks — it is a proven property of the approach.

Put watermarks in the evidence. Keep them out of the verdict. And write the record somewhere anyone can read it.

Further reading: SynthID (Google DeepMind) · SynthID Detector announcement (Google) · Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024) · On Google's SynthID-Text LLM Watermarking System (arXiv 2603.03410) · EU AI Act, Article 50 · C2PA content provenance standard