How a watermark is hidden inside the output

Attached versus embedded

The lesson on fakes and evidence covered provenance: a signed record attached to a file, saying where it came from. That record lives beside the content, and a screenshot leaves it behind. A watermark is the other idea. It lives inside the content (in the pixels, the samples, the choice of words) so that a copy carries it whether the copier wants it to or not. The two are complements, and both are now written into law in several places, so it is worth knowing exactly what an embedded mark can do.

Inside a picture

Every generated image comes out of a process that made millions of tiny arbitrary choices (this pixel a fraction brighter, that one a fraction bluer) that no viewer could distinguish from the alternative. An image watermark makes those choices non-arbitrary. A pattern is spread across the whole image, far below the level a person can see, in a way that a matching detector can recognise statistically.

Google’s version, deployed in its image models since 2023, is trained as a pair: an embedder that learns to hide the pattern and a detector that learns to find it, trained together against a battery of what images go through in the wild: compression, cropping, resizing, colour changes, screenshots. The mark survives most of that, which attached metadata does not. It does not survive everything: heavy editing, re-generation through another model, or a determined attacker with the detector to test against.

Inside a paragraph

Text seemed impossible to watermark, because there are no invisible pixels in a sentence. The trick, first published in 2023 and deployed in a major chatbot from 2024, is in the sampling you met in the lesson on why answers differ.

At each step the model has a spread of plausible next tokens. A secret function of the previous few tokens splits the vocabulary into two lists, and the sampler nudges its choice toward one of them. The nudge is small enough that the text reads normally: the model still picks among good words, just with a thumb on the scale. A detector that knows the function recounts the text: an ordinary paragraph has about half its tokens on the favoured list; a watermarked one has noticeably more. Over a few hundred tokens the difference is statistically unmistakable.

Two properties follow directly from the mechanism. Short texts cannot be reliably marked, because a sentence has too few choices to count. And paraphrasing by a person, or by another model, washes the mark out, because it replaces the choices.

Audio works the same way as images, with the pattern hidden below hearing.

What the mark proves

Here is the limit that every headline about watermarking omits. A watermark is put in by the generator, and only the generator’s detector can read it. So a positive result proves “this came from a system that cooperated”. It says nothing about anything else.

A negative result proves nothing at all. Unmarked content might be human-made, or made by a model whose lab does not watermark, or made by an open-weights model, which can never be forced to, because the sampling code is in the user’s hands and the nudge is one line to remove. Since a large share of generated content now comes from open models, absence of a mark is not evidence and cannot be made into evidence by law.

And the detector is private. Only the lab that made the image can tell you it made it. There is no universal check, and each lab’s mark is invisible to the others’.

What the law now asks

The European Union’s AI law requires, from 2026, that providers of generative systems mark their output in a machine-readable way; China’s labelling rules, in force from September 2025, require both a visible label and an embedded one. Both regulate the cooperating generators. Neither can reach a model file on a laptop, which is the honest boundary of what regulation of this kind achieves: it makes the compliant products traceable and leaves the rest as it was.

What to take from it

Use the two ideas for what each can do. Attached provenance can give a positive reason to trust a piece of media whose chain is intact. An embedded watermark can let a platform or a lab identify its own output at scale: for removing spam, for keeping generated text out of the next training set, for answering a specific complaint. Neither can tell you that an unmarked photograph is real. That question stays where the earlier lesson left it: with the source, the corroboration, and who benefits.