{"slug": "watermarking-ai", "title": "Watermarking AI", "summary": "Google DeepMind's SynthID watermarking system, introduced in 2023 and now applied across several major models including Claude for text, injects a secret statistical bias during generation rather than relying on post-hoc classifiers, which lose accuracy as generative models improve. The EU AI Act's Article 50 requires providers of generative AI to mark output as AI-generated and make it detectable across images, video, audio and text, with the rules applying from August 2026. The approach shifts a model's next-word probability distribution using a secret key so biased word choices accumulate into a detectable statistical pattern, with the bias applied only when entropy is high enough that many words fit.", "body_md": "## Background and history\n\nAn AI watermark is not a logo stamped on a stock photo. It is a hidden mathematical trick: a signal inside the generated image or text that people cannot see or read, but that a watermark detector can identify, flagging the content as AI-generated.\n\n## Why we suddenly need it\n\nThe first approach to spotting AI output was a classifier. You trained a model on huge amounts of human and generated content and let it look for tiny differences. That worked while generated content was clearly different or worse. As generative models improved, those differences vanished and the accuracy of the classifiers dropped.\n\nThat was the trigger for watermarking. **Instead of guessing afterwards, you inject a signal while the content is generated.** In practice this means giving the generative model a small, secret bias.\n\n## Which kinds of output it works on\n\nThe same idea now covers almost every kind of generated output:\n\n- **Images and video** : lots of pixels, so lots of room to hide a signal.\n- **Text** : much harder, because every word is visible and there is little room to hide anything.\n- **Biology** : AI-designed proteins, where the challenge becomes \"is this sequence from nature or from an AI?\"\n\nThe big difference is between high-dimensional output like images, video and biological 3D molecular structures, and rather low-dimensional output like text, code and amino acid sequences. Each needs a different approach, even though the principles are somewhat similar.\n\n## What makes a good watermark\n\nA good watermark is invisible to humans and highly detectable by machines. That can be expressed by three properties.\n\n## SynthID and the law\n\nSynthID is Google DeepMind's watermarking system, introduced in 2023 and now used across several major models, including Claude for text.\n\nThe EU AI Act [Article 50](https://artificialintelligenceact.eu/transparency-rules-article-50/) requires providers of generative AI to mark their output as AI-generated and make it detectable. That covers images, video and audio, but also text, and the rules apply from August 2026.\n\nThe goal is not only catching plagiarism or students using \"Cheat GPT\". It is about trust in what we read and see, and detecting fake news or [misinformation](https://madewithlove.com/blog/bots-and-boundaries-who-do-you-blame-when-the-bot-defames-part-2/). In biology it's even more important, because it's about stopping something potentially hazardous from doing harm.\n\n## How it is done in text\n\nYou cannot hide a text watermark in whitespace or commas. Those are easily spotted and stripped. **The watermark signal comes from the choice of words itself.**\n\n### Nudging the next word\n\nA language model does not just pick the next word. It produces a [probability distribution](https://madewithlove.com/blog/ai-needs-more-uncertainty/) over possible next words. Take this sentence:\n\nThe cat sat on the ___\n\nWithout a watermark the model mostly says \"mat\". A watermarking model slightly shifts these odds, using a secret key, so that some words are favoured a little more than they normally would be. Each watermarked (or biased) choice still looks natural to humans and doesn't alter the meaning of a text. But across hundreds of words, the biased words show up more often than pure 50/50. That statistical pattern is the watermark signal, which a detector can pick up.\n\nIn this tiny example picking \"sofa\" would be too obvious. The trick is knowing when the model is allowed to pick a less obvious word. That is measured as entropy: when many words fit well (high entropy), there is room for bias. When only one word is right (low entropy), the model leaves it alone.\n\n### Red and green words\n\nA simple way to explain the purpose of the key is to mark words with two colours:\n\n1. A watermark works in a local context. It only looks at the last few tokens as context.\n2. For every new word, those previous tokens and the secret key split the vocabulary into green and red words, roughly 50/50.\n3. Normal text, written by a human, lands on about 50% green words over a long passage.\n4. Watermarked text is pushed towards green. Pushing to 80 or 90% would make the watermark easy to detect, but it would also hurt quality. A smaller bias is enough: around 60% green words lets a detector find the watermark with high confidence on a long text.\n\n**Only someone who holds the key can recompute which words were green, so only they can run the detector and find the hidden watermark pattern.** To everyone else the text reads normally. It cannot easily be reverse-engineered, and because each company or even each model can use a distinct key, a detector can even tell which model produced the text.\n\n### Caveats\n\n- **Short text** : below roughly 200 tokens the signal is unreliable and even hard to fit into the limited space.\n- **Rewriting** : editing or paraphrasing a long text weakens the watermark but does not erase it. A complete rewrite does.\n- **Factual answers** : when there is basically one exact answer, there are few words to put a bias on, so the watermark is barely visible. In percentage terms, that might mean a bias of only 51% green words.\n- **Code** : structure and syntax leave very little entropy, so code can carry less bias than prose.\n- **Some text is simply not watermarkable** , such as a fixed quote, a number or a single-word reply.\n\n## How it is done in images\n\nImages are rather easier to watermark, for the simple fact that a single picture holds millions of values, so there is plenty of room to hide a signal that no human eye will notice.\n\nBut the hard part is robustness. People crop, scale, zoom, compress and filter images all the time, and the watermark has to survive all of that. SynthID solves this by training three models against each other:\n\n1. An **injector** hides a signal in the image.\n2. A **manipulation model** attacks the image with the kinds of edits people make.\n3. A **detector** has to find the signal in what is left.\n\nThe injector and detector are trained as a pair, so they learn together how to get around whatever the manipulation model throws at them.\n\nEvery miss by the detector pushes the injector towards a signal that survives the edits better, without becoming visible.\n\n## How it is done in biology\n\n[SynthID Bio](https://www.helpnetsecurity.com/2026/10/01/synthid-bio-watermark/) brings the same idea to AI-designed proteins. The main motivation here is biosecurity rather than spotting plagiarism.\n\n### Some chemistry\n\nProteins are chains of amino acids. That chain folds into a 3D shape, and the shape is what determines the protein's function. AlphaFold made its name by predicting that folded structure from the sequence. Newer design models like AlphaProteo do it the other way: they generate new sequences based on the desired function.\n\n### Why a watermark helps\n\nDNA printing companies screen every order against a database of known risky sequences, backed by some identity checks on the customer. The weakness is that an AI can propose a sequence that does not match anything in that database, but still folds into the same functional shape with hazardous effects.\n\nThe watermark does not imply that a design is dangerous. **It signals to the DNA printing company that an order came from a trusted, safeguarded model, which lets safe orders clear automatically and makes an unfamiliar, unwatermarked sequence stand out for a closer look.**\n\n### How the signal is hidden\n\nSynthID Bio works in two places:\n\n- **In the sequence or protein folding** , it works almost exactly like the text watermark: a secret key biases the choice of the next amino acid, without changing the final folded shape. A string of amino acids is really just another string of symbols, which is why the text analogy works.\n- **In the 3D structure or molecular structure** , the angle or distance between atoms is slightly nudged.\n\nNature already tolerates small variations: a slightly different sequence usually folds to the same working protein. Otherwise the slightest variation would have led to mutations and disastrous results.\n\nAs with text, detection relies on keys that have to be shared with whoever needs to check.\n\n## Can anyone use SynthID?\n\nSynthID is now used across many models: Gemini, OpenAI (images from ChatGPT and its API since May 2026), NVIDIA, and Claude for text. Google runs a [SynthID Detector portal](https://deepmind.google/models/synthid/) that checks content against the keys it holds.\n\nThe catch is the keys. Detection only works if the detector has the right key. Google can detect an OpenAI watermark only if OpenAI shares its key. Otherwise the signal is there but unreadable. So \"can anyone use it\" is really a question about agreements between companies to share keys, not about the technology.\n\nThat is also why the EU law is so important. **Marking output on its own is not enough. Being able to detect it is the crucial step.**\n\n## References\n\n- Computerphile, [AI text watermarking explained](https://www.youtube.com/watch?v=kVXp6UNVPTo) (YouTube)\n- [SynthID / tournament sampling walkthrough](https://www.youtube.com/watch?v=HIUzrxQxTtw) (YouTube)\n- Anthropic, [Watermarking Claude's text output](https://anthropic.com/news/claude-text-watermark)\n- Hugging Face, [SynthID Text is now open source](https://huggingface.co/blog/synthid-text)\n- Google DeepMind, [SynthID](https://deepmind.google/models/synthid/)\n- Help Net Security, [SynthID Bio watermarks AI-designed proteins](https://www.helpnetsecurity.com/2026/10/01/synthid-bio-watermark/)\n- EU AI Act, [Transparency rules (Article 50)](https://artificialintelligenceact.eu/transparency-rules-article-50/)\n\n## Appendix: the tournament in detail\n\nThe red and green picture in the main text is based on intuition. But SynthID's real mechanism is tournament sampling. It better explains something the simple version does not: why the favoured words are not always the biased ones.\n\n### The setup\n\nInstead of picking one word from the model's distribution, the model picks several candidate words. Each candidate gets a g-value, a pseudo-random score of 0 or 1 computed from the secret key and the recent context. A different g-value is used in each round of the tournament.\n\nThe candidates then play a knockout tournament. In each round they are paired up, and the one with the higher g-value advances. The word that wins the final round is the one that gets written.\n\n### A working example\n\nSuppose the model is finishing \"The cat sat on the ___\" and samples four candidates. Each round uses its own random g-values.\n\nHere \"mat\" was the model's most likely word, and it still won its first round. But in the next round its g-value came up 0 while \"sofa\" came up 1, so \"sofa\" advanced and was written. A slightly less likely word was chosen, which is exactly what keeps the output natural and the bias hard to spot.\n\n### Why this is clever\n\nBecause the winner always had high g-values, watermarked text drifts towards high-g words. The detector recomputes the g-values for the text it is given, and if they average suspiciously high, it flags the text as watermarked. Yet no single word choice is forced, so the output stays fluent and the model's distribution is only gently tilted. Remember the 60% versus the 80%?", "url": "https://wpnews.pro/news/watermarking-ai", "canonical_source": "https://madewithlove.com/blog/watermarking-ai/", "published_at": "2026-11-02 08:53:00+00:00", "updated_at": "2026-11-02 09:19:34.259781+00:00", "lang": "en", "topics": ["artificial-intelligence", "generative-ai", "ai-policy", "large-language-models", "ai-safety"], "entities": ["Google DeepMind", "SynthID", "Claude", "European Union", "EU AI Act"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/watermarking-ai", "markdown": "https://wpnews.pro/news/watermarking-ai.md", "text": "https://wpnews.pro/news/watermarking-ai.txt", "jsonld": "https://wpnews.pro/news/watermarking-ai.jsonld"}}