Watermarking & Content Credentials

Two mechanisms, and what each one really claims.

The field has converged on exactly two techniques, and they are not variants of each other — they live in different places and make different promises.

• Content credentials — signed metadata. The C2PA standard attaches a cryptographically signed manifest to a file: who or what produced it, with which tool, and what was done to it since. The signature is ordinary public-key cryptography, so verification is mechanical and the claim is auditable. Recent revisions extended manifests beyond images and video to plain-text documents. Its promise is strong and narrow: this assertion was made by the holder of this key and has not been altered since.
• Watermarks — a signal inside the content. Google's SynthID family is the best-documented example: for text it biases the sampler's choice among near-equally-likely tokens so that a detector holding the key can score a passage as probably-watermarked; for images and audio it perturbs the signal below the perception threshold. Nothing is attached, so nothing can be stripped by a file conversion. Its promise is weaker and broader: a statistical trace of one generator survives in this content, with some probability.

Notice what neither one says. A credential on a photograph tells you a camera with a particular key signed it; it does not tell you the photograph is not of a staged scene. A watermark in a paragraph tells you a model probably wrote it; it does not tell you the paragraph is false, and its absence does not tell you a human wrote it. Marking is an attribution technology. Truth is not downstream of it, which is why grounding and the documents a vendor publishes about a model do work that no mark can.

The failure modes are complementary, which is the whole design problem.

Each mechanism is robust against exactly what destroys the other. That is why serious schemes pair them, and why neither alone holds up in the wild.

# what survives what

                       signed manifest    in-content watermark
re-encode / resize     fragile            robust
screenshot / re-type   destroyed          robust (image) / robust (text)
paraphrase / rewrite   robust             largely destroyed (text)
crop / heavy edit      invalidated        degrades
deliberate removal     trivial            hard but studied

# the attacker picks the cheaper column.

The asymmetry is stark for text. A published assessment of SynthID-Text put its true-positive rate near 0.998 on unedited output and around 0.498 under moderate paraphrasing — a coin flip after the single cheapest edit anyone can make, and round-trip machine translation degrades detection similarly. Image watermarking is in much better shape: the same family has been reported at roughly 99.7% true positives at a 0.1% false-positive rate against the worst single transformation, and about 98% against stacked ones.

Signed metadata inverts the table. Paraphrase does not touch it, because it is not in the content. But anything that rewrites the file rewrites the file: a screenshot does not strip the manifest so much as create a new, unsigned artefact that happens to look like the old one. Most of the pipelines content actually travels through — a messaging app's re-encoder, a CMS thumbnailer, a copy-paste — produce exactly that.

So the practical reading is unglamorous. For images, a watermark is the durable layer and the credential is the auditable one. For text, there is no durable layer: the edit that defeats the watermark is the edit a motivated person makes by default, and open-weight models carry no mark at all unless whoever deployed them chose to add one, with nothing stopping its removal.

The law requires marking. It does not require that anyone can read the mark.

This is the gap that surprises people, and it is a drafting consequence rather than an oversight. Article 50 of the EU AI Act obliges providers of generative systems to mark synthetic output in a machine-readable way, and that obligation became applicable on 2 August 2026 (with reporting that systems already on the market may have until later that year under subsequent amendment). The duty falls on the producer, to embed. It does not create a corresponding right for a recipient to verify.

The result is a marking regime without a verification regime. Major text providers began embedding imperceptible marks around that date; no public detector reads them. The key that scores a passage stays with the provider, because publishing it is close to publishing the removal instructions, and a detector anyone can query is a detector an evader can tune against. So the compliance box is ticked and the downstream question — was this essay, this review, this filing written by a model — is exactly as unanswerable as it was before.

• You cannot procure your way to detection. A vendor claiming to detect AI text is, with the partial exception of a provider checking its own output, selling a classifier — and classifiers in this domain carry false-positive rates high enough to have caused real harm to real people when used as evidence.
• Marked does not mean traceable. Two marked files from two providers are two unrelated schemes with two private keys. There is no interoperable "is this synthetic" query, and a marking mandate does not create one.
• Interrogate the claim, not the artefact. Where disclosure genuinely matters — a filing, a submission, a published statement — the enforceable control is a declaration by an accountable party, which is the argument in disclosure and content provenance, not a scan of the bytes.

What to build, given that detection is not coming.

The move is to stop asking what arrived and start proving what you sent. Provenance works when you own the point of creation, and this is the half an agent system can actually implement.

• Sign at the moment of creation, inside your own pipeline. If your agent produces a report, a transcript or an image, attach the credential before the artefact leaves the process that made it — with the model, the prompt version, the tool calls and the human who approved it. That record is what makes an audit trail about output rather than about logs, and it is useful even when no recipient ever verifies it.
• Carry the credential as a field, not as file metadata. Inside your own storage, keep the provenance record joined to the content by ID. Then a thumbnailer stripping the embedded manifest costs you nothing, and the manifest is a bonus for recipients outside your boundary rather than your only copy.
• Never treat an unmarked input as human. This is the single most common design error. An ingestion path that routes "no credential found" to a trusted branch is a path an attacker takes by doing nothing — the same failure shape as any check that fails open. Unmarked means unknown.
• Never treat a marked input as trusted either. A valid credential proves origin, not intent. Content that arrives with a perfect manifest is still untrusted text going into a model's context, and prompt injection does not care who signed it.
• Mark your agent's own outbound content because of who reads it next. The fastest-growing consumer of your output is another model. A marked, credentialed artefact is how the next system in the chain can tell your agent's writing from a user's, and that distinction is the basis of an instruction hierarchy that survives a round trip.