Learn how AI watermarks are hidden in text, images and source code files. Anthropic and some AI giants recently announced that new models wi...
 |
| Learn how AI watermarks are hidden in text, images and source code files. |
Science Techniz possesses a secret tool capable of detecting this cryptographically signed, embedded metadata, and can even remove or bypass these imperceptible statistical watermarks and C2PA content credentials.
To comply with this requirement, Anthropic and other major AI companies use a combination of imperceptible statistical watermarks and C2PA content credentials to record provenance information for generated files. In this article, we will examine how these technologies operate, how statistical watermarks like SynthID-Text are embedded and detected, and how C2PA records the provenance of AI-generated files. Additionally, we will test what happens when watermarked text is paraphrased or translated, as well as whether C2PA metadata can be removed from an AI-generated image.
How AI Watermarking Works
An LLM generates text one token at a time. At each generation step, the model has a probability distribution for the next possible tokens. For instance, if the model generates "The quick brown fox," possible next tokens could be "jumps," "jumped," "is," and so on. The watermark is embedded during the generation process. The sampling algorithm subtly changes the way it selects tokens, resulting in text with a statistical signature. The important thing is that the generated text looks completely normal to a human reader.
Developed by Google DeepMind, SynthID-Text uses a secret watermarking key and a sliding window of recently generated tokens to create a pseudo-random seed. The seed is then used to calculate watermark scores, or g-values, for candidate tokens. The watermarking algorithm subtly favors tokens with higher g-values. This process is repeated for every generated token. The result is text that appears normal but has a statistical bias toward tokens that received higher watermark scores. This process does not insert a visible watermark. Rather, the watermark is hidden within the statistical properties of the token sequence.
Detet AI Watermarks
The second part of the watermarking process is detection. A detector uses the tokenized text and the secret watermarking key as inputs. Using this information, it can reproduce the pseudo-random watermark scores for the tokens in the text. Access to the original LLM is not necessary for the detector. A simple approach to statistical watermark detection is to calculate the mean of all g-values. For unwatermarked text, the g-values should be uniformly distributed, so the average will be close to 0.5. However, for watermarked text, the sampling process introduces a positive bias, so the average score should be higher. I recommend reading my post about the SynthID algorithm for a more detailed description. In summary, statistical watermark detection looks for patterns across many tokens. The signal is included in the tokens chosen to make up the text.
AI Text Watermarks
Statistical watermarking is not perfect. First, the AI model provider must embed the watermark. If a model does not implement watermarking, there is no corresponding watermark to detect. Additionally, the detector requires the appropriate watermarking configuration or must be trained for that configuration. Second, longer texts provide stronger statistical evidence. Very short pieces of text contain fewer tokens, making it more difficult to distinguish a watermark signal from random variation. Third, editing can affect the watermark. Since the watermark is related to the tokens selected during generation, changing those tokens weakens the signal. Here's what Anthropic has to say about text edits: "Can't someone just edit the text to get around the watermarking? To some extent, yes. Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it's arguable whether the text can any longer be described as AI-generated."
Two common transformations that weaken statistical watermarks are paraphrasing and back-translation. Using a local google/gemma-2b-it LLM and the transformers library, I implemented my own SynthID watermarking and tested how the mean g-value changed when editing watermarked text. For paraphrasing, I used the DeepL Write AI tool to automatically rephrase the watermarked text from English to English. For back-translation, I used the Google Translate AI tool for an English-to-Spanish-to-English translation. The bar chart below shows the mean g-value scores from my small-scale experiment. Both paraphrasing and back-translation successfully reduced the watermark score. Therefore, a statistical watermark should not be interpreted as a perfect AI detector. Rather, it provides statistical evidence that a particular watermarking system may have been used in the generation process.
There are several ways to record the origin of AI-generated content, one of which is statistical watermarking. Another approach is the C2PA Content Credentials initiative. C2PA stands for the Coalition for Content Provenance and Authenticity. It is an open technical standard for recording the provenance of digital content. Rather than altering the statistical properties of the generated content, C2PA adds a provenance record to the digital asset. For example, an image generated by an AI system could contain the following information: the image was generated by an AI system, which application or system created it, when it was created, and which actions were performed on the content afterward. This information is stored in a C2PA manifest, also known as a content credential. A manifest can contain multiple assertions describing the asset's provenance.
Cryptographical Metadata
C2PA verifies provenance information using cryptographic signatures. The basic idea is similar to that of a digitally signed document. The creator or application signs the provenance information. Then, a C2PA-compatible system can verify the signature to determine if the information is authentic and if the content has been modified in a way that invalidates the record. This establishes a chain of trust around the content.
For example, I used Google Gemini to generate an image of a cat. Then, I downloaded the file and verified it using a tool that inspects C2PA content credentials. The C2PA manifest provides information about the image's provenance, including the system that created and processed the content. More specifically, the manifest's JSON data shows that Google Generative AI first created the image and subsequently applied an imperceptible SynthID-Image watermark. If I were to edit the image using Adobe Photoshop, for example, additional information could be added to the content credentials describing that action.
Watermark Removal Tool
On August 11, a new MIT-licensed open-source project called watermarks-remover was released, just a few days before Anthropic's announcement about adding watermarks. In just a few days, the project has already received over 10,000 stars on GitHub. The tool can inspect files for invisible Unicode characters, rewrite text using LLMs to weaken statistical watermarks, and remove C2PA and other metadata from supported files.
How to Remove AI Watermark
The tool performs text rewriting to remove or weaken statistical watermarks. Examining the project's source code reveals that the file service/scripts/rewrite_text.py uses common techniques, such as paraphrasing (the default setting) and back-translation ("English to French to English" by default). The prompts include a paraphrase option that rewrites the text so that it uses substantially different wording at the token level, changing clause order, connectors, and transition words, varying sentence boundaries and length, and replacing both content words and function words where meaning allows while preserving all facts, numbers, names, and technical identifiers.
A humanize option rewrites the text so it reads as if a human wrote it from scratch, varying sentence rhythm and length, replacing formulaic AI-style transitions and filler with concrete natural phrasing, and using plain, varied wording while preserving all facts, numbers, names, and technical identifiers. A code option rewrites the natural-language parts of code, including comments, docstrings, and string literals, using different wording, and renames local variables, function parameters, and private helper names to semantically equivalent names while preserving program behavior, public API names, and all values that affect output. Back-translation options translate the text to another language and back to the original language while preserving meaning and using natural phrasing. Structural options extract a bullet outline of all claims and structure from the text and then write a complete document from that outline in natural, varied human prose, avoiding formulaic transitions.
Remove C2PA Metadata
Using the C2PA manifest example image from above, I inspected the AI-generated image with watermarks-remover. The output using the service/scripts/inspect_image.py showed the path, format, C2PA status, AI metadata status, and findings including a confirmed JPEG APP11 segment (JUMBF/C2PA common) and confirmed JPEG APP11 markers for c2pa, C2PA, digitalSourceType, trainedAlgorithmicMedia, algorithmicMedia, and SynthID. The tool correctly identified the C2PA metadata. Then, we can remove the content credentials using service/scripts/clean_image.py. The output showed that the cleaned file was written, dropping the APP11 (C2PA/JUMBF) segment while preserving the entropy-coded scan from SOS to EOF. Finally, I verified the cleaned image using the same website as before. This time, however, the verification tool could not find any C2PA Content Credentials in the cleaned file, and the cleaned image now reads "No C2PA Data Found."
Conclusion
AI watermarking is not a single technology. For text, statistical watermarking alters the probability of token selection during generation, resulting in text that contains a hidden statistical signal. For images and other digital assets, provenance systems, such as C2PA, record information about the origin of the content and the modifications made to it. These approaches solve different problems. A statistical watermark is part of the content itself. It can survive some forms of copying and editing, but large enough changes to the text will weaken the signal.
The more the text changes, the weaker the signal becomes. C2PA, on the other hand, provides a cryptographically verifiable provenance record. It tells us what a participating system claims happened to a file. However, the metadata can be removed from formats that allow it to be stripped. Therefore, neither technology should be considered a perfect AI detector. Using software such as the watermarks-remover tool, we can successfully remove or weaken these watermarks. Consequently, text without a detectable watermark is not necessarily human-written. Likewise, an image without C2PA metadata is not necessarily human-created. However, watermarking systems provide additional evidence about how content was created.
References
[1] Anthropic (2026), How Claude's text watermark works (https://www.anthropic.com/news/claude-text-watermark)
[2] EU Artificial Intelligence Act (2026), Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems (https://artificialintelligenceact.eu/article/50/)
[3] Dr. Leon Eversberg (2026), How To Detect AI-Generated Text with Google's SynthID Watermarking, Generative AI (https://medium.com/u/a67b10ad1762)
[4] S. Dathathri and others (2024), Scalable watermarking for identifying large language model outputs, Nature volume 634 (https://www.nature.com/articles/s41586-024-08025-4)
