Watermarking AI-generated content has moved from a research curiosity to a compliance question. Article 50 of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text to mark their outputs “in a machine-readable format and detectable as artificially generated or manipulated”, with technical solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible”. Those obligations apply from 2 August 2026. If your organization deploys generative AI at any scale, the question is no longer whether to watermark, it is which approach to use and which tools implement it. Our AI security audit frameworks comparison covers how watermarking requirements fit within the broader landscape of EU AI Act and NIST AI RMF obligations.
The problem is that “watermarking” covers three technically distinct things, and vendors conflate them constantly. Let’s separate them before discussing tools.
The Three Categories
Text watermarking biases token selection during generation so the output still reads naturally but carries a statistical signal that a detector holding the key can test for. The reference approach comes from Kirchenbauer et al., A Watermark for Large Language Models, which selects a randomized set of “green” tokens before each word is generated and softly promotes their use during sampling. Detection is a statistical test producing interpretable p-values, and the paper’s design goal was that it run “without access to the language model API or parameters”.
Image and media watermarking embeds a signal in generated images, video or audio, either as a signed provenance manifest attached to the file (C2PA Content Credentials) or as an invisible perturbation carried by the pixels themselves. This is the more mature category, and invisible marking has been standard practice in stock photography for years.
Model fingerprinting embeds identifying information in training data or model weights so that a copied or stolen model can be traced back to its origin. This is a theft-detection and licensing-enforcement tool for model owners, not for end users.
We’ll cover tools in each category.
Text Watermarking Tools
SynthID-Text (Google DeepMind)
SynthID is Google DeepMind’s watermarking family, covering images, video, audio and text. DeepMind describes the text mechanism in terms of the generation loop: “Each word is assigned a probability score, based on how likely it is to be generated next… SynthID adjusts these probability scores to generate a watermark.”
The practical reason to start here is that the text variant is the one you can actually run. Hugging Face Transformers ships it as SynthIDTextWatermarkLogitsProcessor, configured through SynthIDTextWatermarkingConfig with a list of watermarking keys and an n-gram length, and passed straight into model.generate(). The documented implementation also handles repeated contexts, skipping the watermark where a context has already been seen so that naturalness is preserved.
If you serve your own weights and want a watermark that is maintained by a large vendor rather than by you, this is the shortest path from decision to deployment.
lm-watermarking (Kirchenbauer et al. reference implementation)
The authors of the original red-green paper publish lm-watermarking, the official implementation of both that paper and its ICLR 2024 follow-up. It exposes WatermarkBase, WatermarkLogitsProcessor and WatermarkDetector, works with any Hugging Face model through the standard generate API, and ships an interactive demo you can run locally.
This is the right choice when you need to inspect and tune the mechanism rather than adopt someone else’s parameter choices, and it is the implementation most published follow-up work is measured against.
MarkLLM (evaluation toolkit)
MarkLLM is an open-source toolkit that exists because the field now has more watermarking algorithms than any team can evaluate by hand. It provides a unified framework for implementing schemes behind a common interface, automatic visualization of what each algorithm is doing to the token stream, and, per the paper, twelve evaluation tools spanning three perspectives plus two automated evaluation pipelines.
Use it for the selection decision. Running your own text through several schemes under one harness is a far better basis for a choice than comparing vendor claims written to different definitions of “detection accuracy”.
The robustness question, honestly
The standard objection to text watermarking is that an adversary can paraphrase the output away. The most careful published answer is the Kirchenbauer group’s follow-up, On the Reliability of Watermarks for Large Language Models. Their finding is that watermarks weaken under paraphrasing but do not vanish: paraphrased text tends to leak n-grams or longer fragments of the original, and the watermark “is detectable after observing 800 tokens on average” after strong human paraphrasing at a 1e-5 false positive rate.
Read that as a scope statement rather than a reassurance. Text watermarking is credible over long passages and weak over short ones, which makes it a real audit and compliance instrument and a poor gate on any single message.
Image and Media Watermarking
C2PA / Content Credentials
The Coalition for Content Provenance and Authenticity standard is the industry route to media provenance, surfaced to end users as Content Credentials and backed by more than 500 organizations including Adobe, Microsoft, Google, OpenAI, Meta, Amazon, Intel, Sony, Truepic and the BBC.
The technical specification defines a manifest built from three parts: assertions (labelled statements about the asset, including actions taken and content bindings), a claim that references a set of assertions and is encoded as signed CBOR, and a claim signature made with the signer’s private key. Verification is cryptographic, so a manifest either validates against the asset or it does not.
The limitation is written into the spec itself, which acknowledges that “an asset can become separated from its C2PA Manifest due to removal or corruption of asset metadata”. Its own answer to that is soft bindings: a fingerprint or invisible watermark used to look the asset up and recover an intact manifest. Treat C2PA as chain of custody for controlled workflows, and expect to pair it with a pixel-level mark if the content will travel through platforms that strip metadata.
To implement it, the Content Authenticity Initiative publishes c2pa-python, which reads and validates manifest data from supported formats and creates, signs and attaches new manifests.
Stable Signature (Meta Research)
The Stable Signature takes the opposite approach to C2PA: rather than attaching a manifest, it roots the watermark in the generator. The method fine-tunes the latent decoder of a latent diffusion model conditioned on a binary signature, so every image the model produces carries the mark; a pre-trained extractor recovers the signature and a statistical test decides whether the image came from that model.
The headline robustness result reported in the paper is that it detects the origin of an image generated from a text prompt and then cropped to keep 10% of the content, “with 90+% accuracy at a false positive rate below 10^-6”. That is a result from the authors’ own evaluation, not an independent one, and it is the figure to quote rather than any rounder number.
For an operator generating images at scale who wants a mark that survives the manifest-stripping problem, this is the most credible published design. Adversarial ML covers the adversarial-robustness literature that surrounds it.
IMATAG
IMATAG is a commercial invisible watermarking vendor for images and video, selling three products: Leaks (identifying the source of leaked visual content), Monitor (tracking copies of your content online) and Authenticity (proving origin and provenance). Its watermark is described as inserting “hidden identifiers into your visual content”, with recognition claimed for content “even altered by geometry, cropping, size, compression”.
Those are vendor claims and should be treated as such, but the product line has years of production use in stock photography and press distribution behind it, which research implementations do not have. Pricing is quote-based, so it fits organizations already generating or distributing content at volume.
Model Fingerprinting
Radioactive Data
Radioactive data marks the training set rather than the model or the output. The technique makes imperceptible changes to a dataset such that, as the authors put it, “any model trained on it will bear an identifiable mark”. The paper reports detection with high confidence (p below 10^-4) even when only 1% of the training data is radioactive, and reports robustness to data augmentation and to variability in network training.
The use case is licensing enforcement for dataset owners who want to detect unauthorized use of their data in someone else’s model. It is not a deployment-security control, and it does nothing about the content your own systems generate.
EmbMarker
EmbMarker targets embedding-as-a-service specifically. It is a backdoor-based watermark: the method selects a group of moderate-frequency words as triggers and inserts a target embedding into texts containing them, weighted by trigger frequency, so a model distilled from the service inherits the mark while ordinary utility is preserved.
If your primary asset is an embedding model exposed through an API, this is the relevant technique. For the wider picture of attacks against model supply chains, ML CVEs tracks that research area.
What to Actually Deploy
For most teams, the decision tree is:
-
Images generated at scale (marketing, content): Attach C2PA manifests with c2pa-python for internal chain of custody. Add a pixel-level mark, Stable Signature if you control the generator or IMATAG if you do not, for anything that will be redistributed through platforms that strip metadata.
-
Text at scale: If you serve your own weights, SynthID-Text through Transformers is the shortest path, with lm-watermarking as the option when you need to control the mechanism. If you consume a third-party API, you are limited to whatever that provider marks, so make it a procurement question and get the answer in writing.
-
Regulated contexts (medical, legal, financial): Layer provenance manifests, an invisible mark and audit logging. No single tool satisfies Article 50 on its own, and the Article’s own wording ties the requirement to what is technically feasible, which means documenting your choice matters as much as making it. For the broader data protection picture, our AI privacy and data security tools review covers PII scrubbing, runtime protection, and API provider evaluation for regulated deployments.
-
Model owners protecting IP: Radioactive data for training sets, EmbMarker if the asset is an embedding model.
The honest takeaway: text watermarking is real but statistical, and its confidence is a function of how much text you get to look at. The value is in audit trails and regulatory compliance, not in stopping a determined adversary. Treat it as one layer in a provenance and governance stack rather than as a technical control that prevents anything.
For ongoing tracking of regulatory requirements around watermarking and synthetic content disclosure, AI Privacy Report and Neural Watch both cover this area.
Related across the network
- Deepfake Detection Tools Review: How Platforms Perform in 2026 — aiincidents.org
