Learn · Beginner

Content provenance and watermarking: how you tell whether a machine made it

Content provenance and watermarking are the two engineering answers to the question "did a machine make this?" Provenance attaches a signed manifest to a file recording what created it and what was done to it since; watermarking hides a detectable statistical signature inside the content itself. They fail in opposite ways - a provenance manifest is rich and verifiable but gets stripped the moment someone screenshots the image, while a watermark survives the screenshot but carries almost no information and erodes under heavy editing. Most serious deployments now ship both, because neither is sufficient alone.

This stopped being a research topic and became a compliance topic. California's AI transparency law is the first US statute of its kind actually in force, and the European Union's AI Act transparency rules point in the same direction. If you build anything that generates media, this is now infrastructure you have to understand.

Provenance: a receipt stapled to the file

The dominant provenance standard is C2PA, built by the Coalition for Content Provenance and Authenticity - a group that includes Adobe, Microsoft, the BBC, Sony and Google, and whose adoption arm is the Content Authenticity Initiative. The idea is deliberately boring: when a tool creates or edits a file, it writes a small record - who made it, with what software, from what source, at what time - and signs that record with a cryptographic key tied to a certificate. The record rides along inside the file's metadata as a "manifest."

Think of it as the chain-of-custody form attached to a piece of evidence. Each handler signs their own line. A viewer can later check every signature and see that Camera Corp signed the capture, that a named photo editor signed a crop, and that nothing between those steps was altered, because altering the content breaks the hash the signature covers.

The strength is expressiveness. A manifest can say "generated entirely by an AI model," or "photographed by a real camera and then colour-corrected" - distinctions a hidden watermark cannot express. The weakness is brutal and well understood by its own designers: metadata is not glued on. Screenshot the image, upload it to a platform that re-encodes it, or paste it into a document, and the manifest is simply gone. C2PA does not claim to survive that. Its promise is that a present manifest is trustworthy, not that an absent one means anything.

Watermarking: a signature woven into the content

Watermarking takes the opposite bet. Rather than attaching a record, it perturbs the content so that a matching detector can recognise it later.

For text, the canonical method comes from "A Watermark for Large Language Models" by John Kirchenbauer and colleagues at the University of Maryland. Recall that a language model produces a probability over every possible next token and then samples from it. The watermark uses the preceding tokens to seed a pseudorandom generator that secretly splits the vocabulary into a "green list" and a "red list," then nudges the model to prefer green tokens. Any single word choice looks unremarkable. But across a few hundred words, watermarked text lands on green tokens far more often than chance allows, and a detector holding the same secret key can measure that excess and put a statistical confidence on it. Google DeepMind's production version of this idea, SynthID-Text, was described in Nature in 2024 by Sumanth Dathathri and colleagues, who reported that it was deployed to live Gemini traffic and that in a nearly 20-million-response comparison users rated watermarked and unwatermarked answers about equally useful - the practical bar this method had to clear.

For images, the equivalent embeds a pattern across the whole picture rather than in any one pixel, so it survives resizing, cropping, compression and screenshotting. Google's SynthID covers images, audio and video on this principle.

The honest limits: text watermarks are defeated by thorough paraphrasing, weak on short passages, and inapplicable to open-weight models, where anyone can simply run the model without the watermarking step. Image watermarks degrade under determined re-rendering.

Why the absence of a mark proves nothing

The single most important thing to internalise: both techniques are one-directional. A valid manifest or a detected watermark is real evidence something was machine-made. Their absence is evidence of nothing at all - the file may be genuine, or it may be from a model that never marked its output.

This is also why you should be sceptical of general "AI detectors" that take arbitrary text and score its AI-ness with no planted watermark. Those tools rely on surface statistics like perplexity and have documented false-positive problems, notably against people writing in a second language. A watermark detector is a fundamentally different instrument: it checks for a specific signal a specific model deliberately planted, using a key. Do not confuse the two.

The realistic goal is not catching a sophisticated forger. It is raising the floor - making the cheap, high-volume, casual case detectable, so that the effort required to pass synthetic media off as real is no longer zero. That is a modest aim, and it is achievable. Claims beyond it should be treated with suspicion.

Ground Truth. (2026, August 5). Content provenance and watermarking: how you tell whether a machine made it. Ground Truth. https://groundtruth.day/learn/content-provenance-and-watermarking.html

@misc{groundtruth:content-provenance-and-watermarking,
  title  = {Content provenance and watermarking: how you tell whether a machine made it},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/learn/content-provenance-and-watermarking.html}
}

Topics: provenance · watermarking · c2pa · synthetic-media · ai-safety · policy · deepfakes