What a watermark can survive

Two kinds, and only one is interesting

Visible watermarks — a logo, a label burned into the corner. Honest, immediately informative, and removed by a crop.

Invisible watermarks embed a signal into the content itself, distributed across the image or audio in a way designed to survive handling. The best-known implementations from large labs mark generated images, audio, video and text, and provide a detector that reads the mark back.

The interesting question about any of these is not whether they work, but what they survive.

Where the signal is put

For images, a watermark is embedded in a representation robust to common operations — frequency components rather than raw pixels, or, in the strongest designs, applied during generation itself so it is woven through the content rather than added afterwards.

Typical published claims: survives JPEG compression, resizing, cropping, colour adjustment, moderate filtering, and screenshots. This is genuinely impressive engineering and it covers the ordinary path an image takes through the world.

For audio, the mark is placed in a perceptually masked part of the spectrum and survives compression and re-encoding. For text, the mark is a statistical bias in token selection, which survives light editing and disappears under paraphrase.

What removes it

Being honest about the limits, because vendors state the robustness and rarely state the ceiling:

• Heavy transformation. Strong crops, large rotations, aggressive re-compression, significant resizing.
• Regeneration. Passing the image through another generative model — an image-to-image pass at moderate strength, or an upscaler — substantially disrupts embedded signals. Published research has demonstrated this against several watermarking schemes.
• Deliberate attack. There is an active literature on watermark removal, and it works.
• Not being there. The decisive one. Open-weight models run locally produce no watermark at all, and anyone intending to deceive will use one.

What it is for, then

That last point makes the whole thing sound pointless, and it is not. The right way to think about a watermark is as a record of compliant generation, not a barrier to malicious generation.

Its real uses:

Platform labelling at scale. A platform can detect the mark and label the post automatically, which handles the enormous volume of ordinary, non-malicious generated content that nobody would otherwise label.

Keeping training data clean. Model developers use it to avoid training on their own output, which matters more than it sounds — a corpus increasingly filled with generated material degrades the next generation of models, and marking is the only practical way to filter it.

Internal accountability. An organisation can tell whether an asset came from its own approved pipeline.

Establishing intent. Removing a watermark is a deliberate act, and in some jurisdictions is itself becoming an offence. A stripped mark is evidence of something.

None of those is "proving an image is fake", and a vendor who implies otherwise is overselling.

The absence problem, stated clearly

The most important property of every watermarking scheme: the absence of a watermark proves nothing. Most images in the world are unmarked, including nearly all real photographs and all output from open models.

So a watermark detector can say "this came from that system" with reasonable confidence and can never say "this is real". This asymmetry is the whole design, and it means watermarking and provenance are complements rather than alternatives: one marks generated content where the generator cooperates, the other attests to captured content where the camera cooperates.

There is a practical point for anyone publishing generated work. If your tool embeds a mark, leave it in. Removing it gains you nothing legitimate, and in an increasing number of places it is becoming an offence in its own right, quite separate from anything about the content. If you are asked by a client to strip one, that request is worth a conversation rather than a keystroke, because the only reason to want it gone is to make the origin harder to establish.

The unsettled part: whether marking should be mandatory. Several jurisdictions are legislating in that direction, which the final module covers. The case for is that it makes automatic labelling possible at scale. The case against is that a mandate binds only compliant actors while imposing a cost on everyone, and that a mark identifying which system produced a file is itself a privacy consideration for people who make things they do not want traced. Both arguments are serious.