Hidden AI-Content Markers Across Artefact Types: Watermarks, Provenance, and Regulation (August 2026)

TL;DR

• The field has bifurcated into two incompatible technical families: (1) invisible, signal-level watermarks embedded in the artefact itself (Google DeepMind SynthID for images/audio/video/text; Anthropic’s new SynthID-Text-based text watermark) and (2) C2PA Content Credentials — cryptographically signed, but strippable, metadata manifests. Neither is universal, both are defeatable, and vendor schemes are proprietary and mutually non-verifiable.
• Text is the weakest link and the fastest-moving story: For years no major LLM watermarked prose in production except Google Gemini (SynthID-Text). That changed on 2 August 2026, when the EU AI Act Article 50 marking obligation took effect and Anthropic began rolling out a SynthID-Text-style watermark to Claude worldwide. OpenAI still does not watermark ChatGPT text; the “invisible Unicode” seen in GPT outputs is most likely a training artefact, not a deliberate watermark.
• Regulation now mandates marking in the EU, China, and South Korea, but the US federal government has retreated (EO 14110 revoked). Laws mandate “machine-readable marking” and detectability but are largely technology-neutral; none yet compels a specific C2PA-vs-watermark scheme, and all rely heavily on self-reported vendor compliance because third-party detection is unreliable.

Key Findings

Text (LLM outputs)

• Google Gemini (SynthID-Text) is the first and, until August 2026, the only production text watermark at consumer scale, running in the Gemini app/web since 2024 and open-sourced (Nature, Oct 2024; Hugging Face Transformers ≥4.46.0). It uses “tournament sampling” — a keyed logit-biasing scheme in the Red-Green watermark family.
• Anthropic Claude began embedding an invisible text watermark on 2 August 2026, confirmed as a SynthID-Text variant, applied globally (not just the EU), across Claude API, Claude Code, AWS Bedrock, Google Cloud, and Microsoft Foundry. Coverage is model-gated: models launched on/after 2 Aug 2026 support marking at launch; earlier models are being retrofitted.
• OpenAI does NOT watermark text. It built a ~99.9%-accurate scheme (reported by WSJ, Aug 2024) but shelved it, citing circumvention risk, false-positive harm to non-native English speakers, and user attrition. Per the WSJ (Deepa Seetharaman, 4 Aug 2024), an April 2023 OpenAI user survey found “nearly 30% [of surveyed ChatGPT users] said they would use ChatGPT less if it deployed watermarks and a rival didn’t,” and 69% believed detection tech “would lead to false accusations.” xAI Grok has not signed the EU Code and has no known text watermark. Meta Llama, Mistral, and DeepSeek have no known production text watermarking.
• Robustness is poor. All these schemes are in the Red-Green family and degrade sharply under paraphrasing, translation, and heavy editing. Academic work (ETH Zürich SRI Lab; multiple arXiv papers) shows SynthID-Text is detectable via black-box queries, is scrubbable by naive adversaries, and that spoofing/stealing attacks (recursive paraphrasing, DIPPER, model-distillation, mixed-integer green-list recovery) work.
• Hidden Unicode steganography: Newer OpenAI models (o3/o4-mini, GPT-4o/GPT-5) emit invisible/ambiguous Unicode — Narrow No-Break Space (U+202F), zero-width space (U+200B), em spaces, em dashes. Forensic consensus (and OpenAI) attribute these to RL/training artefacts from high-quality typeset training data, not intentional watermarks; they are trivially removed with find-and-replace. Zero-width-character steganography (ZWSP/ZWNJ/ZWJ binary encoding) is a real proposed technique but not a confirmed production LLM watermark.

Images

• C2PA Content Credentials = an open standard (now v2.x) attaching a cryptographically signed manifest (claims → assertions, signed via COSE with X.509 certs, packaged in a JUMBF container, hard-bound to content via SHA-256 hashes). It proves tamper-evidence and origin claims, NOT truthfulness. It is strippable by screenshots, re-encoding, and social-media upload.
• SynthID (images) = an invisible pixel-level watermark embedded during diffusion in latent space via paired embedder/detector neural nets, distributed redundantly across frequency bands. Robust to mild JPEG, resize, minor crop, color adjustment (detection typically drops 10–25 points but survives); defeated by severe cropping, heavy compression, or crop-and-resize (which flips ~half the latent sign pattern per arXiv 2509.10577).
• Vendor approaches: Google (Imagen) = SynthID + C2PA; OpenAI (DALL-E 3/GPT image) = C2PA + SynthID; Adobe Firefly = C2PA Content Credentials (founding member); Amazon Titan = invisible watermark + C2PA; Meta = IPTC Digital Source Type + C2PA reading + classifiers + visible marks on photorealistic images; Midjourney = no C2PA, no known invisible watermark as of V8; Stable Diffusion/FLUX = varies. IPTC Photo Metadata 2025.1 (ratified Nov 2025) added four XMP fields for AI content; Google Merchant Center requires the IPTC DigitalSourceTypeTrainedAlgorithmicMedia tag. LumethicNumonic
• Durable Content Credentials now pair C2PA with a soft binding (SynthID watermark + perceptual fingerprint) so a stripped manifest can be recovered — mitigating but not eliminating stripping.

Video

• OpenAI Sora 2: visible moving watermark on app downloads + C2PA metadata. Independent testing (LessWrong/EA Forum) found C2PA was applied inconsistently — only present on Pro-tier no-visible-watermark downloads, absent on standard visibly-watermarked exports. Sora consumer app discontinued 26 Apr 2026; API sunset ~24 Sep 2026.
• Google Veo (and Gemini image/video): mandatory SynthID across all frames, not disableable via API.
• Runway/Kling/HeyGen and others vary; visible watermarks common on free tiers; robust invisible provenance inconsistent. Watermark-removal-as-a-service sites proliferate.

Documents / PDFs

• Microsoft 365 Copilot / Word: A document property labeled “Intelligence data from AI assisted features” genuinely appears when Copilot/Editor contributes. Critically, Microsoft has NOT published the exact OOXML field name, XML part, or path — even senior Word community experts in Microsoft’s own Q&A forum could not locate it. The authoritative-sounding “Microsoft adds this property for transparency and compliance” statement is from a Microsoft Q&A forum moderator (“Microsoft External Staff”), not from Microsoft Learn spec documentation. Likely candidate locations (unverified) are docProps/custom.xml, docProps/app.xml, or the newer docMetadata/ part (Microsoft already uses docMetadata/LabelInfo.xml for sensitivity labels per [MS-OI29500]). Microsoft LearnMicrosoft Learn
• Google Docs/Gemini: No documented AI-identifying metadata embedded in exported .docx/PDF text.
• Adobe Acrobat AI Assistant / ChatGPT PDFs: No official documentation confirms embedded AI-authorship metadata or C2PA manifests on generated text/PDFs; C2PA/SynthID provenance from OpenAI and Adobe is documented for images only. PDF Producer/Creator XMP fields may incidentally reveal the generating library but are not purpose-built AI flags.
• No documented hidden tracking GUIDs deliberately embedded for AI authorship. Standard OOXML GUIDs/rsids are pre-existing, non-AI features. The python-docx maintainer community stated (Mar 2026) that “the DOCX format carries no metadata about AI generation, trust level, or source provenance.” GitHub

Web pages / HTML

• No ratified standard. Multiple competing proposals: a WICG/WHATWG proposal for a <meta name="ai-disclosure"> tag and element-level ai-disclosure attribute (values: none/ai-assisted/ai-generated/autonomous), aligned to the IETF AI-Disclosure HTTP header and IPTC Digital Source Type vocabulary. C2PA does not cover HTML text. Separately, noai/noimageai robots meta directives and TDMRep (W3C) address training opt-out, not generation disclosure — adoption largely symbolic.

Cross-cutting: interoperability & standards

• Not uniform. Two non-interoperable families (signal watermarks vs C2PA metadata), plus vendor-specific keys. SynthID detection requires Google’s key; Claude’s watermark requires Anthropic’s; they cannot verify each other. As Andrew Jenks (Microsoft’s director of media provenance and executive chair of the C2PA) told IEEE Spectrum, the SynthID-Text work “holds promise for improving the use of durable content credentials from C2PA for documents and raw text” — i.e., the two families are seen as complementary, not yet unified.
• C2PA steering committee: Adobe, Amazon, BBC, Google, Intel, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, Truepic. Joined dates: Google (Feb 2024), OpenAI (May 2024), Meta (Sep 2024), Amazon (Sep 2024). The Content Authenticity Initiative (Adobe-led) has thousands of members.
• Detectability by third parties: Largely NO. Text watermarks need the vendor’s secret key (no public Gemini/Claude checker). SynthID image/audio detection is a Google black box returning binary results. C2PA is publicly verifiable but only when the manifest survives. Compliance is therefore effectively self-reported.

Legislation & regulation

• EU AI Act Article 50: Transparency obligations apply from 2 August 2026. Providers must mark synthetic content in a “machine-readable format” and make it “detectable as artificially generated or manipulated”; deployers must label deepfakes and disclose chatbots. Grace period to 2 December 2026 for systems already on the market. Technology-neutral (watermarks, metadata, or fingerprints acceptable); a voluntary Code of Practice on Transparency of AI-generated Content supports compliance — per the European Commission, “by the end of July 2026, about 190 companies [and] organisations have signed the code,” with Section 1 signatories including “Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, Open AI, Synthesia” (about half small/recent companies). Under Article 99(4), Article 50 breaches carry fines “up to EUR 15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher” (the lower figure applying to SMEs/start-ups). Commission final guidelines published 20 July 2026.
• China: Measures for Labeling AI-Generated Content + mandatory standard GB 45438-2025, in force 1 September 2025 (CAC/MIIT/MPS/NRTA). Requires BOTH explicit visible labels (“AI生成”) AND implicit labels (metadata watermarks in file headers, provider name, content ID). Applies extraterritorially. Builds on 2023 Deep Synthesis Provisions.
• US federal: Retreat. Biden’s EO 14110 (Oct 2023) — which defined watermarking and directed NIST/AISI on synthetic-content provenance (NIST AI 100-4) — was revoked 20 Jan 2025 by Trump (EO 14179). No federal mandate; NIST guidance survives as voluntary.
• US states — California: SB 942 (California AI Transparency Act, 2024), amended by AB 853 (Oct 2025), operative 2 August 2026 (deliberately aligned with EU). Requires large GenAI providers (>1M monthly users) to offer a free AI-detection tool, embed latent (invisible) provenance disclosures, and visible manifest disclosures; extends duties to hosting platforms (2027) and capture-device manufacturers (latent provenance by default, 2028). Civil penalty $5,000/violation/day. AB 3211 (a stricter watermarking bill) did not become law. SB 53 (frontier transparency) signed Sep 2025.
• South Korea: AI Basic Act (Framework Act), in force 22 January 2026 — billed as first fully-enforced national AI law. Generative AI output must carry disclosure; realistic deepfakes need visible labels, other synthetic output invisible watermarks. Fines up to ₩30M; ~1-year enforcement grace (real penalties ~Jan 2027).
• Others: India IT Rules amendment (effective 20 Feb 2026) requires platforms to label AI content and carry traceable metadata. UK has no bespoke mandate (relies on existing regimes). Japan favors soft/voluntary guidance.
• Mandate type: All these laws require marking/detectability but are largely technology-neutral; none yet compels C2PA specifically. EU’s Code of Practice recommends combining metadata with imperceptible watermarking precisely because metadata is strippable.

Limitations, circumvention, criticism

• Text: paraphrasing, translation, synonym substitution, emoji-insertion, and model distillation all remove or spoof Red-Green watermarks; black-box stealing recovers green lists.
• Images/video: screenshots and social-media re-encoding strip C2PA on major platforms. Imatag’s “State of image metadata in 2018” report found that across “over 40 million images published online (not including social media or image databases),” only 15% still contained metadata (~85% stripped); analyses put the figure at effectively 100% for major social platforms in 2026. Crop-and-resize defeats pixel watermarks; commercial C2PA/watermark strippers exist.
• Fundamental theory: Christ et al. prove undetectable watermarks require cryptographic secrecy; no watermark is secure against a determined white-box adversary. C2PA also cannot prove truth (a real camera can sign a photo of a fake). arxiv

Details

1. Text watermarking — the state of play

The dominant academic technique is the Kirchenbauer et al. (2023, University of Maryland) “green-list/red-list” scheme: at each generation step a hash of prior tokens pseudo-randomly partitions the vocabulary into a “green” list, and a logit bias nudges sampling toward green tokens. A detector holding the key runs a statistical test (z-score / low p-value) over token-color frequencies. Aaronson’s 2022 OpenAI prototype used a related cryptographic-sampling approach.

Google DeepMind SynthID-Text generalizes this with “tournament sampling,” effectively a variable logit bias, but ETH Zürich’s SRI Lab showed it still belongs to the Red-Green family (median p-value 0.000 detectable via the Red-Green test on Gemma-7B). Per the Nature paper (Dathathri et al., “Scalable watermarking for identifying large language model outputs,” 23 Oct 2024), the team “conducted a live experiment that assessed feedback from nearly 20 million Gemini responses,” analysing watermarked and unwatermarked outputs and finding the quality difference negligible; the abstract states “standard benchmarks and human side-by-side ratings indicate no change in LLM capabilities,” and DeepMind VP Pushmeet Kohli said the scheme “doesn’t compromise the quality, accuracy, creativity, or speed of the text generation” (MIT Technology Review, 23 Oct 2024). It is open-sourced for developers but production detection is gated to Google. arxiv

Anthropic Claude: Anthropic’s Aug 2026 disclosures confirm a SynthID-Text-based statistical word-choice watermark that adds no tokens, no hidden characters, carries no identifying info, and travels through copy-paste. Anthropic is candid about limits: a mark means “likelihood this was partly written by Claude,” cannot prove human authorship, cannot identify other AIs, and cannot distinguish authored-vs-edited. This was driven by the EU AI Act and the Code of Practice, though applied worldwide.

OpenAI’s non-deployment is the most consequential negative fact: the largest LLM vendor deliberately does not watermark text, so any compliance model assuming durable text watermarks on arbitrary AI output is broken.

2–3. Images and video — provenance architecture

C2PA’s trust model rests on the signer’s identity (X.509 cert validated against the C2PA Trust List). A manifest’s claim binds assertions (origin, edits, c2pa.actions, AI use via digitalSourceType: trainedAlgorithmicMedia) with hard bindings (content hashes) so any post-signing pixel change fails validation. Verification is offline (certs travel in the manifest). Its Achilles heel is distribution: platforms recompress and strip manifests. Durable Content Credentials (soft binding via SynthID + perceptual hash to a manifest repository) are the ecosystem’s answer.

SynthID’s image variant integrates into the diffusion denoising process, modifying latent dimensions chosen by a trained network below perceptual thresholds, with error-correction-style redundancy across frequency bands. It survives the standard distribution chain far better than metadata but is not adversarially robust.

For video, the pattern repeats: Google Veo = SynthID on all frames (mandatory); OpenAI Sora = visible mark + inconsistent C2PA. Visible watermarks are the only signal most consumers actually see, and they are the easiest to crop/mask.

4–5. Documents and web — the coverage gap

Documents and HTML text are the least-covered artefact types. AI-generated prose inside a Word doc, Google Doc, or PDF generally carries no robust, standardized, machine-readable AI-authorship marker. Microsoft’s “Intelligence data from AI assisted features” property is the closest thing in production, but it is undocumented at the spec level and is an audit hint, not a cryptographic provenance signal. C2PA v2.x can technically wrap PDFs, but real deployment is image/video/audio-centric.

Recommendations

1. Do not rely on hidden watermarks or metadata for detection or policy enforcement. Treat absence of a mark as inconclusive, never as proof of human authorship. For your own DevSecOps pipelines, assume adversaries can strip C2PA (screenshot/re-encode) and scrub text watermarks (paraphrase/translate).
2. For provenance you control, adopt C2PA/Content Credentials plus a durable soft binding (SynthID-style watermark + fingerprint) so a stripped manifest is recoverable. Preserve manifests through your own asset pipelines (many CDNs/CMS processors strip them by default) and validate against the C2PA Trust List offline.
3. For compliance, map obligations by jurisdiction and date: EU Article 50 (2 Aug 2026; grace to 2 Dec 2026 for legacy systems), California SB 942/AB 853 (2 Aug 2026), China GB 45438-2025 (live), South Korea (live, penalties ~Jan 2027), India (20 Feb 2026). If you deploy generative AI in the EU/California, implement machine-readable marking now and add chatbot/deepfake disclosures. If serving China, implement both visible and implicit labels.
4. Vendor due diligence: In procurement, require vendors to state exactly which signals they emit (C2PA? SynthID? visible only? none?), on which tiers/export paths, and whether detection is publicly verifiable. Note that OpenAI text, Grok, Midjourney, and most open-weight models emit no robust invisible provenance.
5. Benchmarks that would change these recommendations: (a) a cross-vendor, publicly verifiable text-watermark detector emerging; (b) major platforms committing to preserve (not strip) C2PA manifests end-to-end; (c) an adversarially robust watermark surviving crop-and-resize and paraphrase in peer-reviewed evaluation; (d) EU standardization work turning the voluntary Code of Practice into a hard technical standard. Until then, treat all marks as advisory.

Caveats

• Fast-moving area: The Anthropic text-watermark rollout, EU Article 50, and California SB 942 all landed within days of each other around 2 August 2026; model-by-model coverage tables are not yet published and some claims (e.g., “every Claude output is watermarked”) overstate the sources.
• Vendor self-reporting: Most robustness figures for SynthID come from Google or from SEO-driven “watermark remover” sites of uneven reliability; treat specific percentages as indicative, not audited. Google’s detectors are black boxes.
• Undocumented internals: The exact OOXML storage of Microsoft’s AI-assisted property, and the precise algorithms behind Claude’s and OpenAI’s (shelved) text watermarks, are not publicly specified.
• Unicode ≠ watermark: The invisible-Unicode-in-ChatGPT phenomenon is widely misreported as intentional watermarking; current forensic consensus is training artefact.