AI Watermarking

AI watermarking encompasses a range of techniques for embedding imperceptible or detectable signals into content generated by artificial intelligence systems. The signals allow downstream tools, platforms, and users to determine whether a given image, audio clip, video, or text was produced by an AI system, and in some implementations to identify the specific model or organisation responsible. AI watermarking has become a priority for technology companies, governments, and standards bodies as AI-generated synthetic media has grown pervasive enough to challenge trust in digital content at scale.

Motivation

Generative AI systems capable of producing photorealistic images, convincing deepfake videos, synthetic voices, and coherent long-form text have made it increasingly difficult to distinguish authentic human-created content from AI-generated output. This creates risks across several domains: political disinformation campaigns using synthetic media, academic fraud through AI-written submissions, financial scams using voice cloning, and non-consensual synthetic imagery. Watermarking offers a technical mechanism to assert the origin of content without requiring forensic analysis, enabling platforms, journalists, and regulators to verify provenance at scale.

Technical Approaches

AI watermarking is not a single technique but a family of approaches that differ in where the signal is embedded, how robust it is to common transformations, and whether it is visible to the human eye.

Imperceptible pixel-level watermarks embed a signal directly into the pixels of an image in a way that is statistically detectable by a trained classifier but invisible to human observers. Google's SynthID technology, originally developed for Imagen and later applied to Gemini, encodes a distributed pattern across pixel values that survives common transformations such as JPEG compression, resizing, cropping, and colour adjustment. Detection does not require access to the original unwatermarked image.

Cryptographic metadata and C2PA is an approach based on the Coalition for Content Provenance and Authenticity (C2PA) open standard, co-developed by Adobe, Microsoft, Sony, the BBC, and others. A C2PA manifest is a cryptographically signed record of the content's creation history — including which model generated it, at what time, and with what inputs — that is embedded in the file's metadata. Detection tools read and verify the manifest against its signature. C2PA credentials are attached to images from Adobe Firefly, OpenAI's DALL-E 3 and Sora, and metadata from Leica and Nikon cameras, creating provenance chains that extend across both AI-generated and human-captured content.

Latent-space and model-level watermarks are techniques applied within a generative model itself rather than to its output. By constraining the model's sampling distribution in a structured way during training, developers can cause all outputs to exhibit a subtle statistical signature detectable with knowledge of a secret key, without affecting perceived quality. These approaches are resilient to post-hoc metadata stripping because the watermark is intrinsic to the generation process.

Text watermarking for large language models is an emerging area. One approach biases the model's token selection using a cryptographic key — certain tokens are probabilistically preferred over semantically equivalent alternatives, creating a detectable signal across a passage of text. A detector knowing the key can identify watermarked text with high confidence even after rephrasing, while the watermark is imperceptible to a human reader.

Limitations

No watermarking system is unconditionally robust. C2PA metadata can be stripped by saving an image through a non-conformant tool or applying a screenshot. Pixel-level watermarks can be degraded or destroyed by aggressive cropping, adversarial perturbations, or image-to-image translation. Text watermarks can be defeated by rewording. The EU AI Act (2024) mandates transparency labelling for AI-generated content but acknowledges that technical watermarks are a complement to, rather than a replacement for, regulatory obligations and platform-level moderation.

Industry and Regulatory Developments

In 2024, OpenAI began adding C2PA Content Credentials to DALL-E 3 outputs and announced a partnership with Google to integrate SynthID watermarks into certain OpenAI image products. Adobe's Content Authenticity Initiative (CAI) has built C2PA support into Photoshop and Firefly. The US executive order on AI (2023) directed NIST to develop standards for watermarking and content authentication. The EU AI Act requires that AI systems generating synthetic content include mechanisms enabling detection and disclosure.

Malaysia has seen increasing public concern about AI-generated synthetic media used in scams, political disinformation, and non-consensual deepfake imagery. The National Cyber Security Agency (NACSA) under the National Security Council has identified synthetic media as a category of threat in its cybersecurity advisories and has worked with the Malaysian Communications and Multimedia Commission (MCMC) on guidance for platforms operating in Malaysia.

The MCMC Act and the Penal Code have been applied to cases involving digitally manipulated imagery and synthetic audio used to defraud or defame, but enforcement relies on post-hoc forensic analysis rather than automated watermark detection. The absence of a national content provenance infrastructure means that detection of AI-generated disinformation depends on platform-level tools — primarily those provided by Meta, Google, and TikTok — whose C2PA or watermark implementations vary in completeness.

Bernama, the national news agency, and mainstream media groups including Media Prima and Star Media have begun assessing AI content detection tools as part of their editorial verification workflows. The use of C2PA-aware tools such as Adobe's Content Authenticity verify browser extension is expanding in Malaysian newsrooms. Astro, which operates Malaysia's dominant pay-TV and streaming platform, has identified synthetic voice and face generation as a content integrity risk in its anti-piracy and brand protection strategies.

MDEC's AI initiatives under the Malaysia Digital framework include digital trust and content integrity as priority themes. Malaysian AI startups and several cybersecurity firms under NACSA's CREST Malaysia programme have begun offering AI-generated content detection services to enterprise and government clients. As Malaysia advances its AI governance through the Malaysia AI Governance Framework, alignment with international standards including C2PA and ISO/IEC 42001 is expected to become a procurement and compliance requirement for public-sector AI deployments.

See Also

1. OpenAI. (2024). Advancing Content Provenance for a Safer, More Transparent AI Ecosystem. openai.com.
2. C2PA Technical Specification. (2024). Coalition for Content Provenance and Authenticity. c2pa.org.
3. Fernandez, P., et al. (2024). SynthID-Image: Image Watermarking at Internet Scale. arXiv:2510.09263.
4. NIST. (2024). AI 100-4: Reducing Risks Posed by Synthetic Content. National Institute of Standards and Technology.