Two mechanisms people confuse

Two very different mechanisms are called a “watermark”, and that confusion comes at a price. The first declares the origin of a file in its metadata, like a label stuck on it. The second quietly alters the content itself, like a texture woven into the cloth. A file can carry one, the other, both, or neither.

This chapter fabricates the second mechanism before your eyes, in a text and then in an image, because it can be calculated. The first cannot be calculated: it is declared, or it is not. Then comes the comparison of the two, with what each survives and what neither of them replaces.

A green-list watermark, placed on a text

At every word it generates, this site’s toy model works out a list of possible candidates. A secret key, combined with the preceding word, marks one half of that list as green. The draw is then nudged slightly towards that half. Set the key and the strength of that nudge, then generate a text: each word produced appears with the label the key gives it at that moment.

The text above can be measured with the same key, and so can any other text: paste one in, or change the one that has just appeared, then measure. The result is never watermarked or not watermarked: it is a proportion, to be compared with what it would be without a watermark.

A watermark in the least significant bits of an image

A digital image is a grid of numbers, one per colour channel and per pixel, from zero to two hundred and fifty-five. Changing the least significant bit of just one of those numbers alters its value by at most one: nothing anyone can see. This demonstration draws an image, hides a message in exactly those bits, finds it again, then lets you destroy it.

Now choose an everyday operation, one of those that sending by messaging app or sharing on a network applies all by itself, and see whether the message survives.

The method

The green-list watermark, step by step

1. For the current word, obtain the list of possible candidates and their probability, exactly as in the chapter the next word.
2. Combine the secret key with the immediately preceding word, then draw from that a number between zero and one through a hash function. Below one half, the candidate is green; above, it is red. Half the vocabulary is green at every step, but never the same half: it changes with the preceding word.
3. Add the chosen strength to the logit of every green candidate, before the temperature and the draw: that is the bias the toy model accepts at this very stage.
4. Draw normally from that corrected distribution. A green word now has a better chance of being chosen, without any word becoming impossible; and when all the candidates at a given step share the same colour, the bias changes nothing, there being no choice to separate.
5. Repeat for the next word: the preceding word has changed, so the green list has too.
6. To measure a text, redo the calculation of step two on each of its words, with the same key, and count the share of green words. Under the key that served to generate it, that share clearly exceeds one half; on any other text, or under another key, it stays close to one half.
7. Compare that measured share with the expected half through a standardised difference: the bigger the difference, the rarer the observed proportion would be in a text that had not received this watermark. That number never becomes a verdict.

Hiding a message in the least significant bits, step by step

1. Draw the image and read its pixels: for each one, three numbers from zero to two hundred and fifty-five, one per colour channel.
2. Write the length of the message, in bytes, into the first thirty-two bits available.
3. Write each byte of the message after it, eight bits each.
4. For each bit to be written, take the next number in the grid of colour channels, wipe its least significant bit and put the message bit there. The number changes by at most one, on a scale of two hundred and fifty-five: no eye sees the difference.
5. To find the message again, read the same bits in the same order, rebuild the length and then the bytes, and convert them into text.
6. An operation that recalculates the pixels, a recompression or a resizing, recalculates their least significant bit too, with no regard for what it was carrying. The message survives only if that value stays identical, to the bit.

Two ways of marking content

The two attempts above put the two mechanisms this chapter distinguishes in their proper place.

Declared provenance: readable, and fragile

A public technical standard, C2PA, says how to attach signed information about its origin and its history to a file: which device or which software produced it, what changes it has been through. An application that reads this standard displays that information in plain sight, under the name Content Credentials. It is a label, in the literal sense: it says where the file comes from, it touches nothing inside the file itself.

A label comes off. The standard itself acknowledges it: its provenance information can be separated from the file, which makes it losable through a simple screenshot or a re-saving of the file. Sending by a messaging app that recompresses an image, a screenshot that copies only the pixels displayed, an export to a format that ignores that block of metadata: none of those moves is an attack, and each is enough to wipe out the provenance without leaving any trace of the wiping.

That is where the most widespread misreading lies: an image with no declared provenance is not an image hiding something. It may well be an image whose label simply fell off along the way, which happens to very nearly all the images in circulation.

The statistical watermark: discreet, and more resistant, not invincible

A statistical watermark is not added alongside the content: it alters the content itself, in a tiny and spread-out way. In a text, by nudging the draw towards a list of words chosen by a key, as the demonstration above has just done. In an image, by altering pixels in a way that can be far more discreet than the least significant bits used here to stay explainable.

That difference in nature changes everything about resistance. A metadata label disappears in a single move, because it is never more than data beside the data. A statistical watermark has to be undone inside the content itself: copying a text out by hand changes nothing about its green list, and an image sometimes keeps a watermark through operations that would wipe out its provenance with no effort.

That resistance has two limits, and both have just been seen above. The first: a watermark assumes that the maker placed it at the moment of creation. Nothing obliges a service to do so, and nothing proves it after the fact if the content has circulated without it. The second: a watermark is not invincible either. A paper cited in the chapter a fabricated image shows that a regeneration attack, which adds noise to an image and then reconstructs it, removes watermarks invisible at pixel level while preserving visual quality. The recompression or the resizing you have just chosen above is the elementary version of it, applied to a different mechanism but to the same idea: recalculating the pixels wipes out whatever was hiding in them.

What research has measured

A public technical standard defines how to attach verifiable, signed information about its origin and its history of changes to a file, and acknowledges itself that this information is separable from the file, and therefore losable through a screenshot or a re-saving, with nothing to signal the loss.

Inserting into a generated text a statistical watermark invisible to the eye, by slightly favouring certain words at every step, then detecting it by a statistical test: that is exactly the mechanism the demonstration above has just run. A mechanism of this family, built into the sampling of a real service, has been published and peer reviewed in the journal Nature: what this page simplifies for teaching purposes is deployed elsewhere on an entirely different scale.

The habit to keep

Faced with a file whose origin matters, two reflexes too often stand in for a judgement. The first: looking for a declared provenance and, failing to find one, concluding that the file is hiding something. The standard itself says the opposite: the absence of provenance is the normal state of very nearly all the files in circulation, not proof of anything. The second: asking a detection tool for a verdict, on a text or on an image. An independent evaluation of fourteen text detection tools, including tools used in education, concludes that none is both reliable and accurate; the maker of one of the most used withdrew its own tool six months after launch, citing a rate of accuracy too low to be useful.

The green-list watermark demonstration above applies that same caution to itself: its result is a proportion and a standardised difference, never a word to settle the matter. Faced with content whose origin really matters, the useful question stays the same: who published it first, on what date, and is it corroborated elsewhere. A technical clue documents a doubt, it never replaces one.

Going further

The mechanism this chapter sets aside, the one that spots the unintended trace of a fabrication rather than a watermark placed on purpose, is covered in the chapters a fabricated image and a fabricated voice. The draw that the text watermark nudges is explained in detail in the chapter the next word. The situations where none of these tools is enough are gathered in when not to use it. All the demonstrations on the site are gathered on the demonstrations page, and the contents of the course on the understand page.

Sources

• Content Credentials: C2PA Technical Specification (version 2.4) Coalition for Content Provenance and Authenticity (C2PA), 2026. Establishes that there is a public technical standard defining how to attach verifiable, signed information about its origin and its history of changes to a file.
• C2PA Frequently Asked Questions Coalition for Content Provenance and Authenticity (C2PA), 2026. Establishes that the C2PA standard acknowledges itself that its provenance manifests can be separated from the file, which makes that information losable through a simple screenshot or a re-saving of the file.
• A Watermark for Large Language Models John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein, 2023. Establishes that it is possible to insert into a generated text a statistical watermark invisible to the human eye, by slightly favouring certain words at every step, and to detect it afterwards by a statistical test.
• Scalable watermarking for identifying large language model outputs Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, et al., 2024. Establishes that SynthID-Text, a statistical watermark built into the speculative sampling used in production, was published and peer reviewed in the journal Nature (volume 634, pp. 818-823).
• Testing of detection tools for AI-generated text Debora Weber-Wulff, Alla Anohina-Naumeca, Sonja Bjelobaba, Tomas Foltynek, Jean Guerrero-Dib, Olumide Popoola, Petr Sigut, Lorna Waddington, 2023. Establishes that an independent evaluation of fourteen tools for detecting AI-generated text, including commercial tools used in education, concludes that none of them is both reliable and accurate.
• OpenAI scuttles AI-written text detector over “low rate of accuracy” Devin Coldewey / TechCrunch, citing OpenAI, 2023. Establishes that OpenAI withdrew its own tool for detecting AI-generated text six months after launch, itself citing a rate of accuracy too low to be useful.