The ink you cannot see

Picture this. It is late on a Tuesday. A fact-checker I will call Mira has three files open.

• a photo of a flooded train station, shared thousands of times in an hour
• a two-line quote from a city official, pasted into a group chat
• a voice note of the same official telling people to stay home

Her editor wants one answer. Did a machine make any of this?

She starts with the photo. She drops it into a Content Credentials checker. Nothing comes back. The file carries no label at all.

That tells her less than it seems. The photo reached her as a screenshot. A screenshot keeps the pixels and drops everything else. Any label the generator attached fell off at the first share.

So she tries a second tool. This one ignores labels and looks inside the pixels. It finds a pattern no eye can see. The image came from a model that signs its work.

Then the quote. It is two sentences long. The text detector shrugs. Too short to say.

Then the voice note. The audio check finds no mark. Mira knows that proves nothing.

The note could be real. It could also come from a tool that marks nothing.

One night. Three files. Three answers: yes, maybe and no idea.

That is AI watermarking in late 2026. It works. It also fails in ways you can predict.

Below I walk through how each frontier lab marks its output. Then I cover why the law now demands it. I end with where the marks give out.

Say it to a friend. AI companies now mark their output in up to three ways.

• A signed label attached to the file. It says which tool made it. It falls off when you screenshot or re-save.
• Ink mixed into the content itself. In a picture it hides in the pixels. In text it hides in which words the model picked. It survives most handling but not a full rewrite.
• A record the company keeps. It lets them find their own work again later.

A mark found means "probably made by that model". No mark found means nothing at all.

Three layers, one idea

Provenance means the history of a piece of content. Labs record it in three layers. Each layer fails in a different way. That is why the serious players now use more than one.

• Metadata is signed data that rides along with the file. The open standard is C2PA. Its consumer name is Content Credentials. It is easy to read and easy to lose.
• A watermark is a signal woven into the content itself. It is hard to see and hard to remove. Only the owner's detector can read it.
• A fingerprint is a compact digest of the content, kept in a lookup database. It can find a lost label again after the metadata is gone.

The EU now expects providers to stack these. Law firm summaries of the new EU code of practice describe a floor of two machine-readable layers. Think signed metadata plus a watermark.

How a sentence carries a signature

Text has no pixels to hide in. So the trick works on choices instead.

A language model writes one token at a time. A token is a word or a piece of one. At each step the model holds a list of likely next tokens with odds attached. Then it rolls the dice and picks one.

A text watermark changes the dice. It does not change the words you would expect.

Anthropic explains this with a board game. Imagine playing Monopoly with the digits of pi instead of a die. The players see random moves. The game plays out the same. But someone who replays the moves and knows pi can tell which game used it.

The green list

The first public recipe came out in January 2023. John Kirchenbauer and colleagues at the University of Maryland called it "A Watermark for Large Language Models". It works in four steps.

1. Hash the previous token into a seed.
2. Use the seed to split the vocabulary into a green list and a red list.
3. Give every green token a small boost before the model picks.
4. Move to the next token and repeat.

A human writer does not know the lists. People pick green words about as often as chance predicts. The model picks green a bit more often. Over a few hundred tokens that small tilt adds up.

The detector just counts. It rebuilds each green list from the text itself and tallies the green hits. Then it turns the tally into a z-score. In the paper, a z-score above 4 means a false alarm about 3 times in 100,000.

Two details matter here. The detector needs the key but not the model. So whoever holds the key decides who gets to check.

And the boost only works where the model has real choices. "2 + 2 =" leaves no room for a nudge.

Google's tournament

Google DeepMind took a different route with SynthID Text. The team published it in Nature in 2024.

Instead of boosting a list, SynthID runs a tournament. The model draws several candidate tokens from its own odds. Secret scoring functions rate each candidate.

Winners advance round by round. The last token standing gets written.

Every candidate comes from the model's own odds. That keeps the quality close to normal.

Google open-sourced SynthID Text in Hugging Face Transformers in October 2024. Anyone can now add it to an open model. The keys stay private.

Anthropic says its own text watermark is a version of SynthID Text. So two frontier labs now share one family of methods.

What the numbers say

OpenAI published the clearest numbers so far. It calls its EU text watermark textGrain. Here is what it reported in October 2026.

• At a 1% false-positive rate it caught about 80% of 200-token passages.
• At 400 tokens it caught about 95%, for content such as psychology.
• Swapping 10% of words for synonyms cut detection from about 92% to 66%.
• Swapping 25% of words cut it to 17%.

Read those twice. Length helps a lot. Light editing hurts a little. Heavy editing hurts a lot.

How a picture carries a signature

Images have far more room. A 1024 by 1024 picture holds over a million pixels. An image watermark nudges many of them by amounts too small to see. The detector looks for that pattern as a whole.

Labs design these marks to survive normal handling. Amazon calls its Titan marks "designed to be tamper-resistant". A Microsoft report says the Bing mark survives "minor modifications". Cropping and compression should leave the signal readable.

There is a known way past them. In 2023 researchers published a paper titled "Invisible Image Watermarks Are Provably Removable Using Generative AI".

The attack adds noise to the image. Then a generative model rebuilds it. The picture looks the same. The faint pattern underneath does not survive.

The label that travels

The label layer has one standard. C2PA stands for the Coalition for Content Provenance and Authenticity. Adobe, Arm, the BBC, Intel, Microsoft and Truepic founded it in February 2021. Version 2.5 of the spec came out in October 2026.

A C2PA manifest has three parts.

• Assertions are facts about the file. Which tool made it. What edits happened.
• The claim bundles hashes of those assertions.
• The signature seals the claim with a certificate.

The manifest also holds exactly one hard binding. That is a hash of the file's bytes. Change one byte and the seal breaks.

It may also hold soft bindings, such as a watermark or a fingerprint. Their job is to find the label again if it falls off. C2PA calls this Durable Content Credentials.

The weakness is plain. Metadata lives outside the pixels.

Screenshots, re-saves and many upload pipelines strip it. Black Forest Labs warns about this in its own docs. That is why C2PA now ships alongside watermarks.

Lab by lab

Here is where each lab stood on November 9, 2026. I used each company's own pages wherever I could.

Google DeepMind

Google started early. SynthID launched in beta in August 2023 for Imagen on Vertex AI. It now covers text, images, video and audio.

In October 2026 Google said it had marked over 180 billion images and videos. It also counted 240,000 years of audio.

The same month it opened SynthID Detector to everyone at synthid.com. The detector reads marks from Google and from partners including OpenAI, NVIDIA, Kakao and Apple. Checks built into Search, the Gemini app and Chrome now handle over 1 million requests a day.

OpenAI

OpenAI began adding C2PA Content Credentials to DALL·E 3 images in 2024. Later it added them to ImageGen and Sora. Sora 2 adds a visible moving watermark too.

Text took longer. In August 2024 OpenAI said its text method was accurate but easy to dodge by rewording or translating. It also worried a detector "could stigmatize" non-native English speakers who use AI. So it held off.

Then 2026 changed the picture.

• May: OpenAI became a C2PA Conforming Generator Product. It added SynthID watermarks to images from ChatGPT, Codex and the API through a partnership with Google. It previewed a public verify tool.
• July: SynthID came to supported audio.
• October: textGrain arrived for eligible ChatGPT and Codex text in the EU only. In the API it is an opt-in, off by default. Detector access starts with approved researchers and expert groups.

Anthropic

Anthropic watermarks Claude's text at the model level. So the mark appears on every surface.

That covers the API, the Claude apps, Claude Code and the cloud partners. It applies the mark worldwide. It says there is "no durable way" to scope it by region.

Files that Claude creates, such as PNG and JPEG images, carry C2PA Content Credentials. A free Claude Content Checker reads them. The text detector is narrower. It is open to eligible groups the EU law names, such as regulators, media, fact-checkers and researchers.

Anthropic is candid about limits. Where an exact answer is needed, the nudge does not apply. So code carries less watermark than prose.

Light edits probably leave the mark. A complete rewrite removes it.

Meta

Meta labels more than it marks, at least in public. Since February 2024, images from Meta AI carry visible markers, invisible watermarks and IPTC metadata. Meta also reads C2PA and IPTC from other companies to label their images on Facebook, Instagram and Threads. The label now reads "AI info".

Its research arm builds the marks. Stable Signature covers images. AudioSeal covers audio. Video Seal covers video.

The umbrella is now Content Seal, released under the MIT license. Meta says it runs at scale for its Muse Image model. I could not confirm that Meta marks text in production.

Microsoft

Microsoft co-founded C2PA. Bing Image Creator added Content Credentials in October 2023.

Microsoft Foundry now uses two layers. Images from GPT Image, MAI-Image and FLUX get C2PA plus invisible watermarks. So do several audio models.

Microsoft offers a free detection website and an API. Text watermarking is planned only for select models in the gpt-5.1 to gpt-5.6 families.

Amazon

Amazon marked images from day one of Titan Image Generator. It went generally available in April 2024 with an invisible watermark on every image. The same launch shipped an API that checks for the mark.

Nova Canvas images and Nova Reel videos carry an invisible watermark. They also carry C2PA credentials. Nova 2 Sonic speech carries a watermark you cannot turn off. Bedrock also lists Claude's text watermark as on by default.

xAI

Grok Imagine stamps a visible Grok watermark on images and video. No setting removes it.

Text changed on November 7, 2026. Responses from grok-4.3 through grok-4.7 and the grok-4.20 models now carry an invisible watermark. It is on by default.

Team admins can opt a model out. To do so they must confirm a legal exception applies. A response header tells developers whether a given answer was marked. Detection access is by application.

Mistral and the open-weight world

Mistral signed the provider section of the EU code. I found no public Mistral documentation on how it marks output.

Open weights are the hard case. The original Stable Diffusion script added an invisible watermark. But anyone who runs the model can delete that line.

Black Forest Labs signs FLUX images from its own API with C2PA. It says self-hosted FLUX output sits "outside" that signing. On open weights, the mark is only as strong as the person running the model.

Where the marks break

Every lab lists the same weak spots. Here they are in one place.

• Short text. Two sentences give the counter too little to count. AWS says detection is "less reliable for short text".
• Fixed answers. Code, numbers and facts leave the model few real choices.
• Heavy rewrites. A 2023 study showed a paraphrasing model could slip text past detectors.
• Translation by another tool. OpenAI flagged this in 2024.
• Stripped metadata. Screenshots and re-saves drop the C2PA label.
• Regeneration. Noise plus a rebuild can wash out an image mark.
• Open weights. The marking code can simply be removed.

Two harder problems sit behind that list.

The first is false positives. Run the arithmetic on a detector with a 1% false-positive rate. Check a million essays and it wrongly flags about 10,000 people.

That is why OpenAI worried about non-native speakers. That is why every lab limits who gets the detector.

The second is spoofing. A 2023 paper by Vinu Sankar Sadasivan and colleagues showed attackers could get human-written text flagged as AI. A mark can be faked as well as erased.

Then there is what a mark does not say. OpenAI lists it plainly.

A watermark does not measure how much human judgment went in. It does not prove ownership. It does not identify the user. It does not check facts.

Anthropic adds that Claude may only have proofread or translated the text. And missing marks prove nothing at all.

Why now: the rules

Text watermarks went live this autumn for one main reason. Anthropic, OpenAI and xAI each point to the EU AI Act.

• EU AI Act Article 50 applies from August 2, 2026. Providers must mark synthetic output in a machine-readable way. Systems already on the market get until December 2, 2026.
• The EU code of practice on transparency of AI-generated content was finalised on June 10, 2026. About 190 organisations had signed by the end of July. Anthropic, Google, Meta, Microsoft, Mistral and OpenAI are among them.
• California's AI Transparency Act became operative on August 2, 2026, after an amendment set that date. Providers must embed hidden disclosures with the provider, version, time and a unique ID.
• From January 1, 2027, large platforms in California must detect and show that provenance. They must not knowingly strip it.
• China's labeling measures took effect on September 1, 2025. They require visible labels and hidden labels in file data.
• In July 2023, seven US companies pledged provenance or watermarking for AI audio and images.

What I take from this

I read these pages as someone who builds with these models. Five things stand out.

1. Treat a detector result as evidence, not a verdict.
2. If you ship a product on a frontier model, you inherit its marks. Know which ones, for which outputs.
3. Do not strip what you inherit. Re-encoding images in your own pipeline can drop the C2PA label.
4. For text, "too short to tell" is often the honest answer. Plan for it.
5. Ask every vendor the same four questions. Which outputs get marked? Which layers? Who can detect? What is the false-positive rate at your text length?

Back to Mira. She files her note at midnight.

The photo is AI-made and marked. The quote is too short to call. The voice note shows no mark, which proves nothing.

Her editor does not love the answer. It is still the honest one.