TAI BUI
Back to curriculum
BuildPython

Watermarking — SynthID, Stable Signature, C2PA

Three technologies structure 2026 AI-generated-content provenance. SynthID (Google DeepMind) started with image watermarking in August 2023, added text and video in May 2024 (Gemini and Veo), open-sourced the text version in October 2024 through the Responsible GenAI Toolkit, and got a unified multi-media detector in November 2025 alongside Gemini 3 Pro. Text watermarking nudges next-token sampling probabilities imperceptibly, while image and video watermarks survive compression, cropping, filters, and frame-rate changes. Stable Signature (Fernandez et al., ICCV 2023, arXiv:2303.15435) fine-tunes the latent diffusion decoder so outputs carry a fixed message, and images cropped to 10% of their content were detected more than 90% of the time at FPR<1e-6. The follow-up "Stable Signature is Unstable" (arXiv:2405.07145, May 2024) showed that fine-tuning removes the watermark while preserving quality. C2PA is a cryptographically signed, tamper-evident metadata standard (C2PA 2.2 Explainer, 2025). The two approaches complement each other: metadata can be stripped but carries richer provenance, and watermarks persist through transcoding but carry fewer bits.

TIME: ~75 minutesPREREQUISITES: Phase 10 · 04 (sampling), Phase 01 · 09 (information theory)

Learning Objectives

  • Describe token-level watermarking (SynthID-text style) and the mechanism by which it is detectable.
  • Describe Stable Signature and the 2024 removal attack that broke it.
  • State C2PA's role and why it is complementary to watermarking.
  • Describe the key limitations: model-specific signal, robustness under paraphrase, and meaning-preserving attacks (arXiv:2508.20228).

The Problem

Between 2023 and 2024, deepfakes and AI-generated content entered political and consumer contexts at scale. Watermarking is the proposed technical provenance signal: mark a generation when it is created, detect the mark later. The 2025 evidence says watermarks can be broken, but layered with C2PA metadata they add up to a usable provenance story.

Warm-up0/3
1. In temperature sampling, what happens when you add a small constant δ to the logits of half the vocabulary before the softmax?Warm-up
Eight generic logit bars, half of them marked with a plus-delta annotation, arrow into a softmax step, with the resulting eight probabilities shown only as a question mark.
2. A deterministic hash function is run twice on the same input string. What comes out?Warm-up
The same input string run through a hash function twice, in two separate rows, each producing an output box marked only with a question mark.
3. A fair coin is flipped 1000 times. Which count of heads is typical?Warm-up
A single fair coin flipped one thousand times, with the total number of heads shown only as a question mark.

The Concept

Text watermarking (SynthID-text style)

The mechanism comes from Kirchenbauer et al. 2023, and Google productionized it:

  1. At each decoding step, hash the previous K tokens to produce a pseudorandom partition of the vocabulary into "green" and "red" sets.
  2. Bias sampling toward the green set by adding δ to green logits.
  3. The generation contains more green tokens than chance would produce.

Detection: rehash each prefix, count green tokens in the generation, compute a z-score. The z-score is >0 for watermarked text, ~0 for human text.

Properties:

  • Imperceptible to readers (δ is small enough that quality loss is minor).
  • Detectable with access to the vocabulary partition function.
  • Not robust to paraphrase. Rewriting the text destroys the signal.

SynthID-text is open-sourced October 2024 via Google's Responsible GenAI Toolkit.

Stable Signature (image)

Fernandez et al. ICCV 2023. Fine-tune the latent diffusion decoder so generated images contain a fixed binary message embedded in the latent representation. Detection decodes the message from the latent with a neural decoder. Cropped (to 10% of content) images detected >90% at FPR<1e-6.

May 2024 "Stable Signature is Unstable" (arXiv:2405.07145): fine-tuning the decoder removes the watermark while preserving image quality. Adversarial post-generation fine-tuning is cheap, so the watermark's adversarial robustness is limited.

SynthID unified detector (November 2025)

This shipped alongside Gemini 3 Pro as a multi-media detector that reads SynthID signals from text, image, audio, and video through one API, which unifies the Google provenance stack.

C2PA

Coalition for Content Provenance and Authenticity. It is a cryptographically signed, tamper-evident metadata standard (C2PA 2.2 Explainer, 2025). A C2PA manifest records provenance claims (who created, when, what transformations) signed by the creator's key.

Complementary to watermarking:

  • Metadata can be stripped, while watermarks are hard to remove.
  • Metadata is rich (a full provenance chain), while watermarks carry bits.
  • C2PA depends on platform adoption, while watermarks embed automatically.

Google integrates both in Search, Ads, and "About this image."

Limitations

  • Model-specific. SynthID watermarks generations from SynthID-enabled models. A generation from a model without SynthID is not watermarked, so "no SynthID signal" is not proof of authenticity.
  • Paraphrase. Text watermarks do not survive meaning-preserving paraphrase.
  • Transformation attacks. arXiv:2508.20228 (2025) shows meaning-preserving attacks that destroy both text watermarks and many image watermarks.
  • Fine-tune removal. Per "Stable Signature is Unstable," post-generation fine-tuning removes embedded watermarks.

EU AI Act Article 50

Transparency Code for AI-generated content labeling (first draft December 2025, second draft March 2026, expected final June 2026 per the European Commission status page). The Code remains in draft as of April 2026 and the timeline is subject to change. This is the regulatory layer that requires the technical layer: deepfakes must be labeled.

Where this fits in Phase 18

Lessons 22-23 are about what the model emits (private data, provenance signal). Lesson 27 covers training-data governance, and Lesson 24 covers the regulatory framework that requires these technical measures.

Check: The Concept0/21
1. What is SynthID?Define
A dated timeline of four SynthID milestones: image watermarking in August 2023, text and video added in May 2024 via Gemini and Veo, the text version open-sourced in October 2024, and a unified detector shipped in November 2025 alongside Gemini 3 Pro.
2. What is a token watermark in a text generator?Define
A flow diagram: the previous K tokens are hashed into green and red sets, sampling is biased toward the green set, and a detector counts green tokens later.
3. What does Stable Signature (Fernandez et al., ICCV 2023) do?Define
Fernandez et al., ICCV 2023: a latent diffusion decoder fine-tuned to embed a message, a generated image carrying that message, and a neural decoder reading it back from the latent, with a note that images cropped to 10% of their content were still detected over 90% of the time at a false positive rate below one in a million.
4. What is C2PA?Define
A C2PA manifest box listing fields for who created the content, when, and what transformations it underwent, next to a tamper-evident signature marker.
5. What does paraphrase robustness describe for a text watermark?Define
An original generation with watermark bias applied is reworded into a version with the same meaning but new words, then passed to a detector whose result is shown only as a question mark.
6. What does the fine-tune removal attack from "Stable Signature is Unstable" (May 2024) do?Define
Per arXiv:2405.07145, May 2024: a watermarked image where the message embeds cleanly, an attacker fine-tuning the decoder, and the same image afterward shown with unchanged quality but the watermark gone.
7. What is a cross-modal detector in the SynthID stack?Define
Four input types, text, image, audio and video, each arrow pointing into one box labeled the unified SynthID detector shipped alongside Gemini 3 Pro, producing a single signal output.
8. Why does paraphrasing hurt a token-level text watermark?Explain
A row of ten token positions with one position replaced by a random new token, an arrow pointing toward the positions that follow it, a note that later checks reuse the previous few tokens as hash input, and the question of whether the green count stays high left open.
9. Why can only a party holding the vocabulary partition function check a token watermark?Explain
The same row of token positions shown twice: once as colored dots to someone holding the hash-based partition function, and once as plain gray dots of the same tokens to someone without it.
10. Why does a watermarked generation contain more green tokens than chance would produce?Explain
One decoding step's logits for eight tokens, four tagged green and four tagged red, with a plus-delta boost marked on each green bar before the softmax while the red bars are left unmarked.
11. Why is the z-score near 0 for human-written text?Explain
A row of ordinary, unwatermarked tokens colored green or red by the same hash-based partition applied after the fact, with the detector's already-given result of a near-zero z-score noted alongside.
12. Why is the fine-tune removal attack on Stable Signature considered cheap?Explain
A watermarked image whose message embeds cleanly, next to an attacker fine-tuning only the decoder after generation, with a note asking how much work this amount of retraining actually takes.
13. How do C2PA metadata and watermarks complement each other?Explain
Two cards side by side, a C2PA manifest described as a signed record of who created content and what changed, and a watermark described as a signal embedded in the content itself, with how they complement each other left as a question mark.
14. What do meaning-preserving transformation attacks show about watermarks?Explain
A meaning-preserving transformation from arXiv:2508.20228, 2025, applied separately to a text watermark and an image watermark, with the outcome for each left as a question mark.
15. How does the EU AI Act Article 50 relate to watermarking and C2PA?Explain
A regulatory timeline for the EU AI Act Article 50 Transparency Code, from a December 2025 draft to a final version expected June 2026, shown above a separate box for the technical layer of watermarking and C2PA, with the relationship between the two left unlabeled.
16. A moderator scans a viral image with the SynthID detector, finds no signal, and marks the image as human-made. What is wrong with that call?Analyze
A viral image, a SynthID detector scan reporting no signal, and a moderator's note marking the image as human-made, with whether that conclusion is sound left as a question mark.
17. A passage from a watermarked model scored z of 20, but after a user rewrote most of the words it scores 0.8. A reviewer says the detector is broken. What is the better diagnosis?Analyze
One passage scored at z equals 20 before any edit and z equals 0.8 after most of its words were rewritten, with a reviewer's claim that the detector must be broken and a better diagnosis left blank.
18. A vendor says its image watermark is robust because the message was decoded in over 90 percent of images cropped to 10 percent of the content, at a false positive rate below 1e-6. Which claim does this evidence leave untested?Analyze
A vendor's quoted claim about detecting a message over 90% of the time on images cropped to 10% of their content at a false positive rate below one in a million, with what remains untested left blank.
19. A platform re-encodes every upload and drops all file metadata. Which provenance signal is most at risk, and what may remain?Analyze
An uploaded file going through a platform's re-encoding step that strips all file metadata, with the fate of its C2PA manifest and its watermark both left blank.
20. You ship an open image model and expect users to fine-tune its decoder. Which design best protects provenance?Design
An open image model released publicly, next to a note that users are expected to fine-tune its decoder, with the deployment design that protects provenance left blank.
21. You ship a text generator that uses SynthID-text plus C2PA metadata. Which pair of failure modes belongs in the provenance audit?Design
A text generator producing output layered with SynthID-text and C2PA metadata, with an arrow toward a provenance audit and a note that the audit should name one failure mode per layer, both left blank.

Use It

code/main.py builds a toy text watermark. Tokens are integers 0..N-1; watermarked sampling biases toward the hash-defined green set. A detector computes the green-token z-score. You can observe detection at 1000-token generations, watch a 30% paraphrase weaken the signal and a 60% paraphrase erase it, and measure the false-positive rate on human text.

Check: Use It0/5
1. In main.py, a watermarked sample is 4 seed tokens plus 1000 generated tokens, and detect() counts 580 green tokens. What does it return?Apply
The real detect() formula from main.py next to the stem's given numbers, four seed tokens plus 1000 generated tokens and a green count of 580, with the expected count, standard deviation and final z-score all left blank.
2. detect() scores 400 tokens. What green-token count does it expect, and what standard deviation does it divide by?Apply
The real detect() formula shown symbolically for 400 scored tokens, with the expected green count and standard deviation both left blank.
3. With the default bias of 0.9, about how many of 1000 tokens from watermarked_sample() fall in the green set?Apply
Real lines from watermarked_sample() showing that a red-pool pick can never land in the green set, with the question of how many of 1000 generated tokens are green at the moment they are drawn left blank.
4. In paraphrase(), one token at position i is replaced by a random token. Which positions' green checks can change as a result?Apply
Trimmed real lines from green_set() and paraphrase() in main.py, showing the hash window looks back 4 tokens and one edit lands at position i, next to a row of ten positions with only position i marked, and the set of affected checks left blank.
5. The toy detector shows a false-positive rate of 0 over 100 random sequences. A teammate says this proves it is safe on real writing. What is the flaw?Analyze
Real captured output from main.py's false-positive check, 100 uniform-random draws scoring a false-positive rate of exactly 0.000, next to a teammate's claim that this proves safety on real writing, with the flaw in that claim left blank.

Ship It

This lesson produces outputs/skill-provenance-audit.md. Given a content deployment with a provenance claim, it audits: the watermark mechanism (if any), the C2PA signing chain (if any), the adversarial robustness of each, and the per-modality coverage.

Author's Note

I'd run main.py first and read the four printed z-scores before touching the prose. The toy uses a vocabulary of 200 integers, hashes the previous 4 tokens to split it into green and red halves, and samples from the green half 90% of the time. That is cruder than the logit bias in the text-watermark description, but detection is the same count-and-z-score idea, so you can see the signal without a real language model.

The part I'd poke at is the paraphrase attack. In the code it replaces a fraction of tokens with random ones, which is a harsher edit than a synonym swap. It also breaks the hash context for the tokens after each edit, so the damage spreads past the tokens you touched. Exercise 2 asks you to swap in synonym-style replacements, and I'd compare the two before trusting any single number.

I'd also keep the false-positive check in proportion. It draws 100 uniform-random sequences, which is a far simpler null than human writing. A real detector has to face text with repeated phrases and skewed token frequencies, and nothing in this toy tells you how it would behave there.

Exercises

  1. Run code/main.py. Report z-scores for watermarked 1000-token generation vs human-authored text. Identify the false-positive rate at the 95% confidence threshold.

  2. Implement a paraphrase attack that replaces 30% of tokens with synonyms. Re-measure the z-score.

  3. Read Kirchenbauer et al. 2023 Section 6 on robustness. Why do text watermarks fail under paraphrase but image watermarks survive cropping?

  4. Design a deployment that uses SynthID-text + C2PA metadata. Describe the provenance chain a consumer sees. Identify one failure mode of each component.

  5. The 2024 "Stable Signature is Unstable" result shows fine-tuning removes the image watermark. Design a deployment control that limits this attack. For example, require signed releases of fine-tuned checkpoints.

Key Terms

TermWhat people sayWhat it actually means
SynthID"Google's watermark"Cross-modal provenance signal; text, image, audio, video
Token watermark"Kirchenbauer-style"Biased-sampling text watermark detectable via green-token z-score
Stable Signature"image watermark"Fine-tuned-decoder watermark; ICCV 2023
C2PA"the metadata standard"Cryptographically signed tamper-evident provenance metadata
Paraphrase robustness"does rewording break it"Text watermark property; currently limited
Fine-tune removal"adversarial unwatermark"Attack that removes image watermark via decoder fine-tuning
Cross-modal detector"unified SynthID"November 2025 unified API across modalities

Further Reading

Code

Ships With