Skip to content

Can AI Watermark Images, Audio, and Video? (Part 3 of 3)

You can watermark a sentence by influencing word choices. But an image has pixels, an audio clip has sound measurements, and a video has thousands of frames. Can those very different files carry a hidden signal that survives being shared, cropped, trimmed, or compressed?

This final post explains how watermarking works across images, audio, and video. It also separates an embedded watermark from file metadata, and shows why a positive or negative check is evidence with limits rather than a final answer about a file.

Part 3 of 3 - Explore the complete series
Navigate this post

This post explores three types of AI-generated media:

  • Images: Made of tiny colored squares (pixels) created by AI tools like Midjourney, ChatGPT, or Gemini.
  • Audio: Made of sound measurements created by AI voice and music generators like Lyria or NotebookLM.
  • Video: Made of still picture frames created by AI video generators like Sora or Veo.

Because these media types work differently, AI tools watermark them differently. One core principle connects all three:

Spreading hidden clues across many small parts of a file allows AI detectors to spot the watermark, even after an edit changes or removes some of those parts.

For example, if you crop a photo, compress a video for WhatsApp, or trim an audio clip, the file keeps enough hidden clues for an AI detector to recognize the watermark. Heavy edits - like severe blurring or cutting out almost the entire clip - can erase those clues completely.

We will build this concept step by step.

Image watermarks

Pixels are the building blocks of an image

A digital image consists of millions of tiny squares called pixels. Here is a greatly enlarged image grid:

Text Only
+------+------+------+------+
| blue | blue | grey | grey |
+------+------+------+------+
| blue | green| green| grey |
+------+------+------+------+
| grey | green| green| blue |
+------+------+------+------+

A real photograph contains millions of pixels. Human eyes blend these squares into a smooth picture.

Each pixel stores numbers that define its color. Changing those numbers changes the picture. Large number changes create visible edits. Tiny number changes remain invisible to human eyes, but AI detector programs read them easily.

This gives us our first building block:

AI image generators like Midjourney or Gemini hide watermarks inside pictures by making tiny, controlled adjustments to pixel numbers.

An image file can contain more than the visible picture

The photograph on your phone contains visible pixels and hidden text notes. These stored details include:

  • the date and time of the photo;
  • the camera or phone model;
  • the camera settings; and
  • the GPS location, if location recording was active.

Apple calls these extra details metadata. Apple lets iPhone users strip location details before sharing photos. Apple's iPhone guide explains how to manage shared photo metadata.

Metadata means extra text information saved inside a file alongside the picture.

---
title: "Pixels and Metadata Live in Different Parts of an Image File"
---
flowchart TB
    accTitle: Pixels and metadata live in different parts of an image file
    accDescr: An image file contains pixel information for the visible picture and may also contain metadata about dates, cameras, creators, or edits.
    A["Image file"] --> B["Pixel information<br/>the visible picture"]
    A --> C["Metadata<br/>date, camera, creator, or edit notes"]

Pixels and metadata perform different jobs. Pixels build the tree you see. Metadata records when, where, and how your phone created the file.

Follow an iPhone photo through WhatsApp

Suppose your original photo includes camera details and GPS location:

Text Only
On the iPhone

pixels:    the photographed tree
metadata:  date + phone model + camera settings + location

When you share a photo through ordinary WhatsApp messaging, the app compresses the picture pixels and wipes away camera notes like location and camera model. Technicians call these camera notes EXIF metadata. If you send the photo as a full document file, WhatsApp preserves those camera notes. A 2025-2026 study of file changes compares ordinary image sharing with document transfers.

---
title: "A Shared Photo Keeps Its Picture After Metadata Is Removed"
---
flowchart LR
    accTitle: A shared photo keeps its picture after metadata is removed
    accDescr: Ordinary chat sharing may change or compress pixels and remove original metadata while the tree remains visible.
    A["Original file<br/>pixels plus metadata"] --> B["Ordinary chat-photo route"]
    B --> C["Compressed pixels"]
    B --> D["Camera metadata removed"]
    C --> E["Friend still sees the tree"]
    D --> E

This example reveals an important truth: the visible picture stays intact even when an app wipes away attached file notes.

So if sharing a file can remove metadata, how do watermarks in AI generated images survive? The answer lies in where the watermark lives. This is what we will explore next.

Three ways to mark an image

Creators and AI platforms use three distinct methods to mark digital images.

A visible watermark

A creator or AI tool draws a visible watermark directly onto the picture where anyone can see it. It appears as a logo, a creator name, or semi-transparent text across the image.

Text Only
+------------------------------------+
|                                    |
|             Photograph             |
|                                    |
|                         SAMPLE.COM |
|                                    |
+------------------------------------+

Visible watermarks offer immediate notice without needing special software. However, anyone can remove a visible mark by cropping the edge, placing a cover sticker over it, or editing out that corner.

Google Gemini provides a clear example. Gemini adds a small sparkle logo to images generated for free and Google AI Pro users. Google omits this visible mark on certain professional tools, while adding an invisible SynthID watermark inside the pixels. Google's Nano Banana Pro announcement explains both watermarking methods.

A label stored as metadata

An AI tool can leave the visible pixels untouched while saving a hidden text note inside the file:

Text Only
pixels:    [the picture]
metadata:  ["AI-generated by ChatGPT"]

Metadata labels provide detailed creation records. However, file notes vanish whenever a chat app, social media site, or image editor strips metadata.

OpenAI uses metadata labels in ChatGPT and DALL-E. OpenAI attaches signed digital records called C2PA Content Credentials. These signed notes record the file's creator and edit history, also known as its provenance. OpenAI also embeds an invisible SynthID watermark into supported images so the attached file notes and embedded pixel patterns reinforce each other. OpenAI's official guide details how these two features work together.

The distinction matters throughout this series: Part 1 explains how a text signal is formed, while Part 2 shows why the signal's survival depends on the kind of later change.

An invisible watermark in the pixels

If someone wants to pass on an AI generated image as a normal photograph, they can remove the visible watermark and strip the metadata. However, an invisible watermark can survive these edits. This is our third method of watermarking an image: alterting the pixel values across the picture in a precise pattern.

An invisible watermark makes real changes to pixel values. Human eyes cannot spot these tiny changes during normal viewing, but AI detectors read them easily.

Compare the three methods

Method Where the information lives Normally visible to humans? How an edit affects it
Visible watermark Directly on the picture elements Yes Cropping, covering, or painting over that area removes it
Metadata label Inside stored file notes No Stripping metadata or saving a new file erases it
Invisible pixel watermark Inside pixel value patterns No Survives common edits; extreme pixel changes destroy it

AI platforms combine these three methods. A single image can carry a visible logo, a metadata note, and an invisible pixel watermark at the same time.

Current AI tool example Stored metadata note Embedded pixel pattern Visible mark
ChatGPT / DALL-E image C2PA Content Credentials SynthID watermark Optional / None
Google Gemini image Content Credentials (where supported) SynthID watermark Gemini sparkle logo

Platforms select different combinations based on product tiers, export settings, and creation dates.

Where SynthID fits in an image

The first two parts of this series cover the related question for text: Part 1 introduces the hidden-pattern model, and Part 2 explores the effects of constrained output and editing.

SynthID is a watermarking system that Google DeepMind uses to mark AI-generated text, images, audio, and video.

Google DeepMind built SynthID using two paired AI programs:

  1. an AI watermaker that embeds a hidden pixel pattern when generating an image; and
  2. an AI detector that scans pixel values to recognize that pattern.

Google trained these two AI programs together. The AI watermaker hides the pattern so human eyes cannot see it, while the AI detector scans the pixels to find matching signals. Google DeepMind describes this paired design here.

---
title: "Image Watermarking and Detection Flow"
---
flowchart LR
    accTitle: Image watermarking and detection flow
    accDescr: Gemini creates an image, an AI watermaker adds a hidden pixel pattern, and an AI detector scans the pixels.
    A["Gemini creates an image"] --> B["AI watermaker adds hidden pixel pattern"]
    B --> C["Marked image"]
    C --> D["AI detector scans pixel values"]
    D --> E["Signal found, uncertain, or missing"]

While Google keeps the exact math of SynthID proprietary, we can easily understand how it works conceptually.

Why spread an image mark across many pixels?

If an AI tool stored its watermark in a single corner pixel, cropping that corner would destroy the entire watermark.

To solve this, AI developers spread hidden clues across the entire picture. The grid below shows how clues scatter across an image:

Text Only
+---+---+---+---+
| • |   | • |   |
+---+---+---+---+
|   | • |   | • |
+---+---+---+---+
| • |   | • |   |
+---+---+---+---+

• = one small clue in a spread-out watermark pattern

When you crop an image edge, you remove the pixels in that corner. Because the AI watermaker spreads hidden clues across the entire grid, the remaining pixels still carry enough clues for the AI detector to find the watermark. We call this concept distributed evidence.

How image edits affect the watermark pattern

Four everyday edits alter stored pixel numbers:

  • Cropping: Cuts away outer edges of the picture;
  • Color or brightness filters: Shift pixel color values across the image;
  • Resizing: Rebuilds the picture grid at a new pixel size; and
  • Compression (like JPEG): Simplifies fine pixel details to shrink file size.

AI watermarks tolerate pixel changes:

After common edits like cropping or compression, enough hidden clues remain across the image for an AI detector to spot the watermark.

Text Only
Original pattern grid:       • • • • • • • • • •
After cropping & JPEG:        • · • • · • • · • •
Remaining clues:             Sufficient for AI detector to recognize

After severe destruction:    · · • · · · · · • ·
Remaining clues:             Too weak for detection

Google SynthID resists common edits, including cropping, color filters, brightness shifts, and JPEG compression. Extreme edits - like heavy blurring or severe cropping - can erase the clues entirely. Google's SynthID overview outlines these design goals and states its detection limits.

Understanding these boundaries helps you interpret detector results correctly:

Verified observation False assumption
The watermark resists common edits The watermark can never be erased
The mark stays invisible during normal viewing Pixel values never changed
The detector found no matching mark The image was definitely created by a human

What image detection actually proves

Finding a hidden watermark proves one specific fact: a compatible AI tool generated or marked that image file.

A watermark confirms the creation tool. It leaves other questions open:

  • Accuracy: An AI diagram can accurately illustrate a scientific concept. "AI-generated" describes the creation tool, while the content itself can be factual.
  • Intent: A watermark identifies the tool used, while human intentions remain separate.
  • Uploader identity: A watermark tracks the generating software, while the person uploading the file remains unlisted.

If an AI detector finds no watermark, three main possibilities exist:

  1. A human recorded or drew the image naturally;
  2. An un-watermarked AI tool created the image; or
  3. Severe edits erased the hidden clues from the file.

An AI detector answers whether a specific mark exists. You must evaluate surrounding context to determine truth and intent.

Audio watermarks

Images spread clues across a grid of pixels. Audio files use a different material: sound measurements recorded through time.

When you clap your hands, the sound moves the surrounding air. A microphone converts air movement into electrical signals. A digital recorder measures that signal thousands of times every second.

---
title: "Sound Becomes Digital Measurements"
---
flowchart LR
    accTitle: Sound becomes digital measurements
    accDescr: A clap moves air, a microphone follows that movement, and a recorder saves many measurements that represent the sound.
    A["A clap moves air"] --> B["A microphone captures movement"]
    B --> C["A recorder takes frequent measurements"]
    C --> D["Saved numbers represent the sound"]

Drawing a line through these measurements creates a waveform. Time moves from left to right. Larger air movements push the wave line higher or lower.

Here is a simplified sequence of sound measurements:

Text Only
Moment:       1    2    3    4    5    6    7
Measurement:  0   +2   +5   +1   -4   -2    0

A single measurement gives little information. The full sound emerges when you play thousands of measurements in sequence over time.

This sound sequence enables audio watermarking:

AI audio tools like Google Lyria hide watermarks by making tiny, coordinated adjustments across thousands of sound measurements over time.

AI developers design these tiny sound adjustments so human ears hear natural audio, while AI detectors spot the embedded pattern easily.

Mapping sound by time and pitch

Sound pitch depends on vibration speed. Low hums vibrate slowly, while high whistles vibrate rapidly. Scientists call vibration speed frequency.

Human speech and music combine many sound pitches at once. AI audio tools convert sound recordings into a visual grid called a spectrogram:

Direction on the spectrogram What it represents
Left to right Time passing
Bottom to top Pitch (from low bass to high treble)
Bright or dark areas Loudness of specific pitches at that moment 
---
title: "A Spectrogram Organizes Sound by Time and Pitch"
---
flowchart LR
    accTitle: A spectrogram organizes sound by time and pitch
    accDescr: Saved audio is rearranged into a time-frequency view whose regions can be inspected or adjusted.
    A["Saved audio waveform"] --> B["Group sound pitches over time"]
    B --> C["Spectrogram<br/>a pitch and time map"]
    C --> D["AI tool embeds hidden clues into selected pitch regions"]

Google DeepMind uses this approach for SynthID audio. The AI tool converts audio waves into a 2D spectrogram and embeds invisible watermark clues into specific pitch regions over time. Listeners hear clear music, while the AI detector scans the pitch map to verify the watermark. Google DeepMind describes its audio watermarking design here.

We can now connect the pieces:

  1. a recording contains many measurements through time;
  2. those measurements contain a changing mixture of frequencies;
  3. a spectrogram lays out that mixture by time and frequency;
  4. a watermark can place coordinated evidence in that larger pattern; and
  5. a matching detector can examine many regions rather than search for one audible beep.

Here is how an AI tool distributes clues across time and pitch:

Time Low pitch region Middle pitch region High pitch region
Early seconds Hidden watermark clue Original audio sound Hidden watermark clue
Middle seconds Original audio sound Hidden watermark clue Original audio sound
Late seconds Hidden watermark clue Original audio sound Hidden watermark clue

How audio watermarks survive editing and trimming

If an AI tool placed its watermark only in the first two seconds of a track, trimming the opening would erase the mark completely.

When an AI tool scatters clues across the opening, middle, and end of a song, trimming the first few seconds leaves the remaining clues intact.

---
title: "Distributed Audio Clues Survive Local Trimming"
---
flowchart LR
    accTitle: Distributed audio clues survive local trimming
    accDescr: When marked evidence is spread through a track, removing the opening can leave evidence in the middle and end.
    A["Clues spread across opening, middle, and end"] --> B["Trim the opening 10 seconds"]
    B --> C["Middle and end sections keep enough clues for detection"]

Spreading clues across audio accomplishes two key goals:

  1. Survives local trimming: Deleting one section leaves clues intact elsewhere in the file.
  2. Pinpoints AI segments: The detector scans through time to identify exactly which parts of a long track contain AI audio.

Google SynthID scans entire audio tracks to identify sections generated by Lyria. Longer audio clips provide more clues, helping the detector deliver confident results. Google's Lyria announcement details this audio scanning capability.

How an audio watermark reacts to common edits

Suppose you edit a one-minute audio track created by Google Lyria:

Common edit What changes in the file How the watermark reacts
Trim the first 10 seconds The opening audio disappears Opening clues vanish; middle and end clues remain intact
Compress to MP3 format High-frequency details simplify Sound numbers change, but the core watermark pattern survives
Add background noise New sound mixes into the track Noise covers parts of the pattern, but the detector still reads the underlying clues
Speed up playback Audio plays faster and shifts pitch A detector configured for speed shifts recognizes the adjusted pattern
Replace 90% of the track Original AI audio gets deleted Almost all clues vanish, causing detection to fail

Google SynthID audio resists MP3 compression, added noise, and speed adjustments. Google's audio research paper outlines these survival limits.

Video watermarks

Video combines image and audio techniques. An AI video generator like Google Veo or OpenAI Sora creates moving pictures alongside an audio track.

When you record someone waving, your camera captures a rapid series of still photographs called frames. Playing these frames quickly creates the experience of smooth motion.

---
title: "Video Consists of a Sequence of Still Frames"
---
flowchart LR
    accTitle: Video consists of a sequence of still frames
    accDescr: Successive still frames show a hand moving farther across the picture and create the experience of continuous motion.
    F1["Frame 1<br/>hand starts wave"] --> F2["Frame 2<br/>hand moves right"]
    F2 --> F3["Frame 3<br/>hand reaches top"]
    F3 --> F4["Frame 4<br/>hand moves left"]

Frame rate measures how many still pictures play each second (such as 24 or 60 frames per second).

A complete video file contains two distinct data streams:

Video data stream Physical content What you experience
Picture stream Pixel grids played across time Moving visual pictures
Audio stream Sound measurements recorded over time Speech, music, or background noise

Each stream receives its own watermark. AI tools watermark video frames in the picture stream and audio measurements in the sound stream.

Google SynthID for video embeds an invisible pixel watermark into every individual frame generated by Veo. Viewers watch high-quality video, while AI detectors scan the frame pixels over time to verify origin. Google DeepMind explains video frame watermarking here.

---
title: "Video Watermarking Across Frames"
---
flowchart LR
    accTitle: Video watermarking across frames
    accDescr: An AI creates frames, an AI watermaker adds pixel patterns to each frame, and an AI detector scans frames over time.
    A["Veo creates video frames"] --> B["AI watermaker marks each frame's pixels"]
    B --> C["Marked video plays"]
    C --> D["AI detector scans frames over time"]

Audio and video share one unifying principle:

Spreading hidden clues across time - through sound measurements or video frames - gives AI detectors multiple opportunities to recognize the watermark.

How video edits affect frame watermarks

Editing a video alters or removes marked frames:

Video edit What changes in the file How the watermark reacts
Cut out one scene Removes marked frames from that scene Clues in deleted frames vanish; remaining scenes keep their clues
Crop video edges Removes outer pixels across frames Loses outer pixel clues; inner frame clues survive
Apply color filter Shifts pixel values across all frames Alters pixel numbers while preserving the core watermark structure
Change frame rate Drops, doubles, or recalculates frames Remaining original frames keep their watermark clues
Compress for web sharing Simplifies visual detail across frames Changes exact pixel numbers while the watermark pattern remains readable
Replace all video frames Deletes the entire original picture stream Erases all original frame watermarks completely

Google SynthID video watermarks resist cropping, color filters, frame-rate changes, and web compression. Google's SynthID overview defines these capabilities and limits.

Analyzing combined video clips

Suppose you edit a 20-second video by joining a 10-second Google Veo AI clip to a 10-second iPhone camera recording:

---
title: "One Video Assembled From Two Sources"
---
timeline
    accTitle: One video assembled from two sources
    accDescr: The first ten seconds contain marked generated frames and the next ten seconds contain unmarked camera frames.
    title One video assembled from two sources
    0-10 seconds : Marked Veo AI frames
    10-20 seconds : Unmarked iPhone camera frames

Each section retains its original status. The Veo section carries hidden watermark clues, while the iPhone section remains un-watermarked.

Google Gemini's video checker scans files and reports specific timestamps where it detects SynthID. If Gemini highlights seconds 0 to 10, it confirms AI generation in that specific portion. Gemini's help guide explains how portion checking works.

Verification tools and scope

Different AI tools apply watermarks according to their specific product rules:

AI Product What Google marks Scope limit
Lyria Embeds SynthID into all Lyria audio tracks Other music tools use their own watermarking systems
NotebookLM Embeds SynthID into generated podcast audio clips Source documents uploaded into NotebookLM remain un-watermarked
Veo Embeds SynthID into generated video frames Real camera videos contain no Veo watermark

When Veo generates video with sound, check both picture and audio streams separately to confirm origin details.

Try watermarking verification with public tools

You can test these concepts today using public verification tools.

Protect private content

Upload public or non-sensitive files when testing online tools.

Check Google AI files in Gemini

Open Gemini, upload an image, audio, or video file, and ask Gemini if Google AI created it.

Gemini scans for Google SynthID watermarks and attached C2PA Content Credentials. Gemini currently detects SynthID marks made by Google AI tools. Google's Gemini help center details file size limits and supported formats.

Google also tests a dedicated SynthID Detector portal with journalists and media organizations.

Check OpenAI files on OpenAI Verify

Open OpenAI Verify and upload an image or audio file. The tool scans for C2PA Content Credentials and SynthID watermarks created by ChatGPT, DALL-E, and OpenAI APIs. OpenAI's official guide lists supported detection formats.

Inspect C2PA Content Credentials directly

Visit Content Credentials Verify to inspect signed history notes attached to a file. This site reads metadata history to display creation dates, editing tools, and digital signatures.

Perform a safe comparison experiment

You can observe how metadata and pixel watermarks travel by running a quick test:

  1. Upload an original AI image to an inspector tool and record the results;
  2. Take a screenshot of that same AI image;
  3. Upload the screenshot to the inspector tool; and
  4. Compare which metadata notes vanished and which pixel watermarks survived.

This experiment proves that attached file notes and embedded pixel patterns travel independently when files are edited or captured.

Reading results across media

Images, audio, and video apply the same core watermarking principle across different materials:

Medium Basic building block Where SynthID hides Why spreading clues helps
Image Pixels in a picture grid Inside pixel color numbers Cropping one edge leaves clues across the rest of the picture
Audio Sound measurements over time Inside a pitch-and-time map (spectrogram) Trimming the opening leaves clues in the middle and end
Video Still picture frames over time Inside pixels across every generated frame Cutting one scene leaves clues in remaining marked frames 
---
title: "How Spread-Out Clues Survive Edits"
---
flowchart TB
    accTitle: How spread-out clues survive edits
    accDescr: An AI detector finds clues after an edit changes or removes part of a file.
    A["AI tool scatters hidden clues across a file"] --> B["An edit changes or removes part of the file"]
    B --> C{"Do enough hidden clues remain?"}
    C -->|"Yes"| D["AI detector identifies the watermark"]
    C -->|"No"| E["Watermark undetectable or missing"]

Conclusion

Images, audio, and video can carry a watermark by spreading a signal across pixels, sound measurements, or frames. That is why one ordinary crop, trim, or compression step may not remove it. But detection is still only evidence about a specific scheme and submitted sample - not a final verdict on the whole file, its author, or its truthfulness.

This completes the three-part foundation. How to Understand Anthropic's Announcement About Watermarking Content uses these ideas to explain the company's new commitments and the questions that its forthcoming technical documentation will need to answer.

References and further reading

Open the complete reference catalog

Primary Sources