AI Detection: Watermarks vs. Metadata

The mechanism

Detecting AI-generated content is technically harder than adding a signature. The industry is shifting from simple visible labels to two distinct layers: metadata (C2PA) that travels with the file header, and invisible watermarks woven into the content itself. While Anthropic and OpenAI are deploying these systems, the ability to verify them depends heavily on whether the file remains unaltered. This guide breaks down the mechanism, the limits of current tools, and why the dynamic between generation and detection is far from settled.

This is a technical breakdown, not a guide on how to bypass these systems.

Defining the layers: Labels vs. Signatures

When a piece of content is flagged as "AI-generated," it can mean two very different things. The first is a visible label or a user interface tag (like a "Created with AI" badge). This is a UI choice, easily removed by taking a screenshot or downloading the image.

The second layer is the technical signature. This is where the real mechanism lies. It splits into two approaches:

1. Metadata (C2PA): A digital passport attached to the file header.
2. Invisible Watermarking: A statistical signal embedded directly into the pixels or the text.

The core tension is that metadata is fragile (it breaks if the file is edited), while watermarks are robust (they survive editing) but harder to detect without the right keys.

The C2PA mechanism: A digital passport

Content Credentials (C2PA) work by associating provenance metadata with digital assets. As noted by blogdumoderateur.com regarding OpenAI's tools, these credentials allow systems to determine if an image was generated via an API or a chat interface.

Think of C2PA as a digital chain of custody. When a model creates an image or text, the system signs the file with a cryptographic key, recording the tool used and the timestamp. If you upload the original file to a verifier, the signature validates the origin.

However, the vulnerability is structural: manual edits break the chain. If a user crops an image, converts the format (e.g., from PNG to JPEG), or copies text into a plain document, the C2PA metadata is often stripped or invalidated. The signature does not survive the transformation because it lives outside the content, in the file's header.

As OpenAI stated in its rollout, the goal is to contribute to a more interoperable ecosystem by adopting C2PA alongside other tools. But the standard relies on the file remaining intact from creation to verification.

Invisible watermarking: Weaving the signal

To solve the fragility of metadata, companies like Anthropic and Google have turned to invisible watermarking. This approach integrates the signature directly into the content.

According to reporting by Pasquale Pillitteri, since August 2, 2026, every Claude model launched from that date produces text with a digital watermark integrated into the words themselves. Anthropic formalized this by signing the code of good practices under Article 50(2) of the EU AI Act.

The mechanism is distinct from C2PA:

• Text: The watermark is described as an "imperceptible signal woven into the words themselves." It alters the statistical probability of word selection in a way that is invisible to the human reader but detectable by a specific algorithm.
• Images: Similarly, systems like Google's SynthID embed a pattern into the pixel data.

Because the signal is part of the content, it survives screenshots, format conversions, and minor edits. If you copy a watermarked paragraph into a text editor, the statistical pattern remains, theoretically allowing a detector to identify the source even without the original file header.

The detection challenge: A moving target

If watermarks survive editing, why is detection still difficult? The answer lies in the asymmetry between generation and verification.

While the creation of a watermark is deterministic (the model knows the secret key), the detection requires a specific tool and often the original context.

• False Negatives: If a text is heavily rewritten, translated, or summarized, the statistical signal may degrade below the detection threshold. The watermark is robust, but not indestructible.
• False Positives: Statistical detectors can sometimes flag human-written text as AI if the style mimics the model's output patterns.
• The Tool Gap: As noted in the reporting on Claude's rollout, a public detector is not always immediately available or universally compatible. The system relies on the verifier having the correct decoding key.

Furthermore, the landscape is fragmented. OpenAI's verification tool, launched in May 2026, combines C2PA metadata with Google's SynthID watermarking. It admits that no tool is infallible. The system works best when both signals are present and the file is unaltered. When only one signal remains (e.g., a watermarked text pasted into a new document), the detection becomes a statistical guess rather than a cryptographic proof.

The regulatory push (like the EU AI Act) mandates these markers, but the technical reality is that detection is a probability game, not a binary switch. The "moving target" is the constant evolution of how content is shared, edited, and repurposed across the web.

Going further

• Pasquale Pillitteri: How Claude's Invisible Watermark Works — A detailed breakdown of the statistical mechanism behind Anthropic's text watermarking and its relationship with the EU AI Act.
• blogdumoderateur: OpenAI's Tool to Identify ChatGPT Images — An overview of how OpenAI combines C2PA metadata and SynthID watermarks to verify image provenance.