Watermarking AI-generated content may seem like an algorithmic problem, but in practice, it involves a substantial amount of engineering. When people discuss AI watermarking, they often view it as a complex cryptographic or mathematical problem. Yet in real-world applications, the algorithms are often the easiest part to solve, while the key factors determining how the entire system is built are practical engineering constraints—including server capacity and cross-team collaboration. Currently, Google’s SynthID is the most comprehensive AI content identification system in public literature, spanning four modalities: text, images, audio, and video. Among these, no primary sources have been published for audio and video to date, leaving text and images as the only modalities with complete published papers.
These two published papers fully document how Google applies watermarks to massive amounts of content in real-world production. On the text side, there is the SynthID-Text paper published in Nature; on the image side, there is the image watermarking production deployment paper released last October (arxiv:2510.09263, subtitled Image watermarking at internet scale). Powered by the image-side system, Google has already watermarked over 10 billion images and video frames across multiple online services. Reading this paper offers a clear look at how a hyperscale watermarking infrastructure is actually implemented in real-world production.
Looking at both papers side by side reveals a striking contrast: within the very same SynthID framework, text watermarking is seamlessly integrated token by token as the model writes, whereas image watermarking waits until the entire image is generated before being applied separately at the end of the pipeline. The choice of two different approaches was largely forced by three engineering realities, having little to do with which algorithm is more sophisticated: model training teams and safety teams operate independently, where any shared modification requires coordination between both sides; generating an image happens only once, yet the same image may be viewed repeatedly by thousands or millions of people; and images already published online cannot be un-written, meaning older watermark versions must remain verifiable indefinitely. As for the three core constraints of text watermarking (perceptibility, unforgeability, and robustness online) and the impossible trinity they form, articles like Claude Watermarks AI Content: Technically 90% Old Methods in New Scenarios and Invisible Signatures have already mapped out the landscape and serve as good references for deeper reading. Here, we focus solely on the engineering playbook underlying this system.
Achieving near-zero computational cost in text watermarking serves as the starting point for the entire system. Without understanding how text watermarking drove overhead down to near zero, it is impossible to appreciate why engineers faced such immense engineering friction when watermarking images.
The implementation of text watermarking is remarkably elegant, exerting influence during the model’s token selection process. Language models generate text one token at a time. For every token generated, the model computes a probability for every possible token in its vocabulary. The core idea behind SynthID-Text is straightforward: for each token generated, the system samples a set of candidate tokens from the model’s probability distribution and pits them against one another in a tournament. This tournament proceeds across several rounds, where the system scores each token using a secret key (private key) known only to the system; tokens with higher scores advance to the next round until a final winner emerges. Because the candidate tokens originate from the model’s own probability distribution to begin with—all representing plausible continuations in its view—whichever token is chosen will not significantly compromise text quality. When detecting whether a watermark is present, we simply score the generated text using the same rules and secret key. The simplest detection method is to sum the scores across all rounds and compute their average to evaluate the statistical bias. This method is called mean scoring.
Detecting text watermarks is likewise exceptionally resource-efficient, requiring no large language model whatsoever. The verifying party only needs the secret key to scan the words in the text and compute a statistical score. As the paper explicitly states: “watermark detection is computationally efficient, without using the underlying LLM”. The system does not embed extra metadata like author names or version numbers into the text; the key itself serves as the identity. In large-scale online production testing, the team sampled and analyzed approximately 20 million real user responses from Gemini, finding that the difference in upvote rates after watermarking was merely 0.01%, and the difference in downvote rates was only 0.02%—neither being statistically significant, indicating that users could barely perceive any difference. This scheme is currently deployed across Gemini and Gemini Advanced; although Google open-sourced a reference implementation of the algorithm, the keys and specific parameters running in production remain unreleased. Beyond directly averaging scores via mean scoring, the system offers a more robust alternative: training a model on extensive sets of watermarked and unwatermarked texts to calculate the probability that the text in question carries a watermark—an approach known as Bayesian scoring. However, this text watermark is far from unbreakable: the paper specifically notes that simply paraphrasing or rewriting the text noticeably weakens the watermark signal.
Text watermarking works effectively because text inherently enjoys unique advantages. A solution that succeeds in text often relies on many implicit preconditions. Understanding why these lessons cannot be directly ported to images is essential to grasping why image watermarking subsequently required so many intricate trade-offs.
The first pitfall lies in the fundamental difference in physical structure between text and images. Text consists of sequences of discrete tokens; every time the AI generates a token, it can choose among several candidates. An image, by contrast, consists of millions of contiguous pixels. Modern AI image generation relies on diffusion models, akin to ink slowly dispersing in water—a continuous evolutionary process devoid of discrete candidate tokens. Embedding an imperceptible watermark across an entire image cannot be done by selecting candidates on the fly; instead, it requires training two dedicated deep neural networks—an encoder to conceal the secret signal within the pixels, and a decoder to extract it—blending the watermark signal into the subtle luminance and chrominance relationships across millions of pixels.
Once the medium shifts to images, the computational overhead flips entirely. Watermarking an article requires only a few lines of code with virtually zero compute, and detection is merely basic arithmetic statistics. For images, however, applying a watermark even once requires running the entire image through a massive neural network. Even more challenging is the deluge of requests hitting the receiving end: while few people scan the entire web piece by piece to check if a snippet of text is watermarked, image watermarking from day one must confront billions of circulating images across the internet. When analyzing efficiency, the paper explicitly notes that decoder invocations can be several orders of magnitude higher than encoder invocations, as decoders must not only check user uploads, but also handle routine content moderation on social media, automated indexing by search engine web crawlers, and massive scanning runs by other foundation model developers filtering web-scraped training corpora. How many images a single machine can verify per second (decoding throughput) immediately becomes the critical bottleneck constraining the entire system.
What truly forced the engineering team’s hand was organizational friction and cross-team collaboration. If watermarks were tightly integrated directly inside the image generation model (a customized approach termed “ad-hoc” in the paper), any architectural modification by the upstream generative modeling team could invalidate downstream watermarking. The paper concedes that at scale, such an ad-hoc approach cannot support all current and future models with a single watermark. Consequently, the team settled on a post-hoc method: generate the image first, and then apply the watermark as a separate downstream step. To be sure, post-hoc processing modifies already generated pixels, representing a lossy alteration. Yet through disciplined algorithmic design, the team strictly safeguarded baseline image quality, keeping visual degradations imperceptible to the human eye.
The overall workflow of image watermarking is remarkably straightforward, resembling a two-stage assembly line. Once the upstream AI image generation model produces a complete image, it passes the image directly to an independent encoder network (in communication theory, the watermark is the payload signal to be transmitted, the original image serves as the channel carrying this signal, and the network that embeds this signal into the image is called the encoder or embedder). The encoder performs a swift pass over the entire image, generating a newly watermarked image to deliver to the user. When verification is needed, the image is passed directly to a corresponding decoder network to extract the secret signal. The entire detection process requires neither reference to the original unwatermarked image nor knowledge of the prompt used during generation; any image can be inspected directly on its own—a capability known technically as blind detection.
Beyond simply distinguishing whether an image is AI-generated, this watermark can also embed detailed provenance metadata into the image. While the earliest version merely determined whether an image was AI-generated, the SynthID-O release for enterprise clients allows engineers to embed up to 136 bits of auxiliary payload into a single image. This auxiliary payload can specify which company generated the image using which version of which AI model, enabling highly granular provenance tracking.
To ensure watermarks survive the open internet, the models responsible for embedding and extracting watermarks are co-trained under rigorous degradation pipelines. During development and training, the encoder and decoder are tied together and trained end-to-end. During training, the system intentionally subjects images to an array of severe distortions—such as aggressive low-quality JPEG compression, random cropping, color jittering, and blur filters. Under this demanding adversarial regime, both networks continually adapt, learning to conceal the secret signal within image features that persist even after heavy manipulation and distortion. Once the system enters production, the battleground shifts to an ongoing contest between safety teams and external adversaries.
Image generation faces an inherent physical constraint: the watermark can only be applied after the image is fully generated, rather than on the fly. The paper highlights that while audio and video can be generated chunk by chunk and watermarked in streaming slices, a single static image must be completed as a cohesive whole—which is why the paper underscores that “watermarking has to be performed after generation”. This strict sequential requirement—finishing generation before watermarking—firmly establishes the boundary conditions for all downstream engineering designs.
When deploying such a system to the open internet to process massive daily verification traffic, the truly existential challenges are practical engineering hurdles. Once technology leaves the laboratory, the system is no longer judged by theoretical benchmark scores in a paper, but by latency, concurrency handling, backward compatibility across legacy versions, and resilience against malicious tampering. Understanding the following five engineering challenges reveals how real-world watermarking infrastructures walk the delicate tightrope between performance and security.
Positioning watermarking after image generation offers one supreme advantage: drastically cutting the overhead of cross-team coordination. Within large tech companies, foundational model teams and safety/compliance teams operate with markedly divergent goals and rhythms. The modeling team constantly tweaks network architectures, tunes sampling steps, and integrates new training modules. Had watermarking code been intertwined directly within the generative model, every model update would require the safety team to retune the watermark, trapping both teams in perpetual coordination and paralyzing rapid product iteration.
Decoupling watermarking into an independent downstream service allows both teams to execute with autonomy. The safety team wraps watermarking into a standardized service interface: whether upstream teams use legacy models or yet-to-be-developed future architectures, they output standard color images regardless. Whether the safety team wants to benchmark latency, rotate encryption keys, upgrade watermarking models, or introduce telemetry toggles, they can do so entirely within their own boundaries without requiring upstream modeling teams to modify their code. Although this decoupled workflow necessitates modifying already generated pixels, strictly bounding the perturbation magnitude within the watermarking model keeps image quality degradation entirely imperceptible to the human eye.
Looking solely at the latency required to generate an image severely underestimates the operational load placed on the system. Across the internet, an image is generated only once, but once distributed, it is continuously inspected by end users, crawlers, and content moderation systems—magnifying the demand for watermark verification exponentially.
The decoder tasked with verifying watermarks may experience invocation frequencies several orders of magnitude higher than the embedder. An image is watermarked only once upon generation; yet once published to the open web, thousands of users browse it, search engine crawlers index it, social media safety pipelines screen it frame by frame, and foundation model teams scrape it during web-scale dataset curation. Every one of these scenarios can trigger a watermark verification request. Furthermore, in production pipelines, watermark inspection is frequently executed concurrently with C2PA cryptographic manifest verification and image resizing (C2PA is a tamper-evident digital metadata manifest, whose synergy with watermarking will be discussed in detail later).
Consequently, the number of images a single server can process per second becomes the linchpin for whether the entire system is viable. Designing a heavy, complex watermark decoder would lead to unsustainable server compute and energy costs when fielding massive daily verification requests across the web. The engineering team had to make the decoder as lightweight as possible, ensuring that even commodity servers could sustain web-scale verification demands under high concurrency.
Academic watermark detection methods in the past were often overly idealized, leading to frequent false positives on unwatermarked images in real-world scenarios. Early literature routinely adopted a simplifying assumption: each bit (0 or 1) extracted from an image is mutually independent, behaving like an unbiased coin flipped repeatedly with an equal probability of landing on heads or tails (known mathematically as a Bernoulli distribution). Under this approach, whenever the number of matching bits extracted from an image exceeds a predetermined threshold, the image is declared watermarked.
Real-world imagery, however, is immensely diverse and cannot be treated like independent coin flips. Many web images feature vast expanses of solid blue sky or dense grids of architectural lines—textures that introduce strong spatial correlations to the watermark decoder, causing certain bit patterns to cluster spuriously. If evaluated against rigid coin-flip formulas, the system would routinely misclassify unwatermarked everyday photographs as AI-generated, producing widespread false positives. The authors therefore abandoned this unrealistic mathematical assumption in favor of a statistical framework anchored directly in empirical real-world data: first observing the distribution of scores across real unwatermarked images, and then using this calibration baseline to rigorously bound the error probability. This approach is known as conformal prediction, and the resulting metric is called the conformal p-value.
Using conformal prediction with real-world data as a calibration benchmark confers three distinct operational advantages. Prior to deployment, the system reserves a calibration set of authentic images specifically to establish the baseline score distribution. This provides three engineering benefits: first, it mathematically guarantees that the false positive rate will not exceed a predefined upper bound; second, if an image is heavily cropped or corrupted such that the signal is too faint, the detector can abstain from making a forced determination; third, if web image distributions shift over time, engineers can simply collect fresh images and recalibrate the lookup table without needing to retrain the underlying neural network.
Another critical challenge is that while standard software updates allow deprecating and decommissioning older versions at will, watermarking infrastructures cannot afford that luxury. Typical software services can sunset legacy APIs once a new version deploys. But watermarked images, once released onto the open internet, escape the system’s perimeter—legacy images remain in circulation forever.
Once a legacy watermark version is released into the wild, corresponding detection tooling must support that version in perpetuity. As the paper highlights, if a particular encoder version watermarks an image, that image may circulate online for years or even decades, meaning it must remain verifiable at any point in time. Consequently, the encoder version dictates the generation identifier of the entire system. As long as an encoder generation has been active in production, server-side detection for that generation cannot be retired; it must support verification indefinitely.
To defend against emerging evasion techniques, the verification pipeline must maintain multi-generational detection capabilities simultaneously. While legacy detection cannot be discontinued, watermark decoders must be upgraded regularly to counter new tampering methods devised by adversaries. Production verification services must therefore maintain an all-generation compatibility matrix: a unified query endpoint capable of recognizing signals embedded years earlier by first-generation models while simultaneously parsing second-generation and bespoke custom variants. The paper cautions that if an early-generation encoder contains a security flaw, that vulnerability must be carried forward across decades of backward compatibility, turning into permanent legacy debt.
Before addressing tampering countermeasures, we must examine which system components an adversary can access. Discussing defense in a vacuum without context is meaningless; the paper outlines three distinct operational settings: first, fully closed internal systems completely inaccessible to external users; second, cloud services offering external APIs; and third, open-weight systems where model parameters are publicly released.
The most pragmatic defenses rarely involve intricate cryptography; they rely on server-side operational controls. For public-facing endpoints, for instance, the most straightforward measure is enforcing rate limits at the API gateway (e.g., capping requests per second). This prevents adversaries from executing high-frequency probing attacks across tens of thousands of test images to reverse-engineer watermark patterns. Another approach provides watermarking modules to vetted enterprise partners under trust agreements rather than releasing raw model weights, preventing adversaries from performing white-box attacks via access to model internals.
Against black-box attacks where adversaries can only probe the system externally, the paper presents four robust countermeasures. First, distortion-resilient training dramatically drives up removal costs, forcing attackers to degrade image quality to unwatchable levels or expend prohibitive compute to scrub the watermark, rendering the effort economically irrational. Second, injecting stochastic perturbations during each embedding run prevents attackers from averaging hundreds of identically watermarked images to cancel out the signal. Third, conditioning the watermark payload on the specific image content prevents adversaries from grafting a valid watermark extracted from Image A onto Image B. Fourth, deliberately abstaining from watermarking extreme images: much like text watermarking skips verbatim memorized classical poetry, an image watermarking system selectively abstains when encountering solid white, solid black, or virtually textureless minimalist images, avoiding forced embeddings that would visibly degrade pristine surfaces.
When combining C2PA cryptographic signatures with imperceptible watermarking, the two techniques complement each other to build a far more reliable defense. While many mistakenly view them as competing approaches, they operate synergistically in production engineering. C2PA functions like a cryptographically signed digital identity card attached to an image; as long as this manifest remains intact, verification accuracy is exceptionally high. In practice, however, many social media platforms automatically strip file metadata upon re-upload, rendering C2PA unverifiable once the manifest is lost. Imperceptible watermarking, by contrast, weaves the payload directly into the luminance and chrominance relationships across millions of pixels. Even if platforms strip all metadata clean, the payload persists—though its limitation is that severe blurring, heavy compression, or editing can degrade the signal.
Combining both mechanisms with visual perceptual hashing builds a multi-layered defense: even if an adversary manages to forge a counterfeit C2PA signature, forging the 136 bits of enterprise payload concealed within the pixels remains extraordinarily difficult, and matching it against visual fingerprint databases in the backend is harder still. In its conclusion, the paper candidly acknowledges that SynthID-Image alone cannot solve disinformation, identity impersonation, or copyright disputes; watermarking by itself does not provide a tamper-proof chain of custody. It must integrate into a broader tooling ecosystem alongside provenance manifests like C2PA, relying on cross-industry platform cooperation to achieve meaningful impact in the real world.
Viewing the text and image papers side by side reveals a universally applicable set of system design principles. Setting specific model architectures aside, these two seemingly disparate systems share five foundational engineering tenets at their architectural core:
Placing the text and image approaches in a direct comparison table immediately clarifies why they made divergent engineering trade-offs:
| System Consideration | Text Watermarking (SynthID-Text) | Image Watermarking (SynthID-Image) |
|---|---|---|
| Insertion timing | Applied on the fly during token sampling | Appended separately at the end of the post-generation pipeline |
| Payload location | Concealed within candidate token selection, biasing specific choices | Concealed within subtle luminance/chrominance relations across millions of pixels |
| Impact on generation quality | Theoretically near-zero loss (candidates drawn from model’s own distribution) | Modifies pixels slightly; algorithmic constraints keep loss imperceptible to the human eye |
| Inputs required for verification | Test text plus secret key | Test image plus secret key (no reference original required) |
| Payload capacity | Single detection bit (no metadata; key itself serves as proof) | Rich operational payload (SynthID-O embeds up to 136 bits of provenance metadata) |
| Decision criterion | Mean scoring or Bayesian probability; abstains when evidence is insufficient | Conformal prediction on real data to guarantee error bounds; abstains when uncertain |
| Open-source availability | Reference algorithmic implementation open-sourced; production secret keys unreleased | Model weights unreleased; verification service accessible only to contracted testers |
| Relationship to generative model | Tightly coupled (code inserted directly into token sampling logic) | Decoupled (deployed as an independent service, compatible with any upstream model) |
These two outwardly different algorithms are, in truth, pragmatic compromises compelled by engineering realities. Why does the same company watermark text while it is being written, yet watermark images only after they are finished? That divergence was dictated by three engineering realities: the friction of cross-team coordination, whether a single machine can handle massive web-scale verification traffic, and whether decade-old images must remain verifiable into the distant future. It had nothing to do with which mathematical formulation researchers found more elegant; algorithmic design ultimately had to yield to these realities.
As watermarking technology matures, the decisive battleground has shifted from how watermarks are embedded to how they are verified. On the serving side, Google has launched public verification interfaces, which reportedly process around one million verification requests daily. Across the broader industry ecosystem, however, text watermarking remains heavily fragmented: media reports indicate that Google’s SynthID, the scheme used by Claude, and OpenAI’s textGrain system each rely on proprietary standards and isolated secret keys, remaining mutually incompatible.
On the detection end, the adversarial contest between attackers and security researchers is intense. The simplest evasion tactic for an attacker is paraphrasing text to alter its sentence structure. In a public audit, SRI Lab at ETH Zurich demonstrated that simple paraphrasing could achieve an evasion rate of over 90% against SynthID-Text watermarks. Another vector targets the default detector in open-source implementations: research reveals that if a detector relies strictly on unweighted mean scoring across rounds, increasing the number of tournament rounds (a layer-expansion attack) can blind the detector. In response, researchers recommend adopting Bayesian scoring for greater robustness. To tackle centralization—where only the originating platform holds the private key required for detection—recent studies have introduced novel paradigms. For example, PVMark leverages cryptographic zero-knowledge proofs to enable third-party verification without exposing private keys, removing reliance on centralized verification APIs managed by tech giants.
For teams looking to architect content provenance systems, these two papers offer a rigorous yardstick for assessing operational viability. Evaluating whether a watermarking scheme can survive in production cannot stop at superficial metrics like embedding latency in milliseconds or human imperceptibility. It demands confronting hard engineering realities: whether the system calibrates against empirical data when facing complex real-world content, whether released legacy watermark versions can be maintained with decades of backward compatibility, whether public-facing endpoints enforce robust rate limits against scraping and probing, and whether the infrastructure can absorb massive web-scale verification concurrency on cost-effective commodity hardware.