AI Leaves a Trace

01 / Before the watermark

How does AI create anything?

Generative models learn patterns from large collections of data. When you give one an instruction, it does not search a vault for one finished answer. It produces a new output from a landscape of learned possibilities.

Each medium has a different generation process. Text watermarking can act on token choices. Image, audio, and video watermarking can embed signals in the generated media. The family resemblance is simple: the generator has room to make choices, and some of those choices can carry a signal.

02 / One choice at a time

How does AI know what comes next?

People often say a language model predicts the next word. More precisely, most modern language models work with tokens—pieces of text that might be a whole word, part of a word, punctuation, or code.

The hidden signal

A watermark can live in the choices themselves

Imagine several next tokens that would all make sense. A watermark-aware generation process can slightly change how those candidates are sampled. Across one choice, the adjustment tells us almost nothing. Across hundreds of choices, a statistical pattern can emerge.

Green and red tokens are an intuition—not a universal recipe

A landmark 2023 ICML paper described a method that pseudorandomly divides candidate tokens into “green” and “red” sets, then softly favors the green set. That makes a wonderful mental model:

Important: this green/red picture explains one class of academic techniques. Google’s published SynthID Text uses tournament sampling, and Anthropic has not published Claude’s exact algorithm. The visual is not evidence that either system uses a fixed green-word dictionary.

03 / Try the idea

Token Watermarking Simulation

This toy model has a tiny vocabulary. In watermark mode, a seeded rule gives some valid choices a modest statistical preference. Generate a sequence, then let the toy detector count how often those preferred choices appeared.

How a real detector thinks

A detector compares the observed pattern with the pattern expected under its watermarking scheme. The answer is probabilistic: likely detected, no recognizable mark, or uncertain.

Think about coins. Four heads in five flips is unremarkable. Eight hundred heads in one thousand fair flips would be extraordinary. Longer, varied text gives a detector more choices to examine; “New Delhi.” gives it almost none.

04 / One idea, four media

SynthID is a family, not one copied-and-pasted algorithm

Google DeepMind launched the first SynthID image beta in August 2023, expanded it to Lyria-generated audio that November, and announced text and video watermarking in May 2024. The SynthID Text paper appeared in Nature in October 2024, and Google released implementations for developers.

The visuals above teach the concept. They do not reproduce Google’s proprietary image, audio, or video embedding systems.

05 / Watermarking is not the whole story

An invisible fingerprint and a signed passport

A watermark can place a signal inside content. C2PA Content Credentials take a different route: a cryptographically signed set of provenance statements is bound to an asset.

C2PA is not “just EXIF.” A Content Credential can contain assertions about creation and edits, a claim, a content binding, and a digital signature. A validator checks whether those statements are correctly bound and untampered. It does not certify that an image is truthful or that its message is trustworthy.

06 / What about source code?

Code is generated as tokens, too

Ask a coding model: Write a Python function to check whether a TCP port is open. It has many valid ways to answer.

def is_port_open(host, port):
    with socket.socket(
        socket.AF_INET,
        socket.SOCK_STREAM
    ) as sock:
        sock.settimeout(2)
        return sock.connect_ex(
            (host, port)
        ) == 0

def check_port(host, port):
    s = socket.socket(
        socket.AF_INET,
        socket.SOCK_STREAM
    )
    s.settimeout(2)
    try:
        return s.connect_ex(
            (host, port)
        ) == 0
    finally:
        s.close()

Function names, variable names, context managers, error handling, comments, statement order, formatting, and even the algorithm are all generation choices. In theory, some choices could receive a statistical preference while the program remains functionally equivalent.

Conceptual code-watermarking example—not a demonstration of any proprietary system.

The problem: developers constantly transform code

for device in devices:
    process_device(device)

Renaming, formatting with Black or Prettier, linting, adding comments, extracting helpers, changing a loop into a comprehension, refactoring an algorithm, transpiling, and compiling can all alter or erase the original token sequence.

Academic systems exist. For example, the ACL 2024 paper SWEET selectively watermarks higher-entropy code tokens because ordinary code contains many low-choice regions. That is research evidence—not proof that Claude Code, Codex, Gemini, GitHub Copilot, or another assistant currently watermarks source code in that way.

In prose, the watermark may hide in word choice. In code, it could hide in implementation choice.

07 / Can the trace disappear?

Robust does not mean indestructible

Watermark survival depends on the medium, the implementation, the strength of the transformation, and the detector. Good systems are evaluated against ordinary edits, but none should be treated as perfect.

Short, factual answers leave less room

Researchers call this freedom entropy. More plausible options create more room for a statistical signal. Google explicitly notes that SynthID Text is less effective for factual answers and works better with longer, varied responses.

Does the watermark know who you are?

Not inherently. A detector can be designed simply to answer whether a supported pattern is present. OpenAI says its current verification result does not identify who created a file. Anthropic describes its mark as evidence that Claude may have processed content, not as an identity tag.

But provenance systems vary. In C2PA, a claim is digitally signed on behalf of a signer using a signing credential, while assertions can include provenance details chosen by the implementer. That is still separate from a watermark. Account logs, prompt records, timestamps, and signed provenance manifests are different things; never assume one contains—or excludes—the others without reading that system’s documentation.

Why is this happening now?

Watermarking research predates today’s regulation, but law is accelerating deployment. Article 50 of the EU AI Act requires providers of systems that generate synthetic audio, image, video, or text to mark outputs in a machine-readable, detectable way, as far as technically feasible. The provider duty has stated exceptions for systems that merely perform standard editing assistance or do not substantially alter input data, and for certain legally authorised law-enforcement uses. These transparency obligations became applicable on August 2, 2026.

The European Commission’s voluntary Code of Practice is an officially recognised route for signatories to demonstrate compliance. Separate deployer duties cover deepfakes and some AI-generated public-interest text; the public-interest-text duty has an exception where content has undergone human review or editorial control. The law does not prescribe one universal technology for every medium.

Formats are not modalities

PDFs, JSON, spreadsheets, and everything else

08 / Quick answers

Questions people actually ask