A visible watermark is a logo in the corner. An invisible watermark is a pattern of tiny changes spread across the image, too small for the eye to notice, that a detector can read back out.
How they survive
A naive hidden signal would vanish the first time an image was resized or re-saved as a JPEG. Modern watermarks are designed around that. They spread the signal redundantly across the whole image and encode it in features that compression and scaling tend to preserve.
The trade-off is always the same: a stronger, more robust watermark changes the image more. Designers tune for a signal that is invisible at normal viewing and still readable after ordinary handling.
The main schemes
TrustMark is an open-source watermarking method released by Adobe. Its role in the C2PA ecosystem is as a "soft binding": if Content Credentials are stripped from a file, the watermark can carry an identifier that points back to a stored copy of them. Because it is open, anyone can build a detector for it.
SynthID is Google DeepMind's watermark for content from Google's generative models. It is embedded at generation time, and detection has been offered through Google's own tools rather than as an open standard.
Other AI companies use their own methods, some documented, some not. There is no single universal watermark, and no single detector that reads them all.
What a detection means
Finding a watermark is strong evidence. Watermarks are deliberately embedded, so a positive reading usually means the image passed through a system that marks its output - an AI generator, or a provenance-aware workflow.
For TrustMark specifically, a detection can also let a checker recover information about credentials that were stripped from the file.
What a missing watermark means
Very little, for three reasons.
- Most images are not watermarked. Most cameras, phones and many generators add nothing.
- Detectors only read the schemes they know. A TrustMark scan will not find SynthID, and vice versa.
- Watermarks can be damaged. Heavy editing, aggressive cropping or deliberate attacks can weaken or remove them, and research regularly shows new ways to do so.
So "no watermark found" should always be read as "no watermark of this kind found", not as "not AI".
Watermarks versus signatures
It helps to keep the two ideas separate.
- A C2PA signature is precise and verifiable, but fragile: it lives in metadata and breaks if anything changes.
- A watermark is robust, but carries less information and gives a probabilistic reading rather than a cryptographic proof.
The provenance standards use them together for that reason: the signature for certainty while the file is intact, the watermark to find the way back when it is not.
In practice
- Check for Content Credentials first - if intact, they say more than a watermark can.
- If credentials are missing, scan for watermarks you can actually detect.
- Treat a positive result as strong evidence.
- Treat a negative result as neutral, and move on to metadata, earlier copies and context.