Three different things get called an AI watermark, they work nothing alike, and the difference decides whether anything survives you posting the file. Most of the confusion in this topic, and all of the bad advice, comes from treating them as one thing.
The three layers, and what each one actually is
1. Content Credentials (C2PA), which is metadata
C2PA is a cryptographically signed record travelling alongside the file. It says which tool made this, when, and what was done to it since. The signature is the clever part: alter the file and the signature stops matching, so tampering shows up as tampering rather than passing silently.
It is also the most fragile layer by a distance, and fragile in a way people consistently underestimate. It is attached data, not part of the picture. Screenshot the image and it is gone. Re-encode it and it is gone. Push it through a platform that rewrites uploads and it is usually gone, without anybody deciding to remove it.
2. SynthID, which is in the pixels
Google DeepMind's SynthID is a different animal. Rather than riding alongside the file it modifies the content itself, adjusting pixels (or audio samples, or token choices in text) in a pattern a detector can recover but a person cannot see. Google has said it has marked well over a hundred billion pieces of content this way.
Because it lives in the content, the things that destroy metadata do not touch it. Screenshot a SynthID image and the watermark is still in the screenshot. That is the entire design goal, and it is why the two layers exist together rather than one replacing the other.
3. Classifiers, which are guessing
The third layer is a model trained to recognise generated content by its statistical fingerprints. No cooperation needed from whoever made the file, which is the appeal. The catch is that it is inference rather than a record, so it produces false positives on real photographs and false negatives on generated ones, and it cannot show its working. Treat a classifier verdict as evidence, never as a finding.
| Layer | Where it lives | Survives a screenshot | Tells you |
|---|---|---|---|
| Content Credentials (C2PA) | Attached metadata | No | Who made it and what was edited |
| SynthID | The pixels themselves | Yes | That a marking model produced it |
| Classifier | Nowhere, it is inferred | Not applicable | A probability, not a record |
Re-encoding, cropping and most platform uploads destroy attached metadata as a side effect. None of them touch an in-pixel mark.
What the platforms actually do
The labels you see are mostly reading layer one. Meta's AI Info label, TikTok's use of Content Credentials, YouTube's disclosure requirements for realistic synthetic content: these lean heavily on signals that arrive with the file from a cooperating generator. Google has been moving detection closer to where people look, into Search and Chrome directly.
That has a consequence worth sitting with. A label largely reflects what the platform could read, not what is true. Content generated by a tool that marks its output, uploaded intact, gets labelled. The same content screenshotted first often does not, because the thing being read no longer exists.
Meta learned the awkward version of this publicly. Its original wording implied a picture was AI-made when the underlying signal only showed that generative editing tools had touched it. Photographers who had used a standard retouching feature found their real photographs labelled as AI. The wording got softened. The underlying problem, that a provenance signal says less than the label implies, did not go anywhere.
The claim nobody makes clearly enough
No watermark scheme covers the internet, so the absence of a watermark tells you almost nothing. An unmarked file might be a real photograph. It might be from a generator that marks nothing. It might be generated, marked, and then stripped by nothing more sinister than a screenshot or an upload.
Presence is informative. Absence is not. Most writing on this subject quietly inverts that, and every "is this AI" tool that returns a confident percentage on an unmarked file is selling you a guess wearing a number.
What this means if you make content for a living
Two practical things follow, and they point in opposite directions depending on what you are trying to do.
If you want provenance to stick, stop screenshotting. Screenshots are the single most common way real provenance gets destroyed, usually by someone trying to be helpful. Upload originals, and prefer platforms that preserve credentials.
If your worry is the other direction, that a real photograph gets labelled because you used a generative retouch, understand that the signal is attached at the editing step and travels with the export. Knowing which of your tools write that record is more useful than arguing with a label after the fact.
The removal tools, and why the honest answer is unsatisfying
Search for removing an AI watermark and you will find tools promising exactly that. Nearly all of them strip metadata. That genuinely removes layer one, because layer one is only ever attached data, and you could achieve the same by taking a screenshot.
What they do not do is touch SynthID, and it is worth being precise about why rather than taking anyone's word for it. A pixel-level watermark that broke under re-encoding would be useless, so surviving re-encoding, cropping and compression is the specification rather than an incidental strength. A browser-side tool that re-saves your file has done nothing to it.
So a tool marketed as an AI watermark remover is doing one of two things. It is a metadata stripper with an ambitious product name, which is a real and useful thing to be, or it is claiming something it cannot demonstrate.
Metadata stripping has plenty of legitimate uses that have nothing to do with provenance. A photograph off a phone can carry GPS coordinates, a device serial, and a timestamp, and publishing a picture of your own house with its coordinates attached is a genuine privacy problem that has caught out plenty of people. That is worth doing on its own terms, and it is worth being clear that it is a different job from what the marketing implies.
Where this is heading
The direction of travel is the two layers converging: a fragile signed record for the full edit history, plus a durable in-content mark that survives the ordinary destruction of that record. Providers who competed on separate schemes have been moving toward carrying both, which is the sane outcome, because each covers the other's failure.
What that does not fix is the base rate. Enormous volumes of content come from tools that mark nothing at all, and no amount of cooperation between the largest providers changes what an unmarked file means. Better provenance for marked content, and the same silence everywhere else.