“Is this AI-generated?” turns out to be three questions in a trench coat, because the evidence lives in three different places with three different survival properties. Get the layers straight and a lot of confused reporting about watermark removal resolves itself.
The three layers
- The visible mark. A logo or badge drawn into the picture. Its job is branding and attribution to a human viewer.
- The invisible signal. A pattern embedded in the pixels themselves — imperceptible, detectable by a matching detector. SynthID is the best-known example of this family.
- The provenance record. Structured data in the file about how the content was made — C2PA manifests, EXIF and IPTC fields marking a digital source type, sometimes the prompt itself.
We took these apart at the image level in the three layers article. What matters here is the second and third — the ones people assume come off together with the first, and don’t.
How an invisible watermark works
The idea is to make a change to the image that a person can’t see but a detector can find. That means the signal has to be:
- Distributed. Spread across the whole image rather than concentrated somewhere, so cropping or covering a region doesn’t destroy it.
- Robust to ordinary handling. Re-encoding, scaling, screenshots and modest colour changes shouldn’t erase it — that’s what distinguishes it from metadata.
- Imperceptible. If you could see it, it would be a visible watermark, with all the aesthetic objections that entails.
Those three requirements are in tension, which is what makes it a research area rather than a solved feature. Robustness costs perceptibility; imperceptibility costs robustness. And there is a fourth requirement that is often the binding one: the detector must not fire on images that never carried the mark, because a false positive is an accusation.
Provenance is the opposite trade
C2PA-style provenance takes the other side of every trade. It carries far more information — what tool, what edits, cryptographically signed — but it lives alongside the picture rather than inside it, so it is fragile by construction. Screenshot the image and it’s gone. Re-encode it and it’s usually gone. Many upload paths strip it as a matter of routine, often for privacy reasons that are perfectly good.
This isn’t a flaw so much as a different purpose: provenance is designed to prove a chain of custody where the chain is intact, not to survive an adversary.
What survives what
| Layer | Re-encode / compress | Crop | Screenshot | Upload to a social platform | Paint over a region |
|---|---|---|---|---|---|
Visible logo Drawn into the picture | survives | sometimes | survives | survives | gone |
Invisible pixel signal Distributed across the pixels | survives | sometimes | survives | sometimes | survives |
File metadata / C2PA Alongside the picture, in the file | gone | gone | gone | gone | survives |
Why generic AI detectors don’t fill the gap
Tools that claim to identify AI-generated content from the pixels alone, with no watermark to read, are working from statistical artefacts — and those artefacts shift with every model release while the space of real photographs keeps producing edge cases. The result is error in both directions: real photographs flagged as synthetic, generated images passing as real.
For a consequential decision — an accusation, a moderation action, a journalistic claim — that error rate is disqualifying. Which is exactly the gap watermarking is trying to fill: replacing a guess with a signal that was deliberately put there.
What this means in practice
- If you generated it: removing the visible badge from your own clip is a branding decision. Removing provenance is a disclosure decision, and worth making deliberately — see the four-questions article.
- If you’re assessing someone else’s image: absence of a watermark proves nothing. Metadata is stripped constantly by ordinary tools, and most generators never wrote a detectable signal in the first place.
- If you’re building on this: treat all three layers as independent and don’t let a UI imply that acting on one affects the others.
Quick answers
What is SynthID?
A class of invisible watermark: a signal embedded in the pixels themselves — imperceptible to a viewer but detectable by a matching detector. It's designed to survive ordinary handling like re-encoding, cropping and screenshots, which file metadata does not.
Does removing a visible logo remove the invisible watermark?
No. They're separate layers in separate places. Painting out a corner badge changes a small region of pixels; a pixel-level signal is distributed across the whole image, and metadata isn't in the picture at all.
What's the difference between SynthID-style watermarks and C2PA?
One is in the pixels, the other is in the file. A pixel signal survives screenshots and re-encoding but tells you little beyond 'this came from a particular system'. C2PA is a signed manifest carrying rich history — and it's stripped by almost any tool that rewrites the file, including most social uploads.
Can you tell if an image is AI-generated without either?
Not reliably. Detector tools that work from the pixels alone produce both false positives and false negatives at rates that make them unsuitable for consequential decisions. That unreliability is precisely why the watermarking and provenance efforts exist.
The visible layer, on your own generations
Our tools handle the visible mark — the corner badge on clips and images you made. The other two layers are a separate decision, and we say so.
Open the watermark remover