As realistic synthetic images, audio, video, and text become easier to make, identifying their origin becomes a distribution problem as much as a detection problem. A classifier can guess what generated a file after the fact. Watermarks and Content Credentials take a different approach: they attach signals during creation or editing so that later viewers can inspect where media came from and what happened to it.
These systems answer related but distinct questions. A watermark is a pattern embedded into content, ideally imperceptible and robust to ordinary transformations. Content Credentials use signed provenance metadata to record claims about an asset's origin and edit history. Either can provide useful evidence. Neither can certify that the scene depicted actually occurred.
Two layers of traceability
Google's SynthID illustrates the watermark approach. It embeds signals directly into generated images, audio, video, or the probability pattern of generated text. For images and video, Google says the signal is designed to survive operations such as cropping, filters, frame-rate changes, and lossy compression. For text, detectability works best on longer, varied responses and is not intended to defeat a determined attacker. Google DeepMind's technical explanation explicitly describes the method as a building block rather than a complete solution.
The Coalition for Content Provenance and Authenticity, or C2PA, provides the complementary metadata layer. A creator, camera, editor, or generator can place assertions in a manifest, bind the manifest to the asset with hashes, and sign it with a cryptographic credential. A validator can then determine whether the credential's signature and asset binding remain intact. The standard's own boundary is important: “There are no value judgments about whether the provenance data is good or bad.” C2PA's explainer treats provenance as information that helps a user judge trust, not as an oracle.
A valid credential might establish that an identified newsroom signed a photograph and that a crop followed. It does not prove the photographer staged nothing outside the frame, captioned the image correctly, or deserves trust. Cryptography protects the integrity of a claim; institutions and evidence determine its credibility.
Robustness and coverage are different problems
Watermarks live with the media and can remain detectable after metadata is stripped, but sufficiently strong editing, re-recording, paraphrasing, or adversarial processing may damage them. False positives and false negatives also matter at scale. Detection thresholds that work in a lab must be tested across languages, codecs, devices, and transformations.
Credentials can carry richer history and identify signers, yet platforms may remove metadata during upload, conversion, or screenshots. C2PA supports externally recoverable manifests and related durability techniques, but retrieval still depends on ecosystem participation. An unsigned file is therefore ambiguous: it could be human-made, generated by an uncooperative system, exported through a service that stripped its credential, or created before the standard was adopted.
The NIST report on synthetic-content transparency groups provenance, watermarking, labeling, and detection as complementary methods. It notes that effectiveness depends not only on technical performance but on how people access and understand the information, and that many approaches have not yet been fully evaluated. Traceability requires interfaces, education, and shared verification infrastructure—not just an embedded bit pattern.
Regulation can expand the network
The European Union's AI Act turns some of this engineering into a compliance obligation. Article 50 requires providers of systems generating synthetic audio, image, video, or text to make outputs machine-readable and detectable as artificially generated or manipulated. It also requires deployers to disclose deepfakes, with accommodations for artistic and certain public-interest uses. The consolidated regulation calls for techniques that are effective, interoperable, robust, and reliable as far as technically feasible.
Rules can increase coverage, but implementation choices matter. A proprietary detector available only to one platform produces a weaker public record than an interoperable signal that browsers, archives, messaging services, and journalists can verify. Standards also need revocation when a signing key is compromised and privacy controls so credentials do not expose a creator's identity or location unnecessarily.
A layered test for media
The practical model is defense in depth. Platforms can display Content Credentials when present, check robust watermarks, preserve provenance across transformations, and use forensic detectors for unmarked media. High-stakes users can verify the signer, compare the asset with independent sources, inspect publication history, and ask whether the content itself supports the claim being made.
Labels should be framed carefully. Watermark detected can be a meaningful positive signal about a participating generator. No watermark detected is not evidence of human authorship. Valid credential means the signed history has not been altered; it does not mean true.
Watermarks and Content Credentials can make AI media more traceable if generators embed them, platforms preserve them, and users can verify them. Their success should be measured by durable, interoperable evidence across the media lifecycle—not by the impossible promise of automatically separating truth from falsehood.