AI vs. Deepfakes: Can Watermarking Save Reputation in the Age of Synthetic Media?

Will watermarks become a mandatory passport for all online video — and will that be enough?

In February 2024, a deepfake video of a Ukrainian government spokesman appeared across social media platforms, claiming in convincing detail that Ukraine had claimed responsibility for a terrorist attack in Moscow. The video was fabricated. To an unsuspecting audience, the impression was virtually indistinguishable from a real broadcast. It permeated millions of people before a viable rebuttal from fact checkers could be constructed, and in between its publication and correction, the disinformation it contained did its work. This is not the first and won’t be the last. But it did kick off a discussion that governments, tech companies, and civil society have increasingly been having for several years now, namely, how to create a technical solution that would enable a viewer, before deciding to believe the information they are ingesting, to know that it was created by a machine? The answer the industry has converged on involves visible and invisible watermarking — and the question of whether that answer is sufficient is now being resolved not in research papers but in legislation.

The key difference is the most important one here. Any text overlay, logo, or labels on screen are the visible watermarks that assert origin. They can be edited off in a basic manner and are never thought of as a security method whatsoever. Invisible watermarking is a method that puts identification information into the structure of the video signal itself, without being noticed by any viewer, but can be detected by analysis software. With AI-generated content, the variety of watermarking that has garnered the most institutional attention is generation-time watermarking, in which the watermark is embedded with the generation process itself, as a part of the content. This is what sets it apart from previous invisible watermarking methods that were implemented after the video was already recorded or rendered. The watermark is not meant to describe the content, but rather its source. But that’s a huge political and legal challenge that this technology is being called upon to address.

What SynthID and Its Competitors Actually Do

Google’s generation-time invisible watermarking system, which is employed in its Imagen and Veo generative video systems, is probably the most publicly reported commercial-scale system for the invisible watermarking of video. Instead of altering an existing video file, SynthID is inserted into the diffusion sampling process itself – the series of computational steps used to create the output from a generative model. The watermark signal is added to an intermediate step of that process, embedding it in the statistics of the resulting frames. The system works by adversarial optimization to find embedding positions that persist through subsequent video processing (compression, re-encoding, format conversion) without being noticeable by the viewer. The watermark can only be detected by a specific analysis tool that accesses the same model on which the watermark was embedded; the generic analysis tools cannot detect the watermark, thus making it difficult to be reverse-engineered.

Adobe’s Content Credentials framework is a complementary approach. Unlike relying on an unnoticeable signal within the pixel data, Content Credentials adds cryptographically signed metadata to AI-generated content at the time of creation, documenting who created the output, when, and how. A content fingerprint — a perceptual hash of this video — is stored on a distributed manifest repository, to which the metadata is linked. When the metadata is removed from the file, the fingerprint becomes a backup method for the provenance record. In 2024, OpenAI revealed that its video generation with Sora would include Content Credentials at the time of generation. This framework is based on the C2PA standard that is now supported by Google, Microsoft, Adobe, Intel, ARM, and an increasing number of news organizations, with plans to become an ISO standard.

The Regulatory Pressure That Changed Everything

If it were left to industry incentives alone, the technical development of invisible forensic watermarking of AI-generated content would have taken its natural course. It didn’t get that opportunity. The EU Artificial Intelligence Act, which was officially adopted in 2024 and will have its labeling provisions come into effect on August 2, 2026, requires that the deployer of an AI system that generates or manipulates a video that is a deep fake include a disclosure of this fact in the video. The solution to that disclosure in a machine-readable format that will be read automatically is “watermarking”. Most violations face a fine of €15 million or 3 percent of the annual turnover on a global level, and more severe violations are subject to higher fines.

The European Commission has acted promptly to implement the regulation. It initiated a seven-month stakeholder process on 5 November 2025 for the development of a Code of Practice on the marking and labelling of AI-generated content, which will be a voluntary document to support the implementation of the obligations of service providers under Article 50 in practice. On December 17, 2025, the first draft of that code, covering watermarking requirements, metadata standards, and technical measures for providers (generative tool developers) and deployers (companies and individuals using the generative tools to create and publish content), was published. This code applies to audio, images, video, and text, but video seems to have been the most talked about because it has the most potential for damage, whether in terms of reputation or politics, when it is fabricated.

The United States has treaded more softly in the waters of compulsory labelling, however, because its First Amendment concerns mean that they have greater barriers to compulsory speech requirements than European law. In October 2023, Executive Order 14110 mandated federal agencies to create plans to watermark government-created AI-generated content and encouraged the adoption of labelling standards by industry. The Tech Accord to Combat Deceptive Use of AI in 2024 Elections was signed by Anthropic, Google, Meta, Microsoft, OpenAI, Stability AI, and others at the Munich Security Conference in February 2024, which pledged signatories to work on and implement technical countermeasures to prevent AI-generated election disinformation, including watermarking.

The Fragility Problem That Regulation Cannot Solve Alone

The law keeps advancing at a faster pace than the technical base can keep up — and experts at the IBA Annual Conference in Toronto in November 2025 made no secret of it. “Fragile doesn’t work,” said one of the panelists for watermarking. Bad guys will never be advertising their fake goods. The rules are not applicable to a provider or deployer who decides not to abide by the law, as the rules do not extend to actors who create deepfakes with open-source models on hardware that is not subject to the jurisdiction of the laws. The EU AI Act is obligatory for commercially available generative AI services that are marketed in or to EU markets. It has nothing to do with binding on a person running a local installation of an open-weights model to produce fabricated video.

This is the structural limitation of invisible digital image watermarking and its video counterparts as a tool to address the deepfake problem: The technology is as universal as the platforms willing or required to use it. When a compliant platform creates a video, it will embed a watermark that signals a detection system that this video was produced by AI and includes a specific provenance record. It offers no clues about content created with non-compliant tools, which is just the content that is most likely to be used in harmful ways. A 2025 study on watermarking adoption by generative AI systems revealed that the technology for watermarking AI content has progressed significantly, but its industry-wide implementation is far from uniform, with providers presented with conflicting incentives as users are sometimes actively unaware of the use of AI tools in content creation.

Generation-Time Embedding: The Architecture That Changes the Game

It’s the association of the mark and origin of the content that makes the capabilities of generation-time invisible watermarking different from post-production capabilities in terms of quality. A watermark added after generating a video can be removed and re-added; the removal of the original watermark and the insertion of a new one by an attacker may be able to forge the provenance. A watermark that has been incorporated at generation time will be linked to the computation used to generate the content in a more difficult-to-replicate manner, without having access to the original model and the state of the model’s internal variables. This renders the generation time marks more difficult to forge and more reliable as forensic marks.

There is a challenge to implementation. If the watermarking method is invisible during diffusion, it needs to be co-optimized with the generation quality goal — otherwise, if the watermarking is noticeable, users will find other unmarked versions and the diffusion won’t be used. Unpublished evaluations from SynthID demonstrate that it does not degrade the quality of the generation results, matching the quality of unwatermarked results on standard benchmarks, and that it watermarks at more than 95% of the time for the common post-processing attacks. These are real engineering feats, but they were obtained in a laboratory setting, and the performance against a stripped opponent is not as well documented.

Reputation, Reality, and the Limits of Technical Certainty

Even if watermarking were flawlessly implemented, a convincing deepfake can cause damage to a reputation for a long time. A fake video can go viral in less than a day. The process of forensic watermark analysis takes hours at best and days under realistic circumstances because only someone who sees the video and submits it to a detection system gets a result and then publishes a credible rebuttal. The reputational damage has already taken place between the release of the deepfake and the technical counterattack. The watermarking is information that can be detected, not prevented. Can detect if a video was generated by AI after the fact. It can’t prevent that video from being accepted by the first few million viewers prior to the detection result being released to the public.

This doesn’t mean the technology itself is useless – it means only useful when used. A world where all videos created with compliant AI platforms are distinguishable is a world where verification tools can be integrated into both browsers, search engines, and social media platforms so that most users won’t see it without context. The C2PA coalition’s roadmap includes this integration, and the W3C is looking into the browser-level support for Content Credentials. If it happens at scale, the passive experience of watching AI-powered video – the social feed, the link embedded in a message app – might include the ability to show the viewer on-screen details about the video’s context. Technically, this is possible with today’s tools. A future implementation will depend on uptake and enforcement by platforms, and the rapidity of the open-weights model ecosystem’s own watermarking.

The Passport Already Exists — the Border Is Still Being Built

In a certain way, the answer to whether watermarks will become universal passports for all online video was answered when the EU AI Act was introduced: they will be required for AI-generated content used in the EU and in the European market from August 2026, when it comes into force. How far that mandate extends into the open source world — and how it applies to content created in other jurisdictions that also don’t currently have the same regulation — plus whether the technical requirements for a compliant watermark will be synchronized across the major platforms and tools, remains to be seen. The EU’s working solution to the final question is provided in the draft Code of Practice (DoP) from December 2025; the first two questions are true open questions. The industry has proven that invisible watermarking of content for generation time is technically feasible at a commercial scale with no significant quality degradation, it has a real and growing regulatory and institutional need, and there is no viable alternative to watermarking for machine-readable AI disclosure at the time of content production. The passport exists. What is still being put together is the infrastructure to verify it at all borders.