How AI watermarks get destroyed
Updated September 1, 2026 · first published September 1, 2026
The interesting question about AI watermarking is not how to defeat it. It is why so much production output arrives at the end of the pipeline with no provenance left, when nobody involved intended to remove anything. Provenance is not usually attacked. It is optimised away, by systems doing exactly what they were built to do.
There are two independent failure modes, because there are two independent mechanisms. Image provenance dies by deletion. Text provenance dies by dilution. Both are silent.
Deletion: the metadata your pipeline throws away
C2PA provenance lives in the file's metadata. Every one of these will discard it unless configured otherwise, and most are configured for bytes rather than evidence:
| Stage | Why it strips |
|---|---|
| Thumbnail and resize jobs | Re-encodes pixels, drops non-image chunks |
| CDN image transforms | Optimises for delivery size by default |
| Format conversion (to WebP/AVIF) | Metadata often not carried across containers |
| Social and CMS uploads | Third-party platforms normalise and re-encode |
| Screenshotting a generated image | Produces an entirely new file |
The pattern is consistent: anything that re-encodes the image produces a new file, and a new file has no signed manifest unless something deliberately re-attaches one. A single automatic transform between generation and delivery is enough.
Dilution: the text steps that erode the signal
The text watermark is statistical, so it does not vanish in one step — it weakens. Each of these reduces detection confidence, and they compound:
Translation, which re-generates every token in another language. Paraphrasing and "rewrite in our tone" passes. Summarisation, which discards most of the tokens carrying the signal. Passing output through a second model, after which the text is attributable to the last model at best. Heavy human editing. And simple brevity: a two-sentence output never carried much signal to begin with.
Note that a normal, well-built product does several of these. A pipeline that generates with one model, rewrites for tone with another, translates into five languages, and truncates to a summary card has not done anything wrong. It has also, without a line of code intended for the purpose, produced output no detector will confidently attribute.
Why this costs money
The bill arrives at the moment you are asked to demonstrate provenance and cannot. Under Article 50, the obligation is to mark generated content; if your delivery path destroys the marking, the obligation is unmet regardless of the model's behaviour at generation time. Remediation is then a pipeline retrofit under deadline, which is the most expensive form of engineering there is.
The cheaper version is a single test, today: generate one image and one long text through your real production path, and check what survives at the far end. That is an afternoon, and it either confirms your pipeline is clean or finds the exact stage that is not.
What to do about it
Preserve metadata explicitly in image transforms rather than relying on defaults, and re-attach provenance after any re-encode you control. Where the marking cannot survive — a third-party platform, a summarisation step you need — carry the evidence in your own telemetry instead: model ID, version, region and timestamp, joined to the artefact ID. That log is not a substitute for marking, but it is the record that answers the question when the marking is gone.
And treat the detection result as evidence, not proof. It is a confidence level over a statistical signal; short or heavily processed text will read as inconclusive even when it was genuinely generated. Systems that treat a low-confidence result as a verdict will be wrong in both directions.
Related
Related
Want this applied to your own LLM spend? FinOps LLM runs a free audit of your AI costs and shows where the savings are. Book free audit →