AI-generated images are getting good enough that “does this look real?” is no longer the right question.

The better question is: where did this image come from?

That is where invisible watermarking comes in. It is often described as a way to fight deepfakes, but that overstates what it can do. Watermarking is not really protection. It is provenance.

A hidden signal is embedded into the image itself in its frequency domain, rather than stored as removable metadata. That signal can often survive screenshots, resizing, and recompression, allowing a detector to identify where the image came from.

In this issue, we look at how the technology works, which tools are already available, where watermarking works, where it fails, and how businesses should actually use it.

The key takeaway: watermarking can help prove that content came from you. It cannot prove that someone else’s content is fake, and it will not stop a determined attacker.

I created a hands-on Invisible Watermarking Lab App that you can run entirely on your local machine.

The app lets you hide a signal inside an image, verify that the signal is present, see how it survives normal editing, and observe what happens when someone tries to remove it. It uses a frequency-domain watermarking technique through the open-source invisible-watermark library, similar in principle to methods used by systems such as Google SynthID and Stable Diffusion.

The main idea is simple: watermarking provides provenance, not protection. It can help show where an image came from, but it cannot prevent someone from copying or modifying it.

Everything runs locally, so your images are not uploaded to any cloud service.

With the app, you can:

The app is designed to make the watermarking process easy to understand through direct experimentation. Screenshots of the application are included below, and the full source code is available in the repository.

The easiest way to run it locally is with Docker. Make sure Docker is installed, clone the repository or download it as zip file and follow the setup and usage instructions in the README.md file. Simply navigate to the project folder and run docker compose up --buildwhich should run the application on http://localhost:7860/

https://github.com/jkasaudhan/watermarking-lab-app

Snapshots:

Seeing is no longer believing. That's not a slogan, it's an operational fact your business has to plan around.

Consider a concrete case. In early 2025, deepfake videos circulated online falsely depicting diplomats in compromising situations in Guinea. The U.S. Embassy in Conakry responded by embedding Digimarc digital watermarks and C2PA Content Credentials into every official image it published, so that anyone could verify an image genuinely came from the Embassy and hadn't been altered, even after the metadata was stripped by social platforms.

That is watermarking doing its actual job: establishing provenance for honest content in a hostile information environment. It's a defensive posture built on attribution, not on stopping bad actors.

The same pressure is showing up in regulation the EU's transparency rules, arriving through 2026, will require machine-readable marking of AI-generated content. But compliance is the smaller story. The bigger one is that watermarking is becoming the substrate of digital trust across search engines, cameras, social platforms, and creative tools. If you're going to rely on it or explain it to a board, you need to understand what it genuinely does. Which starts with a clear-eyed look at the mechanism.

Invisible watermarking comes from steganography, the centuries-old craft of hiding a message inside another message. The modern version hides a small payload of bits inside a piece of media so that three things are true at once: you can't perceive it (fidelity), a detector can recover it (effectiveness), and it survives ordinary handling (robustness).

There are two fundamentally different places to put proof of origin:

Beside the file - metadata: This is the C2PA / Content Credentials approach: a cryptographically signed manifest recording who made the file, when, and with what tools. Think of it as a nutrition label. It's rich and verifiable but it falls off the instant someone screenshots the image or re-saves it. Metadata doesn't survive a right-click.

Inside the file - the watermark: Here the proof is woven into the pixels themselves. Crop it, recompress it, screenshot it ,the signal still gets preserved.

The clever part is where inside the pixels the signal goes. Naively nudging individual pixel values is fragile, the first JPEG compression pass wipes it out. So real watermarking works in the frequency domain instead.

An image can be mathematically decomposed into frequencies: broad, smooth gradients are low frequencies, fine edges and texture are high frequencies. Transforms like the DWT (discrete wavelet transform) and DCT (discrete cosine transform, the same math JPEG itself uses) expose these frequency bands. A watermark encoder tweaks coefficients in the mid-frequency bands: low enough to survive compression, high enough that your eye never registers the change. Some methods add SVD (singular value decomposition) on top for extra resilience. This is exactly what the DWT-DCT and DWT-DCT-SVD methods do.

Every watermarking scheme lives inside a trade-off triangle: capacity (how many bits you hide), imperceptibility (how invisible it stays), and robustness (how much abuse it survives). You can favor any two, you cannot maximize all three. A short marker that survives heavy editing is a very different design from a long payload that must stay pristine.

The landscape matured fast. Here's the practical map, grouped by how you'd use each.

AI-provider native systems:

Open-source developer libraries (build it yourself)

Commercial and standards layer

The takeaway from the map: watermarks (in the pixels) and Content Credentials (in the metadata) are complementary layers, and the industry is stitching them together. The serious answer uses both.

A well-designed watermark can survive normal image sharing. It may remain detectable after JPEG compression, resizing, brightness adjustments, screenshots, and re-saving—all of which can remove metadata. This resilience is the main reason the watermark is embedded directly into the image pixels.

However, a determined attacker may still be able to remove it. The UnMarker research presented at IEEE S&P 2025 reported about a 79% removal rate against SynthID, although Google disputes the claim and notes that the researchers did not have access to the detector. Regeneration attacks take a different approach: they pass the image through another generative model, which can overwrite or weaken the original watermark.

The important trade-off is image quality. Removing enough signal to defeat the watermark often introduces visible damage or reduces the quality of the image. In that sense, both advanced commercial systems and simple removal scripts face the same limitation: successful erasure usually comes at a cost. That trade-off is the key idea to keep in mind, and the next section demonstrates it directly.

Invisible watermarking is becoming part of the basic infrastructure of digital provenance. It gives legitimate content a way to carry its origin with it, even as it moves through an internet full of screenshots, resizing, recompression, and stripped metadata.

What was once a niche commercial technology now has a much broader toolkit behind it, from Google’s SynthID and Meta’s open-source SEAL models to developer libraries that can be installed and tested in minutes.

Used properly, watermarking solves a real problem. It can help show that a piece of content came from you, and it can survive the routine handling that often removes metadata.

But it is easy to expect too much from it. A watermark is not a lock, a lie detector, or a security system. It does not prove that unmarked content is fake, and it does not stop a determined attacker from targeting your business.

The most useful takeaway is that both sophisticated commercial systems and simple open-source implementations tend to fail in similar ways: under deliberate attempts to destroy the signal, often at the cost of visible damage to the image.

That is not a reason to dismiss watermarking. It is a reason to use it for the right purpose.

Provenance can be built into your workflow today. Protection still depends on separate controls: verification, process, access controls, and healthy skepticism. No watermark can replace those.

It is a free weekly briefing you can read in under 10 minutes - covering how deepfakes are actually built, real deepfake fraud cases studies, honest detection tool reviews, and prevention protocols that work. Written independently. 1,000+ cybersecurity professionals, founders, and IT managers across SMBs already read it. Feel free to forward it to your friends who might benefit from this newsletter.

Have you seen something that didn't feel right? or Got questions you don't know who to ask? Whether you've encountered a suspected deepfake, want to understand your exposure, or just want to talk through what's happening in this space, I'm setting aside time for free 30-minute calls.