Invisible watermarks for AI provenance vs. leak attribution

Invisible watermarks are suddenly everywhere. On October 5, OpenAI said it will add an invisible watermark to ChatGPT and Codex text in the European Union. In August, Anthropic said supported Claude models would embed an imperceptible watermark in the text they generate, wherever Claude is offered. Google DeepMind open-sourced its SynthID text watermark in 2024. And the EU AI Act's Article 50 transparency obligations, in effect since August 2, now require generative AI providers to make their output machine-detectable.

For security, legal and compliance teams, that raises a fair question: if AI-generated text now carries an invisible watermark, does that help when a confidential document leaks? Mostly, it doesn't. AI watermarks serve a different purpose from the invisible forensic watermarks used to trace leaks, even though the two share a name and some characteristics. Below, we cover how they're similar, how they differ, and what each one lets you do.

What question does an AI provenance watermark answer?

An AI provenance watermark answers one question: did an AI system generate or process this text? The provider builds it into the model, so the mark is added as the text is written, as a statistical pattern in the model's word choices. A detector then checks a passage for that provider's pattern.

These watermarks aren't designed to identify the person using the tool. OpenAI says its watermark "does not identify the user" and "does not associate a person, organization, account, prompt, or conversation with the text." That's a deliberate privacy choice, and it's part of what makes this kind of marking practical to require at scale.

Detection is a matter of probability rather than a yes-or-no answer, and the signal fades as the text changes. In OpenAI's own testing, replacing 10% of words with synonyms reduced detection on 400-token passages from about 92% to 66%, and replacing 25% reduced it to 17%. Anthropic says a Claude mark "may persist through some editing," but that text which has been heavily edited, paraphrased, translated or mixed into other writing may not carry a detectable mark. Both providers caution that a missing mark doesn't prove a person wrote the text.

What question does a forensic watermark answer?

A forensic watermark answers a different question: whose copy is this?

It's applied by the organization that owns the information, at the moment that information is shared, and it's different for every recipient. Each board member's copy of a board deck, each deal team member's copy of a term sheet, and each employee's copy of an all-hands email looks identical to the reader. But each one carries its own invisible pattern, and the organization keeps a record of which pattern went to whom.

That changes what a leak investigation looks like. When everyone receives an identical copy, the leaked version can't tell you which person it came from, so investigators fall back on access logs and interviews, and many investigations end without an answer. When every copy is individualized, the leaked material carries the answer itself. Investigators compare what surfaced, whether a screenshot posted online, a phone photo of a screen, a printed page or a retyped passage, against the marks that were issued. The investigation starts from evidence rather than from a list of everyone who had access.

It also changes behavior before anything leaks. When people know that every copy is traceable back to its recipient, they can no longer count on hiding in the crowd, which is why many organizations tell employees and partners up front that sensitive material is marked.

Forensic watermarking has limits worth stating plainly. It only works on content that was marked before it went out. A very small fragment carries less signal than a full page. And a match identifies whose copy leaked, which is the start of a fair process rather than the end of one.

How are they similar?

The two approaches share some characteristics:

• Both are imperceptible. Neither changes what a reader sees or how the text reads, and neither can be spotted by eye. Finding the mark takes a detector that analyzes the content.
• Both live in the content rather than in metadata. Copying and pasting carries the mark along, unlike a file property or a document header that is easy to strip.
• Both weaken under heavy alteration. The more a passage is rewritten, cut or blended with other text, the less signal remains, which is why results come with a level of confidence rather than a bare yes or no.

How do they differ?

AI provenance watermark (for example, OpenAI's textGrain or Claude's text watermark)

• Purpose: label content as AI-generated, for transparency and regulatory compliance
• Applied by: the AI provider, as the model generates text
• What a detection tells you: that a passage likely carries a particular provider's mark, meaning that provider's model may have generated or processed it. Each provider's detector checks for its own watermark.
• Not tied to a recipient: these watermarks aren't designed to identify who used the tool
• What it lets you do: support AI-labeling obligations, check whether a passage likely came from a particular AI system, and inform policies on AI-written material in classrooms, newsrooms and regulated filings

Forensic watermark

• Purpose: attribute a specific copy of sensitive content to a specific recipient
• Applied by: the content owner, when the content is shared
• What a detection tells you: which recipient's copy the leaked material came from, with the statistics behind the match
• Individualized to a recipient: every recipient gets a uniquely marked copy
• What it lets you do: identify the source of a leak, deter leaks before they happen, and give legal, HR and regulators documented evidence instead of an inconclusive investigation

If you're also weighing forensic watermarking against DLP or visible watermarks, we covered those differences in an earlier post.

Where EchoMark fits

EchoMark embeds unique, invisible watermarks into email, documents and files, images, and screens, so every recipient receives their own marked copy. For especially sensitive messages, AI rephrasing can also give each recipient a uniquely worded version of the same message, so a copy that has been retyped still points back to its recipient. When something leaks, investigators upload what surfaced, and EchoMark's leak report returns the best match, with the statistics behind it.

AI provenance watermarks will keep spreading, and that's good for transparency. They help answer whether an AI system wrote something. Content marked before it goes out answers whose copy it was. Schedule a demo to see how EchoMark traces a leaked screenshot, photo or passage of text back to the copy it came from.

----------

Frequently asked questions

1. Do AI chatbots watermark the text they generate?
   Increasingly, yes. Several major AI providers now embed invisible watermarks in model-generated text, and the EU AI Act requires generative AI providers to mark their output in a machine-detectable way. Coverage varies by provider, model, product and region, so check each provider's current documentation.
2. Can an AI watermark identify who wrote or leaked a document?
   No. AI provenance watermarks are designed to signal that an AI system generated or processed text, not who used the tool or whose copy was leaked. They also aren't conclusive on their own: a detected mark is a signal, and a missing mark doesn't prove a person wrote the text.
3. Will an AI watermark help a leak investigation?
   Rarely, and only indirectly. If investigators can get access to a provider's detector, it may suggest that a leaked passage passed through that provider's AI tool. It can't tell you which person's copy leaked.
4. How do you trace who leaked a document?
   Traditional investigations compile everyone with access, review logs and interview suspects, which often ends inconclusively. Forensic watermarking gives each recipient a uniquely marked copy before distribution, so the leaked material itself can be matched back to the copy it came from. It only works for content that was marked before it went out.
5. Does an AI watermark replace DLP or forensic watermarking?
   No. DLP governs where data is allowed to move inside managed channels. AI provenance watermarks label machine-generated content. Forensic watermarks attribute a specific copy to a specific recipient, including after the content has left the network as a screenshot, a photo or a retyped passage. Each covers a gap the others leave.
6. Does the EU AI Act require AI watermarking?
   Article 50 transparency obligations applied from August 2, 2026, requiring providers of generative AI systems to mark their output in a machine-readable format and make it detectable. Systems already on the market before that date have until December 2, 2026 to meet that obligation.
7. What should security teams do now that AI text is being watermarked?
   Map where sensitive information leaves the organization, such as board materials, all-hands emails and deal documents. Decide which of those should carry individualized marks before distribution, and update your incident response playbook so it doesn't treat "AI-watermarked" as an answer to "who leaked this?"