AI watermarking doesn't visibly alter text. Instead, it uses a secret key to slightly boost the probability of certain words appearing in a sequence. This creates a statistically significant pattern that can only be detected by a tool with access to the original model and the secret key.

Unlike auditable open-source code, open-weight AI models are a 'black box.' It's impossible for outside experts to verify that a malicious trigger, activated only under specific conditions, wasn't embedded during the training process. This negates the traditional 'security through transparency' benefit of open source.

Despite being a key compliance tool for the EU AI Act, current text watermarking technology is fragile. The statistical fingerprints embedded in AI-generated text can be removed with little effort by running the content through readily available paraphrasing tools, undermining the robustness requirements of the law.

The core safety argument for open-weight models ('many eyes') is flawed. A malicious actor could embed an 'asymmetric backdoor'—a hidden capability that is easy to trigger with a secret key but practically impossible for the public to detect, even with full access to the model's weights.

OpenAI provides a free image verification tool. Marketers can use this tool to their advantage by uploading their edited, ChatGPT-created images. This allows them to confirm that their modifications successfully removed detectable AI fingerprints before publishing the content.

Initiatives like Google's Synth ID aim to standardize detection of AI-generated content. However, these systems are vulnerable. Simple user actions like screenshotting can strip metadata, and blending AI-generated assets with real footage can easily confuse detection algorithms, limiting their effectiveness.

AI labs face a trade-off with watermark detection tools. Making them widely available promotes public transparency, but it also allows bad actors to use the detector's feedback to reverse-engineer and train other AI models to become more effective at removing the watermarks, undermining the system's long-term security.

Watermarking isn't about hiding data in whitespace. It works by using a secret key to subtly bias an LLM's selection of the next word from a list of valid options. A detector can then identify this biased pattern across a body of text to confirm its AI origin without altering meaning.

Current responses to deepfakes are insufficient. Detection is an endless cat-and-mouse game with high error rates. Watermarking can be compromised. Provenance systems struggle with explainability for complex media edits. None provide the categorical confidence needed to solve the crisis of digital trust.