AI video watermarks: SynthID, visible labels, and what a mark proves

This page belongs to the deepfake detection hub and sits beside Content Credentials (C2PA), the other provenance route. The difference is where the information lives: a C2PA manifest is metadata attached to the file, a watermark is written into the pixels themselves.

01What an AI video watermark is

A watermark in this sense is a pattern added to the pixels of an image or to every frame of a video at the moment of generation, invisible to a viewer and recoverable by a detector that knows the embedding scheme. Google DeepMind's SynthID page describes the mark as added "the moment content is created" and "designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression" (SynthID technology page). For video, the 14 May 2024 announcement states that the method "embeds a watermark directly into the pixels of every video frame" and that from that day "all videos generated by Veo on VideoFX will be watermarked by SynthID" (DeepMind blog, 14 May 2024).

The same family covers text, but by a different mechanism. The Nature paper on SynthID-Text explains that the text version "does not affect LLM training and modifies only the sampling procedure", nudging which token is chosen next, and that detection runs "without using the underlying LLM" (Dathathri et al., Nature 634, 2024). A pixel watermark and a token watermark share a goal and a name, not a method, and the robustness figures for one do not transfer to the other.

02What does a found mark prove, and what does a missing one?

A detected watermark is positive evidence with a narrow scope: this video, or this frame, was produced by a generator that embeds this mark, and the mark survived whatever happened to the file afterwards. The claim is about origin, not about content. A marked clip can be an innocent demo or a political fake; the mark says only who made the pixels.

The absence of a mark carries no information on its own, for three reasons that the SynthID-Image paper sets out as its threat model. The video may be a real recording, which no watermark scheme touches. It may come from a generator that does not mark its output, or from an open model whose marking step was removed. Or the mark may have been attacked: the paper names "watermark removal (creating a false negative)" and "watermark forgery (creating a false positive)" as the attacker's two objectives (Gowal et al., 2025). A check that returns "no mark" therefore has to be read as "nothing found", and the question of whether the clip is real has to be answered by other means, which the checking a face video page orders by strength of evidence.

03How robust is SynthID to editing?

The only published measurements come from the image system, and they are reported for an external variant called SynthID-O rather than the model used inside Google's products. Table 1 of the SynthID-Image paper gives the true positive rate at a fixed 0.1 percent false positive rate, with images resized to 512 by 512 and the detection threshold calibrated on worst-case transformations. SynthID-O detected 100.00 percent of untouched marked images, 99.98 percent under randomly sampled transformations, 99.72 percent under the worst setting of every transformation, and 98.06 percent under worst-case combinations of transformations, the hardest category (Gowal et al., 2025, Table 1). The authors note that it was "the only model surpassing 99% TPR in aggregate" in the worst setting, and also that "not a single model outperforms all others across all categories".

Three conditions limit what those numbers say about video. They were measured on still images at one resolution. They describe a variant released through partnerships, not the internal production model. And the transformations were applied by the authors, not by a platform pipeline, so a social network's re-encoding is a related but different test, the same gap this site records for metadata that platforms strip on upload.

04Visible labels and metadata are a different mechanism

A visible "AI generated" label is a disclosure, not a measurement. A platform applies it either because the uploader declared the content synthetic or because the platform found a machine-readable signal in the file. Meta's February 2024 statement says it labels images "when we can detect industry standard indicators that they are AI-generated", naming the C2PA and IPTC metadata fields, and adds that "there are ways that people can strip out invisible markers" (Meta newsroom, 6 February 2024). The label is only as reliable as the signal behind it.

The two signals are designed to work together. The C2PA specification defines a soft binding as "a content identifier that is either (a) not statistically unique, such as a fingerprint, or (b) embedded as an invisible watermark", which lets a manifest that has been stripped from a file be found again by its watermark (C2PA specification 2.5). The SynthID-Image paper says the same from the other side: metadata "is vulnerable to removing said metadata", so "we expect watermarking to be deployed alongside a metadata-based standard like C2PA". Both are verification rather than inference, which is why they rank above a detector score.

05Why does the law ask for marking rather than detection?

Regulation (EU) 2024/1689, the AI Act, puts the duty on the generator. Article 50(2) requires providers of systems "generating synthetic audio, image, video or text content" to ensure their outputs "are marked in a machine-readable format and detectable as artificially generated or manipulated", and recital 133 lists "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques" as the ways to do it (Regulation (EU) 2024/1689). The logic is the same as the figure above: marking at the source is the one point in the chain where origin is known for certain. The EU AI Act Article 50 page covers the deployer-side disclosure duty for deepfakes and the dates.

A marking duty cannot reach a generator outside its jurisdiction, an open model with the marker removed, or a fake made by pasting a face into a real video rather than generating one, the case a blending-boundary detector such as Face X-ray targets and the kind of fake the first test sets, UADFV and DeepFake-TIMIT, were built from in 2018. The political deepfake cases with an official record were caught by telephone rules and court filings, not by a mark. That is why detection benchmarks still matter and why the in-the-wild results are the measure of what remains when no mark is present.

06What this means for checking a clip

Run the provenance checks first, because they can return a verified answer: a valid C2PA manifest, or a watermark found by the generator's own detector. Google's page states that Gemini, Search and Chrome will check an uploaded image, video or audio clip for a SynthID mark, and that a SynthID Detector portal launched in 2025 was later opened to everyone. A positive result ends the origin question for that clip. A negative result moves the question to context, corroboration and, last, a detector score, with the published in-the-wild figures as the ceiling on what that score is worth.