AI Watermarks vs AI Detectors vs Provenance Metadata

A text watermark is inserted during generation by the provider, using a secret key, and verified by recomputing that key over the text. Where a provider deploys one, the check is principled rather than a guess.

The practical catch for everyone else is access. Google publishes its approach and a reference implementation; Anthropic said a detection API was planned but not yet available at our last check. So for most text, no one outside the provider can actually run the test.

An AI detector has no key and no privileged information. It scores surface features — perplexity, burstiness, sentence-length variance — and infers. That inference is wrong in both directions, and it is wrong in patterned ways: unusually clean, plain or formulaic human writing gets flagged, and non-native English writing is flagged disproportionately.

OpenAI retired its own text classifier in 2023 over accuracy. A detector score is not evidence of authorship, and a watermark result and a detector result are not the same kind of claim at all.

C2PA Content Credentials are cryptographically signed statements about how a file was made, travelling with the file. OpenAI documents C2PA plus SynthID watermarking for images and supported audio, with a public verification tool; Anthropic attaches signed C2PA provenance to supported file types.

Two consequences follow. Metadata is strong evidence when present, because it is signed. And it is trivially absent, because copying text out of a file, screenshotting, or re-encoding discards it — which is exactly why watermarking exists as a second layer.

Pasted prose has no metadata to check, and may carry a watermark you cannot test for. A downloaded image or audio file may carry both a watermark and signed metadata. A detector applies to anything and proves nothing on its own.

• Worried about a statistical watermark in text you are editing: rewriting is the documented lever.
• Worried about stray invisible characters: scan and remove them, which is exact and free.
• Facing a detector accusation: a score is not proof, and cleaning text does not make it proof of the opposite.
• Handling files: provenance metadata and file-level watermarks are outside what a text tool can touch.