Those three questions separate pixel-level image signals, generation-time text watermarks, provenance records and human-facing labels. Confusing them leads to bad expectations about what any one mechanism can establish.
Start with the question, not the label
When someone asks whether a picture, post, or passage is “AI content,” they may actually be asking several different things: whether a particular generator left a detectable signal, whether an edit history is attached, whether a platform is disclosing AI involvement, or whether a provenance record can be verified. Those questions require different evidence.
That is why the absence of one mark should not be treated as a universal “not AI” verdict, and the presence of one mark should not be stretched into a complete history of the asset. A useful first step is to identify what produced the evidence and what that mechanism was designed to say.
| Evidence type | Where the information lives | What it mainly answers |
|---|---|---|
| Image watermark / signal | Image pixels or signal space | Whether a particular mark or signal is observable |
| LLM text watermark | Statistical pattern in token selection | Whether text carries a pattern from a specific generation scheme |
| Content Credentials | Signed manifest bound to the asset | What provenance statements can be verified |
| Visible AI label | Platform or product UI | How AI involvement is disclosed to people |
Why marking became part of the AI stack
Generative systems made production cheap and editing powerful. That created a practical need for more context: was this output produced by a particular system, was AI used somewhere in its history, or is a platform simply disclosing how a post was made? The answer matters to publishers, platforms, regulators and ordinary readers for different reasons. The European Union now requires providers of in-scope generative systems to add machine-readable marks that make artificially generated or manipulated output detectable, while separate disclosure duties apply to deepfakes and certain public-interest text. Those Article 50 transparency rules have applied since 2 August 2026.
That regulatory push does not prescribe one universal “AI watermark.” In practice, the technical choices differ sharply by medium and workflow.
1. An image watermark or signal lives with the image
For images, a watermark may be visible pixels — a logo, name or overlay — or a non-visible pattern embedded into image data. The latter can be designed so a compatible detector looks for statistical structure after the image has been produced. Its practical behavior depends on the scheme and on what happens to the image afterward. Resizing, cropping, recompression, screenshots and generative edits can all change what remains observable.
This is the category closest to SIGNA’s current workflow: prepare a supported image before sharing, optionally combine a visible watermark with an invisible SIGNA signal, and later inspect a returned image on the device to see whether that SIGNA signal is observable. It is a pre-share image workflow, not a declaration that the image was or was not AI-generated.
2. Text watermarking can happen while the model chooses words
Text has no pixels in which to hide a conventional image pattern. SynthID-Text instead modifies the sampling procedure used while an autoregressive language model chooses tokens. Google DeepMind’s published method uses Tournament sampling and a keyed scoring process so generated text tends to carry a detectable statistical pattern. The Nature paper reports a non-distortionary configuration designed to preserve the model’s token distribution in expectation and a stronger distortionary configuration that trades some quality for detectability.
That distinction became newly important in September 2026. Lasso Security reported experiments in which applying a SynthID-Text implementation changed some refusal decisions and tool calls in tested open models, an effect the researchers call “sampling drift.” The study is a useful warning, but it should be read at the right scale: it tested a particular text-generation watermark configuration on selected language models. It does not show that pixel-level image signals inherit the same token-sampling behavior, and it does not establish a universal penalty for every watermarking technology.
The original SynthID-Text work and the newer security study are therefore not actually contradictory. One asks whether a watermarking sampler can preserve distributional and perceived text quality at scale; the other asks whether fixed-key changes in individual sampled tokens can matter when those tokens control refusals or agent actions. Both questions can matter at once.
3. Content Credentials are provenance records, not just a hidden mark
C2PA Content Credentials take a different route. A C2PA manifest can carry signed assertions about an asset and its history, such as creation or editing actions, and bind those assertions to the asset. Verification checks the manifest, signatures and bindings under a trust model. This is provenance infrastructure: it can help a viewer understand recorded history and whether that record verifies correctly.
That is different from asking a detector to find a statistical watermark. It is also why a missing Content Credential, a missing watermark and a missing platform label are not interchangeable observations. Each mechanism has its own creation path, persistence characteristics and verification method.
4. A visible AI label is for people
Human-facing labels solve yet another problem: disclosure at the moment somebody encounters content. The EU’s Article 50 framework distinguishes machine-readable marking by providers from disclosure obligations for deployers in cases such as deepfakes and certain AI-generated or manipulated public-interest text. The Commission’s 2026 Code of Practice and guidance make that distinction explicit.
A label can be clear to a reader even when they never run a detector. A machine-readable mark can be useful to software even when a person sees nothing. A provenance record can carry richer history than either. Treating all three as synonyms loses the reason they coexist.
What should you conclude when a mark is missing?
Very little without knowing which system you expected to find. A file may have been transformed, stripped of metadata, captured as a screenshot, re-encoded, copied through a service that does not preserve a provenance structure, or generated by a system that uses a different marking scheme. Conversely, finding a system-specific signal answers a narrower question about that signal; it should not be stretched into a universal judgment about every edit, every creator or every generation tool.
This is why “AI detector” and “watermark detector” should not be used as if they were the same phrase. One may infer from content; another may look for a signal intentionally placed by a known system. Their evidence models are different.
Where SIGNA fits — and where it does not
SIGNA is built around images people are preparing to share. On supported Android image workflows, the selected image is processed on the device rather than uploaded to SIGNA AI Lab for that processing. You can add a visible watermark, add an invisible SIGNA signal, and later inspect supported image and signal information locally. That makes SIGNA relevant to the image-signal part of this story.
SIGNA does not turn SynthID-Text into an image feature, replace C2PA Content Credentials, or convert a missing signal into a universal AI/non-AI classification. Keeping those boundaries clear makes the tools more useful, not less.
Sources
Nature — Scalable watermarking for identifying large language model outputs (SynthID-Text)
Lasso Security — The Provenance Tax (September 17, 2026)
C2PA — Content Credentials explainer
European Commission — Article 50 transparency obligations
European Commission — Code of Practice on Transparency of AI-generated Content
Prepare the image before it leaves your phone
If your problem is image sharing rather than model-output labelling, SIGNA gives you a practical pre-share path: visible watermark when you want immediate attribution, invisible SIGNA signal when you want an additional invisible signal, and local inspection later on supported images.