Contents
An invisible-watermark detector can only read the specific scheme it was built for, so what actually exists is a short list of scheme-specific detectors, not one universal tool. There is no general reader that answers “is there a watermark in this file”. A SynthID detector reads SynthID. An AudioSeal detector reads AudioSeal. Point either one at unmarked content, or at the other scheme’s output, and it returns nothing, which is why a negative result means “not this mark”, never “no watermark at all”.
The limit that shapes the whole field
A detector is bound to a single scheme because the mark is a private construction, and detectors differ in how much they even reveal. Some are self-revealing: presence can be detected while the payload stays unreadable without the owner’s key. Some are keyed end to end, so without the secret key a reader finds nothing at all. And some are not public in any form. Google’s SynthID audio detector is black-box, running only through Google’s API and Gemini with no public implementation, so even where a scheme is deployed you may not be able to run the reader yourself. “What exists” therefore means “which readers are published, keyed or open enough to run”, which is why there is no single scan across schemes.
The image side
Modern invisible image watermarks descend from one template. HiDDeN (Zhu, Kaplan & Johnson, ECCV 2018) was “the first end-to-end trainable framework for data hiding”, a neural encoder and decoder with noise layers inserted between them so the model learns encodings that survive distortion, and almost every post-hoc neural image watermark since follows its shape. From there the designs split by where the mark sits and what it is built to survive.
| Detector / scheme | Type | Distinctive property |
|---|---|---|
| SynthID (Gowal et al., 2025) | Post-hoc neural, spectral | Deployed at internet scale, 0.1% FPR |
| Tree-Ring (Wen et al., 2023) | Latent, seeded in noise | Invariant to crops, flips, rotations |
| Stable Signature (Fernandez et al., 2023) | Decoder-rooted | Every image carries a user’s bits |
| HiDDeN (Zhu et al., 2018) | Neural encoder/decoder | The foundational template |
| StegaStamp (Tancik et al., 2020) | High-amplitude neural | Survives print-scan and screen-cam |
| Gaussian Shading (Yang et al., 2024) | Distribution-preserving latent | 10^-6 false-positive rate by default |
| Watermark Anything (Sander et al., 2025) | Localized | Reads messages in small regions |
Two of those designs carry the extremes. StegaStamp robustly retrieves “56 bit hyperlinks after error correction” and is built so a photograph of a printed page or a screen still decodes (Tancik, Mildenhall & Ng, CVPR 2020), trading visibility for physical-world robustness. Gaussian Shading is distribution-preserving, meaning the watermarked output is statistically indistinguishable from an unwatermarked one, and operates at a 10^-6 false-positive rate by default (Yang, Zeng & Chen, CVPR 2024). On the commercial side, Digimarc covers broadcast and image, and Imatag is a Stable-Signature commercial variant whose public detector card cites roughly one false hit per 1,000 non-watermarked images. That Imatag figure is a product-specific operating point, not a guarantee that an arbitrary invisible mark can be found.
The audio side
AudioSeal is “the first audio watermarking technique designed specifically for localized detection of AI-generated speech” (San Roman, Fernandez & Elsahar, ICML 2024). The audio field is smaller and younger, and it splits by what kind of processing each scheme is built to survive.
| Detector / scheme | Type | Distinctive property |
|---|---|---|
| AudioSeal (San Roman et al., 2024) | Additive, per-sample | Localizes the mark to 1/16000 second |
| WavMark (Chen et al., 2023) | STFT invertible net | 32 bits per one-second chunk |
| SilentCipher (Singh et al., 2024) | Psychoacoustic | First to 44.1 kHz |
| VoiceMark (Li et al., 2025) | Speaker-latent | Zero-shot voice-cloning-resistant |
| TimbreWatermarking (Liu et al., 2024) | Timbre-domain | Survives fine-tuned cloning |
| SynthID-Audio (Google) | Black-box | API and Gemini only, undisclosed |
The audio numbers tell the same scheme-specific story. SilentCipher was the first deep-learning audio watermark to integrate psychoacoustic thresholding and the first to scale to a 44.1 kHz sampling rate (Singh, Takahashi, Liao & Mitsufuji, Interspeech 2024). VoiceMark is the first zero-shot voice-cloning-resistant audio watermark, surviving cloning where AudioSeal, WavMark and TimbreWatermarking collapse toward random (Li, Wu & Xie, Interspeech 2025). WavMark encodes “up to 32 bits of watermark within a mere 1-second audio snippet” (Chen, Wu, Liu et al., 2023). SynthID-Audio, by contrast, cannot be independently run at all, since it is black-box and detectable only through Google’s API and Gemini.
What a reader can and cannot surface
A detector can confirm presence, and sometimes read a payload if the scheme is multi-bit and you hold the key. It can never tell you whether the content is “real” or “AI” in general, only whether its one specific mark is there. And a legal mandate does not conjure a detector into existence. Despite the 2023 China AIGC regulation, the major Chinese AIGC vendors have shipped a visible watermark plus C2PA metadata rather than invisible watermarks, so the rule required labelling without producing a readable invisible mark. The map of what genuinely exists is set by the published schemes above, not by policy.
Whether any of these marks actually survive real-world handling, rather than simply exist, is a separate question, covered in do content watermarks actually work?.
Sources
- Zhu, Kaplan, Johnson (2018). HiDDeN: Hiding Data With Deep Networks. ECCV.
- Tancik, Mildenhall, Ng (2020). StegaStamp: Invisible Hyperlinks in Physical Photographs. CVPR.
- Gowal, Bunel, Stimberg (2025). SynthID-Image: Image Watermarking at Internet Scale. Google DeepMind.
- Wen, Kirchenbauer, Geiping (2023). Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust. NeurIPS.
- Fernandez, Couairon, Jégou (2023). The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV.
- Yang, Zeng, Chen (2024). Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models. CVPR.
- Sander, Fernandez, Durmus (2025). Watermark Anything with Localized Messages. ICLR.
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Singh, Takahashi, Liao, Mitsufuji (2024). SilentCipher: Deep Audio Watermarking. Interspeech.
- Li, Wu, Xie (2025). VoiceMark: Zero-Shot Voice Cloning-Resistant Speech Watermarking. Interspeech.
- Liu, Zhang, Zhang (2024). Detecting Voice Cloning Attacks via Timbre Watermarking. NDSS.