AI watermarks vs hashes vs signatures: what each can prove about an image

An AI watermark, a file hash and a digital signature can all be described as "a mark that proves something about an image". They prove very different things. A hash such as SHA-256 proves the bytes are unchanged. A signature proves who vouched for them. A watermark suggests that a particular AI system produced the pixels.

This page, part of our guides to checking content, takes each in turn, then sets them side by side. The short version: check the signed record first, then the watermark, and never read a missing watermark as proof of anything.

File hashes

A file hash such as SHA-256 is computed from the file. Nobody adds it; anyone can recompute it. If two files give the same SHA-256, they are identical, byte for byte.

That exactness is both the strength and the limit. A hash is perfect for "is this the file that was published?" and useless for "is this resized copy the same picture?", because any change to the bytes produces an unrelated hash. For matching pictures that are similar but not identical, you need a fingerprint instead, which is the subject of perceptual hashes versus SHA-256.

A hash also says nothing about origin. It identifies a file, and it names no maker. Its value is as a reference point: if you record the SHA-256 of an image the day you receive it, you can later show that the copy you are discussing is the same one, whatever anyone else claims about it.

Signed content credentials

A content credential wraps a hash in a signed record. The C2PA specification calls the hash a hard binding, "one or more cryptographic hashes" of the asset, and puts it inside a claim that the signer signs with a certificate (C2PA 2.5). The record can also state which tool made the image and whether it was generated by AI.

This is the strongest of the three: a valid credential shows the image is unchanged since signing and identifies the key that signed it. Its weakness is that it lives in the file's data rather than its pixels. A screenshot, a re-save in software that ignores it, or an upload to a service that strips metadata will remove it. You can check an image's content credentials in a browser in under a minute.

Invisible AI watermarks

An invisible watermark is written into the content itself, in a way people should not notice. Google DeepMind's SynthID is a well-documented example. Google says SynthID "embeds digital watermarks directly into AI-generated images, audio, text or video", and that the image and video watermark is designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression (Google DeepMind, SynthID).

Text works differently. Google describes the text watermark as adjusting the probability scores the model assigns to each next word, so the pattern sits in word choice rather than in pixels. That makes it detectable by the vendor's tool in long enough passages, and it leaves nothing a reader can inspect directly. It is one reason deciding whether text is AI-generated is so much harder than checking a file.

Checking for a watermark requires the vendor's own detector. For SynthID, Google says you can upload an image, video or audio clip to Gemini and ask whether it was created or altered by Google AI, and that a separate SynthID Detector portal checks files from Google and its partners. Each detector looks for the watermarks it was built for, so a clean result from one says nothing about generators outside its list.

Why the rules now point at watermarks

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text to ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated" (AI Act Service Desk, Article 50). The article does not prescribe one method. Watermarks, metadata labels and signed credentials are all candidate ways to meet it, which is why many generators now combine more than one.

Method and sources

The comparison below is built from primary documents: the C2PA 2.5 specification for hashes and signed content credentials, Google DeepMind's SynthID documentation for invisible watermarks, and Article 50 of the EU AI Act for the marking duty. It compares what each signal can prove, not how any one product performs.

Side by side

The C2PA specification ties the last two together. It defines a soft binding as either a fingerprint or a content identifier "embedded as an invisible watermark", and explains that soft bindings let content be matched "even if the underlying bits differ", including after a manifest has been removed (C2PA 2.5, soft bindings). A watermark can be the thread that leads back to a credential that a re-save stripped away.

Which to check first

Run the checks from strongest to weakest, and stop treating any result as final until you have tried the stronger ones.

1. Content credential. If one validates and is trusted, you have the signer, the tool and the edit history, plus a hash that proves the file is unchanged. Strongest available evidence. Cannot prove the content is true.
2. Hash comparison. If someone gives you a reference hash or an original file, compare SHA-256 values. Proves identity exactly. Proves nothing about origin.
3. Watermark detector. If the image may come from a vendor that watermarks, run that vendor's detector. A positive result is good evidence that the vendor's system produced or edited it. A negative result is weak, because it covers one vendor only.
4. Metadata, reverse search, visual checks and general detectors. Below all three, and easier to fake or mislead.

The common mistake is to treat the watermark check as a general AI test. A watermark detector answers a narrow question, "did this vendor's system make this?", quite well, and says nothing about every other generator.

For a deeper look at watermarking methods and how they are tested, AFIP's guide to AI watermarking covers the research side. For a full, ordered walk through every check on one suspect picture, use the checklist for deciding whether an image is AI-generated.

Sources

1. Google DeepMind, SynthID
2. C2PA Technical Specification 2.5, hard and soft bindings
3. European Commission AI Act Service Desk, Article 50

Questions

• If an image has no AI watermark, does that mean a person made it?+

  No. Only some generators add watermarks, and each vendor's detector looks for its own. A missing watermark rules out very little.

• Can I check an image for a SynthID watermark myself?+

  Yes, for Google's watermark. Google says you can upload an image, video or audio clip to Gemini and ask whether it was created or altered by Google AI, and it also runs a SynthID Detector portal. Neither checks for other companies' watermarks unless they are partners.

• Is an AI watermark the same as a content credential?+

  No. A watermark is a signal hidden in the content itself; a content credential is a signed record attached to the file. The C2PA standard can use a watermark as a soft binding to find a credential again after it has been stripped.

• Can AI watermarks be removed?+

  Vendors design them to withstand ordinary edits such as cropping, filters and compression, but no vendor claims they are impossible to remove. Treat a positive result as useful evidence and a negative result as no evidence.

• Does the law require AI images to be watermarked?+

  In the EU, Article 50(2) of the AI Act requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable format so they are detectable as artificially generated. It does not name a specific technique.