Should we skip watermarking entirely then?

No — watermarking does a job provenance cannot, which is communicating something to a person looking at the image with no tooling at all. A visible mark on free-tier output is a reasonable product decision and a reasonable deterrent. The error is treating it as your compliance answer, because a mark on the pixels cannot tell anyone which rules authorised the image or whether that permission still stands.

How well do invisible watermarks survive re-encoding?

It varies enormously by scheme and by attack, which is itself the finding. Mild recompression is usually survivable; aggressive cropping, rescaling, screenshotting through a phone camera and generative inpainting degrade detection substantially. Any vendor quoting a single robustness percentage without naming the attack set is quoting a marketing number rather than a measurement.

Can provenance metadata be faked?

Not if it is signed with a key you hold. Someone can strip a manifest, and someone can attach an unsigned one that claims anything, but neither produces a record that verifies. That asymmetry is the whole security property — absence of a valid record proves nothing, presence of one proves a great deal.

Most platforms end up wanting both, for different audiences. Provenance answers regulators, acquirers and the person filing a takedown. A visible watermark answers the person scrolling past. We use the visible mark on free-tier output and the signed manifest on everything, which reflects who each is actually for.

Which one satisfies the 48-hour removal duty?

Provenance, and it is not close. Meeting the duty means identifying which outputs are affected and demonstrating they were removed inside the window. A watermark on a file you have already lost track of contributes nothing to either half of that. A queryable record of what was authorised, for whom, and under which version turns the whole exercise into a lookup.

Reviews7 August 20266 min read

AI Image Watermark vs Provenance: Which Actually Works?

We compare AI image watermarking with signed provenance on six criteria. Only one survives a takedown request. See which to build first.

By LikeWard Engineering Desk

A laptop screen showing code, comparing AI image watermark techniques against signed provenance records

Photo via Unsplash

Every platform building with generative imagery eventually asks the same question, usually a week before a compliance deadline: is an AI image watermark enough? The honest answer is that watermarking and provenance solve different problems, and only one of them survives the conversation you are actually preparing for.

This is a straight comparison across six criteria that matter operationally — not a survey of techniques. We build one of these and use the other, so treat the conclusion as informed and interested; the reasoning is laid out so you can disagree with it.

Verdict up front

Watermarking wins on human legibility and deterrence. Nothing else needed to see it.

Provenance wins on evidence, scope, revocation and regulatory fit — decisively.

They are complements, but only one is a compliance control.

Any watermark robustness claim without a named attack set is marketing.

If you can only build one: provenance.

What each one actually is
The six criteria
Scorecard
Where watermarking genuinely wins
Where watermarking fails you
What a combined design looks like
Buying advice

What each one actually is

Watermarking modifies the image. Visible marks overlay something legible; invisible schemes perturb pixel or frequency data so a detector can recover a signal later. Either way the claim lives in the pixels.

Provenance attaches a signed record about the image: who authorised it, under which rules, for whom, when. The claim lives beside the pixels, and it is signed so alteration is detectable. We covered the mechanics in content provenance explained.

The distinction people miss: a watermark can say "this is synthetic". It cannot say "this was permitted by this person under version 3 of their rules, and that permission was withdrawn on Tuesday". Those are the sentences compliance runs on.

The six criteria

1. Human legibility. Can someone with no tools tell? Visible watermarks: yes, trivially. Invisible watermarks: no, by design. Provenance: only if the viewing surface renders credentials, which most still do not.

2. Tamper evidence. Can you tell it was altered? Watermarks degrade rather than fail cleanly, so you get a confidence score and an argument. Signed provenance fails cleanly — verification passes or it does not.

3. Scope expression. Can it record what was permitted? Watermarking: no, and this is the structural gap. There is nowhere to put "portrait and fitness contexts, stylised ceiling, nudity forbidden". Provenance: that is the payload.

4. Revocation. Can it reflect withdrawn consent? A watermark is fixed at creation and says the same thing forever. Provenance status is live — the record flips to revoked and every subsequent check sees it.

5. Survivability. Watermarks survive some transformations and not others; screenshots through a phone camera and generative inpainting are notably hard. Metadata is stripped easily and often innocently — but stripping destroys a true record rather than forging a false one, so the failure mode is "unknown", not "wrongly authorised".

6. Regulatory fit. The TAKE IT DOWN Act requires removal inside 48 hours plus reasonable efforts on known copies. The Online Safety Act 2023 requires record-keeping and swift action. Card networks require documented consent produced on request. All three need facts about authorisation. None of them is satisfied by a mark.

Scorecard

Criterion	Visible watermark	Invisible watermark	Signed provenance
Human legibility	Strong	None	Weak (tooling-dependent)
Tamper evidence	Weak	Moderate, probabilistic	Strong, binary
Records permitted scope	No	No	Yes
Reflects revocation	No	No	Yes
Survives screenshot	Usually	Varies widely	No (record is separate)
Forgery resistance	Weak	Moderate	Strong (key-based)
Answers a regulator	No	Partially	Yes
Answers an acquirer	No	No	Yes

Table: comparison across the criteria that determine whether an approach survives a takedown request or an acquirer review. "Varies widely" is the honest entry for invisible watermark robustness — results depend on the scheme and the attack set.

Where watermarking genuinely wins

Do not read the scorecard as dismissal. A visible watermark does one thing nothing else does: it communicates to a person who has no tooling, no account and no interest in verification. That is most people.

It also deters casually. Someone repurposing an image for a fake profile prefers unmarked material, and friction has value even when it is not a barrier.

That is why LikeWard puts a visible mark on free-tier output while every authorised output — free or paid — carries a signed manifest. The mark is for the viewer. The manifest is for everyone who will later ask a harder question.

Where watermarking fails you

Three concrete failures.

The takedown request. Someone reports an image. To meet a 48-hour duty you must find it, find known copies, and demonstrate removal. A watermark tells you it came from you. It does not tell you which record, which creator, which permission, or which other outputs share the problem.

The revoked creator. A creator withdraws consent. Every watermarked image still says exactly what it said yesterday. Provenance status flips, and anyone checking a copy sees licensed: false with a reason and a timestamp.

The acquirer review. "Show me the consent record for this image." A watermark is not a consent record. This is the failure that ends processing relationships, and we walked through it in the card network consent rules guide.

"We kept meeting teams who had bought a watermarking product and believed they had bought compliance. They had bought a label. Labels are useful. Nobody has ever satisfied a removal duty with one." — LikeWard engineering desk

What a combined design looks like

If you are building this from scratch:

Sign a manifest on every authorised output. Creator, boundary-set version, requester, age-assurance state, timestamp, engine version.
Expose verification without an account. The person most likely to check is the one depicted, who has no login.
Report signatureValid and licensed separately. They are different questions and conflating them is a real bug.
Visible mark on free tier. Product signal and deterrent.
Add invisible watermarking if your threat model needs it — and measure it against your own attack set rather than the vendor's.
Never cache licence status. Revocation must land on the next check.

The Coalition for Content Provenance and Authenticity is where interoperable credentials are heading, and NIST has engaged with provenance through its AI work. If you want other tools to read your credential, target C2PA. If you want operational answers today, a signed manifest gets you there — provided you say which one you have actually built.

Buying advice

Ask for the attack set. Any robustness number without one is unfalsifiable.

Ask what happens on revocation. If the answer is about future generations only, the product does not model consent as something that changes.

Ask whether verification needs an account. If it does, the wrong people can use it.

Ask what the record contains. "It proves the image is ours" is not the same as "it proves this image was permitted".

Do not buy a watermark as a compliance control. Buy it as a product feature, which is what it is.

Next: content provenance explained for the technical detail, or the TAKE IT DOWN Act compliance guide for the duty this is all pointed at. You can verify any LikeWard output on the verification page.

Frequently asked questions

Should we skip watermarking entirely then?: No — watermarking does a job provenance cannot, which is communicating something to a person looking at the image with no tooling at all. A visible mark on free-tier output is a reasonable product decision and a reasonable deterrent. The error is treating it as your compliance answer, because a mark on the pixels cannot tell anyone which rules authorised the image or whether that permission still stands.
How well do invisible watermarks survive re-encoding?: It varies enormously by scheme and by attack, which is itself the finding. Mild recompression is usually survivable; aggressive cropping, rescaling, screenshotting through a phone camera and generative inpainting degrade detection substantially. Any vendor quoting a single robustness percentage without naming the attack set is quoting a marketing number rather than a measurement.
Can provenance metadata be faked?: Not if it is signed with a key you hold. Someone can strip a manifest, and someone can attach an unsigned one that claims anything, but neither produces a record that verifies. That asymmetry is the whole security property — absence of a valid record proves nothing, presence of one proves a great deal.
Do we need both?: Most platforms end up wanting both, for different audiences. Provenance answers regulators, acquirers and the person filing a takedown. A visible watermark answers the person scrolling past. We use the visible mark on free-tier output and the signed manifest on everything, which reflects who each is actually for.
Which one satisfies the 48-hour removal duty?: Provenance, and it is not close. Meeting the duty means identifying which outputs are affected and demonstrating they were removed inside the window. A watermark on a file you have already lost track of contributes nothing to either half of that. A queryable record of what was authorised, for whom, and under which version turns the whole exercise into a lookup.