Three layers, easily confused
Sorting these out explains most of the contradictory advice in this area, because each layer fails in a different way and people generalise from whichever one they met first.
| Layer | Where it lives | What removes it |
|---|---|---|
| Metadata and credentials | Beside the pixels in the file | Any upload that strips metadata |
| Invisible watermark | Inside the pixel values | Heavy crop, re-generation, strong compression |
| Statistical detection | Nowhere, it is inferred | Nothing removes it; accuracy just degrades |
| Visible watermark | Drawn on the image | Cropping, or an inpainting tool |
The third row is the odd one out and the reason a detector exists at all. There is nothing to remove, because nothing was added: the analysis reads properties the generation process produced incidentally.
That makes the layers complementary rather than competing. A watermark check is exact when it fires and silent otherwise; a pixel check always returns something and is never certain.
How an invisible watermark works
The generator makes small, structured adjustments to pixel values as the image is produced, in a pattern only a matching detector knows how to look for. The changes are below the threshold of visual perception by design.
Because the signal is in the pixels rather than in the file wrapper, it survives things that destroy metadata. Screenshotting, re-encoding, resizing and uploading to a platform all leave metadata behind and can leave a well-designed watermark intact.
That durability is the whole point, and it is also bounded. Aggressive cropping removes the parts of the pattern that were in the discarded region, heavy compression degrades it, and running the image through a second generative model overwrites the pixels entirely.
There is also a structural limitation that gets overlooked: the watermark is proprietary to the system that embedded it. A verifier built by one provider reads that provider marks and is silent about everybody else output, including every open model that embeds nothing.
Indicative. Behaviour differs between watermarking schemes and between platforms.
The last two columns are the interesting ones. A screenshot destroys the statistical signal a detector reads while leaving a durable watermark intact; re-generation does the opposite. Neither layer covers the other completely, which is the argument for having both.
Why you cannot check for every watermark
This is the practical limitation that disappoints people. Verification requires the detector that matches the embedder, and those are controlled by the organisations that built them.
Some providers expose a public verification page for their own output. Others make it available only to partners, and open models generally embed nothing at all, which means a large share of generated images on the web carry no watermark to find.
So a negative watermark result is close to meaningless. It tells you that this particular scheme did not fire, which is the expected outcome for output from any other system and for anything that has been re-encoded aggressively.
A positive result is the opposite: strong, specific and worth acting on. When a watermark verifier says a picture came from a particular system, that is a claim from the system itself rather than an inference about it.
Where this is going
The direction is toward layering rather than toward a single answer. Credentials in the file, a watermark in the pixels, and statistical detection over the top, each covering the cases the others miss.
Adoption is the bottleneck rather than the technology. Watermarking works well when the generator implements it, the platform preserves it and a verifier is available, and any of those three failing returns you to reading the pixels.
For anybody making decisions today, the practical stance is unchanged. Run the checks that are available, treat a positive marker as strong and a missing one as silence, and put the weight on provenance and context where the stakes are real.
Why removal research matters more than removal
Academic work regularly demonstrates that a given watermarking scheme can be stripped, and each demonstration is reported as though the idea has failed. That reading misses what the technique is for.
A watermark is not a lock. It is a cost imposed on the person who wants to pass generated output off as photographic, and a cost that most people will not pay. The casual reposting that accounts for the overwhelming majority of misleading imagery does not survive it.
The comparison worth making is with metadata, which is removed accidentally by every platform on the internet without anybody trying. A signal that requires deliberate effort to defeat is a substantial improvement even though a determined adversary defeats it.
Where the criticism does land is on claims of certainty. A provider saying its watermark proves origin is overstating; one saying its watermark identifies its own unmodified output is describing the thing accurately.
What to do with a positive result
Treat it as the strongest single signal available in this field, and still not as the end of the enquiry. A watermark identifies the system that produced the pixels, which is not the same as establishing what the image is being used to claim.
A generated illustration is not a problem because it is generated. It becomes one when it is presented as a record of something that happened, and that presentation is a question about the caption rather than about the file.
For anybody building a process around this, the sequencing that works is to check the file first, the watermark second where a verifier exists, and the pixels last. Each step is cheaper and more conclusive than the one after it, and most images are settled before the third.
The counter-intuitive part is that the least conclusive layer is the only one that always answers. That is not a criticism of detection; it is the reason it exists, and the reason a result should be read as a likelihood rather than as a verdict.