The History of AI Watermarking: From Hidden Ink to Signed Provenance

Q: Does stripping metadata remove an AI watermark?

It removes the metadata-layer provenance (like a C2PA manifest), but it does nothing to an invisible watermark embedded in the pixels. The two live in different layers, which is why honest tools distinguish between them.

By Calabi Labs Editorial Team · 2026-08-04

AI watermarking is the practice of marking media so its origin can be traced — and it has a long history that predates AI by decades. It evolved from visible stamps, to hidden steganographic marks embedded in the pixels or audio, to today's dominant approach: cryptographically signed provenance metadata like C2PA Content Credentials. Understanding this lineage explains why "watermark" now means several very different things, and why the metadata era is where most of the action is.

The word "watermark" causes endless confusion in AI discussions because it spans three distinct technologies that were invented in different eras for different reasons. Walk through the history and the categories sort themselves out.

Origins: the visible watermark

The literal watermark is centuries old — a faint design pressed into paper during manufacture, visible when held to light, used to mark authenticity and origin on currency and official documents. Its digital descendant is the visible overlay: a semi-transparent logo stamped across a stock photo or a preview render. Visible marks are honest and obvious, but they're also easy to crop out and they deface the content. For AI provenance they were never a serious answer, because the whole point of AI provenance is to survive normal sharing without ruining the image.

The steganography era: hidden marks in the content

The next leap was hiding the mark inside the media so it couldn't be seen or easily cropped. This is digital steganography and robust watermarking, a field that matured through the 1990s and 2000s, driven largely by the film and music industries fighting piracy. The idea: subtly perturb pixels, frequency coefficients, or audio samples in a pattern a detector can recover even after the file is resized, re-compressed, or screen-recorded.

This lineage produced the invisible watermarks that some AI labs now embed in generative outputs. These marks live in the content itself, not the metadata, which makes them far more durable — they can survive edits that would wipe a metadata tag. It also makes them a genuinely hard problem: recovering or removing an invisible content watermark is difficult and inconsistent, and results vary widely depending on the scheme. An honest account of AI watermarking has to say plainly that content-embedded pixel watermarks are not reliably defeated, and no responsible tool claims to remove them.

The provenance era: signed metadata

The most consequential shift came in the last few years, and it moved the "watermark" out of the pixels and into a signed record attached to the file. Instead of hiding a mark in the content, the provenance approach writes an explicit, cryptographically signed statement of origin into the file's metadata.

This is where the Content Authenticity Initiative (Adobe, 2019) and the Coalition for Content Provenance and Authenticity (C2PA, founded 2021 by Adobe, Arm, the BBC, Intel, Microsoft, and Truepic) come in. Their approach isn't a hidden mark at all — it's a manifest, a signed document embedded in the file (in the JUMBF container) that declares what made the media and how it was edited, including an explicit DigitalSourceType: trainedAlgorithmicMedia flag for AI output. See c2pa.org for the standard.

Why did the industry pivot to metadata provenance when content watermarks are more durable? Three reasons. It's verifiable — a signature proves who made the claim and detects tampering. It's rich — a manifest can carry a full edit history, not just a yes/no bit. And it's interoperable — an open standard multiple vendors implement beats every lab inventing its own secret mark. The trade-off is that metadata can be stripped, which is why provenance and content watermarks are increasingly used together as complementary layers.

How the modern stack fits together

Putting the eras in order gives you a clean mental model of what "AI watermarking" means in 2026:

1. Visible marks — obvious overlays, easily cropped, rarely used for AI provenance. 2. Invisible content watermarks — embedded in pixels/audio, durable, hard to remove, results vary; the domain of individual labs' schemes. 3. Signed provenance metadata (C2PA) — an explicit signed manifest in the file's metadata, verifiable and rich, but removable. 4. Supporting forensics — EXIF/XMP metadata and encoder fingerprints that aren't watermarks but serve the same origin-tracing purpose.

Each layer answers "where did this come from?" with a different balance of durability, verifiability, and honesty.

What this means for a creator

The takeaway is to stop treating "watermark" as one thing. If you generate media, the most common and removable mark is the provenance layer — the signed C2PA manifest and the metadata around it that announce "made by AI." That's the layer that file-level normalization addresses: stripping a leftover manifest and making the metadata read as a consistent camera capture. The invisible content watermark, if a generator used one, is a separate matter — it lives in the pixels, results vary, and you should be skeptical of anyone claiming to reliably strip it. Knowing which layer you're dealing with keeps your expectations honest.

Calabi Sanitizer works at the file/metadata level — it strips leftover C2PA manifests and normalizes metadata and encoder identity, and it's explicit that invisible pixel watermarks are a different problem it doesn't promise to remove.

FAQ

Are all AI watermarks invisible marks in the pixels?

No, and this is the biggest misconception. Some are, but the dominant approach today is signed provenance metadata (C2PA Content Credentials), which is a document attached to the file rather than a mark hidden in the content. They're different technologies with different durability.

Which type of watermark is hardest to remove?

Invisible content watermarks embedded in the pixels or audio are the most durable because they survive many edits, and removing them is difficult and inconsistent. Metadata-based provenance marks are removable because they live in the file's metadata container, not the content.

Does stripping metadata remove an AI watermark?

It removes the metadata-layer provenance (like a C2PA manifest), but it does nothing to an invisible watermark embedded in the pixels. The two live in different layers, which is why honest tools distinguish between them.

Calabi Sanitizer automates the file-level cleanup described here — try it free at calabilabs.com (10 cleans, no card).