Three different mechanisms
| Mechanism | Where it lives | Removed by |
|---|---|---|
| Visible watermark | In the picture | Cropping, inpainting, re-framing |
| Invisible watermark | In pixel data | Re-encoding partly; determined removal fully |
| Content credentials | Signed metadata attached to the file | Screenshotting, re-recording, metadata-stripping platforms |
Pick by threat model: visible marks deter casual misuse; invisible marks survive casual re-sharing; credentials support audit. No single mechanism does all three.
Visible watermarks
Simplest to implement and easiest to remove, but that is not an argument against them.
- They work on the audience, which is their actual purpose — a viewer sees the mark and knows.
- They survive screenshotting and re-recording, which metadata does not.
- They are removed by cropping or inpainting, so they are a disclosure device rather than a security control.
Invisible watermarks
Embedded in the pixel data so they survive normal handling while being invisible to viewers.
- They generally survive compression and moderate re-encoding.
- They degrade under heavy compression, resizing and aggressive filtering.
- A determined adversary can remove them, because anything embedded can be attacked.
- Detection requires the detector, so value depends on who runs it.
C2PA content credentials
Content credentials attach a signed record of origin and edit history to the file. This is the most informative mechanism and the most fragile in practice.
- They record what created the media and what was done to it afterwards, signed so tampering is detectable.
- They travel with the file through normal distribution.
- They are stripped by screenshotting, screen recording, or any pipeline that re-encodes without preserving metadata.
- Adoption is incomplete: not every platform preserves or displays them.
Absence proves nothing: a file without credentials may simply have passed through a tool that dropped them. Never treat missing provenance as evidence of human authorship.
What survives what
| Action | Visible | Invisible | Credentials |
|---|---|---|---|
| Normal platform upload | Survives | Mostly survives | Depends on platform |
| Screenshot or screen record | Survives | Lost | Lost |
| Crop or re-frame | Often lost | May survive | Usually lost |
| Heavy re-encode | Survives | Degrades | Usually lost |
| Deliberate removal | Lost | Lost | Lost |
The honest limits
-
Accept that determined removal wins
Provenance raises the cost of misuse; it does not prevent it.
-
Do not rely on one mechanism
Use visible plus embedded plus credentials where the content warrants it.
-
Keep the original signed asset
Your own archive is the most durable provenance you control.
-
Combine with disclosure
Provenance supports disclosure; it does not replace it.
A provenance practice
-
Generate with credentials enabled
Where your tool supports it, turn provenance on at creation rather than adding it later.
-
Preserve metadata through your pipeline
Check each export step. This is where provenance is usually lost silently.
-
Add a visible mark where disclosure is required
Especially for regulated content or synthetic performance.
-
Archive the first-generation asset
Keep the original signed file with its creation record.
-
Verify your own output
Run your published files through a credentials reader and see what survives your pipeline.