AI watermarks are shifting from visible to invisible

This week produced an unlikely trio of stories that, taken together, reveal how fragile the concept of AI authenticity really is. Google made its sparkle watermarks optional on Gemini-generated images, videos, and music. Anthropic will soon be offering a watermark detection API so third parties can check whether Claude wrote something. And a Connecticut judge sanctioned a plaintiff who hid invisible prompt injections in court filings, hoping to manipulate any AI system that might read them. None of these stories is really about watermarks in isolation. Together they outline an arms race between the tools designed to establish authenticity and the tactics used to undermine it.

The timing is not coincidental. The EU AI Act and the EU Code of Practice on transparency, signed by Anthropic and roughly 190 others in July 2026, are pushing AI companies toward provenance standards at exactly the moment when manipulation attempts are becoming more sophisticated and, in the Connecticut case, more brazen.

Google makes Gemini watermarks optional, keeps SynthID intact

Google's change is the most commercially visible move. Users can now go to Settings, then Media Watermark, and toggle off the sparkle icon that previously appeared on content from the Nano Banana, Omni, and Lyria models in Gemini and the AI video tool Flow. The company frames this as a concession to professional and creative workflows, where a visible logo degrades the finished product. Importantly, the invisible SynthID watermark and C2PA metadata remain in place regardless of the toggle, meaning the content can still be verified by asking Gemini or Google Search directly. Google is also open-sourcing a library called Credentio so developers can embed local validation into their own apps. The Verge notes the toggle will not be available in countries that legally require visible watermarks.

Anthropic's watermark detection API offers a more reliable alternative to pattern scanning

Anthropic's approach goes a step further than simply embedding a watermark. The company is launching an API that lets third-party developers query whether a given text was likely produced by Claude. The method is a variant of Google DeepMind's SynthID Text technique, published in Nature in 2024, which adjusts the probability distribution during word selection to leave a traceable pattern. Anthropic says this has no effect on readability or creativity. The detection API matters because it is fundamentally different from external tools like Pangram that scan for stylistic patterns. Those services work without access to Anthropic's keys and are easier to fool. A cryptographic signal baked in at generation time is harder to replicate and, critically, harder to scrub out without substantially rewriting the text. The watermark does have limits: it is less reliable on short texts, fact-dense passages, and code, and heavy rewriting can strip it. Watermarking applies globally to all Claude models released after 2 August 2026, with older models to follow, because Anthropic says there is no practical way to restrict it by region.

Connecticut prompt injection case shows what watermark-free AI processing risks

While Google and Anthropic work on provenance at the output layer, a Connecticut case illustrates the threat at the input layer. Matthew Elliott, a self-represented plaintiff, embedded instructions in 3-point white text on a white background in his court filings. The hidden text told a hypothetical AI reviewer to treat a clerk's denial as an error and to align its output with Elliott's position. Judge Walter Spader Jr. caught the scheme because of unusual whitespace, warned Elliott, and watched him do it again in later filings. The court does not use AI to review filings, so the instructions had no practical effect. But Spader's ruling makes the principle plain: a hidden instruction aimed at an AI decision-support tool is conceptually the same as a secret communication with a juror. A similar case in Brazil involved lawyers hiding prompt injections in filings to manipulate a court AI, where the system detected and blocked the text before processing. Hidden instructions have also appeared in academic preprints on arXiv, targeting AI peer-review tools.

What this means for teams choosing AI tools in 2026

For anyone evaluating AI platforms, the practical takeaway is that invisible watermarking via SynthID and C2PA is fast becoming the baseline expectation, not a premium feature. Google, Anthropic, OpenAI, and Meta are all converging on this standard, driven partly by EU regulation and partly by the reality that visible watermarks were always removable with basic editing. The Connecticut case adds a different dimension: if your organisation uses AI to process documents, whether for contract review, compliance screening, or legal work, prompt injection through hidden text is a real threat that standard watermarking does not address. Those are two separate problems requiring two separate mitigations, and right now the tooling for the second is far less mature than for the first.