Learn · Demo
AI watermarking, made visible
As more images and text are produced by AI, watermarking embeds an invisible, machine-detectable signal so content can be traced back to its source. Two families of technique sit behind most schemes: hiding a signal in an image's pixels, and steering a language model's word choices. Both below run live in your browser, with the real embedding and detection maths.
The simplest image watermark hides bits in the least-significant bits (LSBs) of each pixel. Nudging a colour value by one step is invisible to the eye but perfectly readable to a decoder. Type a secret message, embed it, and compare the images — then amplify the difference to see exactly where the signal lives.
More bits store a longer message and make the mark more robust, but start to become visible.
Original
Watermarked
Difference (amplified)
Decoder output
Bits in the pixels
The message becomes a stream of bits (a 16-bit length, then the UTF-8 bytes). Each red, green and blue value gives up its lowest bit to carry one bit of the payload. Changing a value from 174 to 175 shifts the colour by less than one part in 255.
Invisible, then obvious
The watermarked image looks identical, yet the amplified difference reveals the payload as speckle across the pixels it touched. Raise the bits-per-channel and the speckle, and the capacity, both grow.
Why it is fragile
Press Simulate save / compression and the decode breaks: lossy re-saving rounds the pixels and wipes the lowest bits. Production watermarks embed the signal in a more robust, frequency-domain form so it survives it.
Honest caveats. The image side uses plain LSB steganography: real image watermarks such as Google's SynthID embed the signal in a learned, frequency-domain representation so it survives resizing, cropping and compression, but the principle — a signal below the perceptual threshold — is the same. The text side implements the published green-list watermark (Kirchenbauer et al., 2023) exactly, including the z-score detector; the only toy part is the tiny built-in bigram “model”, so the prose reads as plausible word-salad rather than a real LLM. For related ideas see temperature & sampling, LLM evaluation and the video shelf.