Three layers, three fates
The word "labelling" hides three technically completely different things, and most of the confusion comes from treating them as one.
- Visible mark. An icon or a caption on the image. Anyone can see it, anyone can crop it off.
- Metadata. Signed information written into the file about what made the image and what happened to it afterwards. It is not visible, but it is editable and removable.
- Invisible watermark. A mark encoded into the pixels themselves, imperceptible to the eye, that travels with the image. This is the only one that survives a screenshot.
Metadata: the weakest and the most useful
The metadata approach is essentially a signed log inside the file: which device made the image, with which model, what was edited afterwards. There is a mature industry specification for it, and the large vendors are building it into their products one after another.
Its weakness is stated in the specification's own documentation: it does not protect against complete removal. A screenshot, a re-save, a social platform's compressor — any of them throws it out. It is still the most useful layer, just not for what many people assume: it is not there to expose forgery, it is there to make an honest chain traceable. Where authenticity is part of the product, this layer supplies the evidence; where somebody is deliberately cheating, it will not catch anyone.
The invisible mark: the strongest, but not untouchable
The invisible watermark goes into the image at the moment of generation, not afterwards — so it is not a layer on top of the picture but a tiny, targeted modification of the pixels. That is why it survives cropping, colour grading, compression and the screenshot.
The vendor's own measurements for the best-known such system show striking numbers: detection above 99 percent even in the worst case, with a very low false alarm rate. Two caveats belong here, though. One is that the paper on the image system has not been through scientific peer review — the peer-reviewed publication is about the text version. The other is that the public verification tool that goes with it is still behind a waitlist, so in practice you cannot examine anybody's image with it.
The measurement that sobers you up
In 2026 a study appeared that tested how well invisible watermarks hold up against one specific attack: running the image through another generative model, which recreates the same picture. The results are as follows.
- One established marking system's detection rate fell from 99.8 percent to 7.4 percent, and then to zero in a second round.
- Another one the same way: from 99.9 percent to 12.8 percent, then to zero.
- Even the best system in the test went from 100 percent to 24.5 percent, and then to 1.6 percent.
- The most widespread vendor system was not among those tested — about that one this measurement tells us nothing.
That does not mean watermarking is useless. It means it does not protect against deliberate removal, and anyone who claims otherwise is promising more than the technology delivers. A watermark is good for marking accidental spread and good-faith use.
The signature that was forged
There is a third weakness, and it is the most embarrassing one. In August 2026 a researcher produced a fake provenance record that passed as valid on the official verification site — the system said the image had come from a real camera when it had not. The answer to the report was that the problem is unsolvable, and therefore will not be fixed.
The case shows exactly where the limit of the system lies. Provenance rests on a chain of trust: it is worth something only if the signer's certificate is on a trusted list. You can produce a manifest with your own signature as well, it simply will not be flagged as trustworthy. So in practice the question is not "does it carry a credential", but who signed it, and do you trust them.
What the law requires
2026 is the year of labelling, in three big regulatory directions.
- Under the EU AI Act the labelling is the provider's obligation: generated content has to be marked in a machine-readable way. That applies from August 2026, with a grace period until the end of the year for systems already on the market.
- On the user side the obligation is narrower: public disclosure applies to deceptive content, not to every generated image.
- The voluntary code of practice drawn up for it expects two layers for images — signed metadata and an invisible watermark at once — and only one for text; the still more detailed expectations for video are what Labelling AI Video works through.
- One large Asian market is far stricter than this: there a visible caption is required, with a character height of at least five percent of the image's shorter side.
What to do with your own images
- Do not strip the marking out. Most generators write the metadata in by themselves; image editors and compressors, on the other hand, often throw it away. Check it in the finished file.
- Where a platform asks, tick the box. It is the cheapest risk management there is, and the platforms recognise the invisible mark by themselves anyway.
- Running locally, the marking is your job. Models run on your own machine typically put nothing into the file — Running Image Models Locally covers that in a separate post.
- Do not cite it as proof. Neither its presence nor its absence proves anything: one of them can be forged, the other disappears with a screenshot.
Common misconceptions
- "If there is no marking on it, it is a real photograph." The most common and the most dangerous mistake. The absence of a mark means only that there is no mark.
- "A watermark cannot be removed." A regeneration takes detection to practically zero. Vendor promises are about everyday editing, not about a targeted attack.
- "This is an international standard by now." Standardising metadata provenance is under way, but not finished. It is an industry specification, not a completed international standard.
- "Labelling takes away my rights in the image." It does not. Labelling and ownership are two separate questions — Who Owns an AI-Generated Image? answers that one.
What to take away
The whole topic in three sentences: metadata dies at a screenshot, the watermark survives a screenshot, and the watermark dies at a regeneration. What follows from that is that these systems are good for documenting an honest chain, not for exposing fraud. So your job is to leave the marking on your own images and to spell it out where you have to — the rest is completed by When to Disclose AI Use, the post about what the consumer gets told.