Skip to main content
AI Watermark Removal

Is it watermarked?

Is Llama Watermarked? Meta's Own Documents Say Nothing

Meta's Llama 3.1 and Llama 4 model cards contain zero mentions of watermarking, and so do the Purple Llama and Llama Guard docs and Meta's July 2026 EU transparency announcement. Meta does watermark other things: Content Seal marks images from Muse Image, and a separate, far less publicized product has been fingerprinting AI-generated audio since April 29, 2025. What Meta has never done is confirm that ordinary Llama or Meta AI chat text carries any mark, and the reason may be structural as much as strategic, because once model weights ship Meta no longer controls how the text gets generated.

Published 2026-08-11Updated 2026-08-11Rumor/speculation

Key takeaways

  • Checked directly: Meta's Llama 3.1 and Llama 4 model cards, its Purple Llama and Llama Guard documentation, and its July 2026 EU transparency announcement contain zero mentions of text watermarking.
  • Confirmed: Content Seal, Meta's invisible image watermark, covers only images generated through Muse Image. Meta says it plans to extend the system to video, but no shipped video launch had been announced as of this check.
  • Underreported: Meta's Llama Defenders Program shipped an audio watermark detector on April 29, 2025, over a year before Content Seal, aimed squarely at voice-fraud detection, with early adopters including Zendesk, Bell Canada, and AT&T.
  • A real contradiction: Meta refused the EU's general-purpose-AI Code of Practice in July 2025, with Chief Global Affairs Officer Joel Kaplan citing legal uncertainties and provisions that go far beyond the scope of the AI Act. It then signed the separate Code of Practice on Transparency of AI-Generated Content, which explicitly covers text, on July 28, 2026, and its own signing announcement discusses only image-detection tooling.
  • Structural problem: because Llama ships as open weights, the operator running inference controls decoding, not Meta, so a sampling-time text watermark applied on Meta's servers would never reach a self-hosted deployment.
  • Research, not product: a 2024 paper by Christ, Gunn, Malkin, and Raykova proposes the first watermarking scheme built specifically for open-weight models, and Meta's own FAIR researchers have shown that watermarked training text leaves detectable traces in models fine-tuned on it, a property they call radioactivity.

Provider map

Text watermark status by provider

Detector guide
ClaudeClaudeConfirmed text marksGeminiGeminiContested: app/web vs APIChatGPTChatGPTWatchlistGrokGrokWatchlistLlamaLlamaNo confirmed text markDeepSeekDeepSeekVisible label, not invisible
How to read this map

Confirmed means an official or primary source documents text watermarking. Contested means official sources disagree with each other. Watchlist means regulation, research, or provider behavior makes the topic worth tracking closely.

The absence, checked directly

Rumor/speculation

You'll see exactly which Meta documents were searched, and what a clean set of zero results does and does not prove.

These primary sources were checked for this piece, not assumed:

  • The Llama 3.1 model card
  • The Llama 4 model card
  • Purple Llama and Llama Guard safety documentation
  • The Content Seal launch post
  • Meta's July 2026 announcement of its EU transparency-code signature

None of them mentions text watermarking, not as a shipped feature and not as a planned one. That is a genuine absence after a real search.

It matters because most of what circulates about a Llama watermark traces back to an assumption about what a big AI lab must be doing by now. Meta has published neither a yes nor a no.

What Meta does watermark, and it isn't one system

Confirmed

Here's the media watermarking Meta has actually shipped, including a product line most write-ups leave out entirely.

Meta has documented visible markers, invisible pixel-level watermarks, and file metadata together for photorealistic AI images across its apps. Content Seal is the newer piece: an invisible provenance watermark applied to images generated with Muse Image in the Meta AI app and on meta.ai since its July 7, 2026 launch.

Meta engineered Content Seal to survive:

  • Cropping
  • Compression
  • Resizing
  • Screenshotting

Meta has said it plans to extend Content Seal to video. As of this check, no shipped video launch has been announced, only that same standing promise.

Less widely known: Meta's Llama Defenders Program launched a dedicated audio watermark detector, sometimes called the Llama Generated Audio Detector, on April 29, 2025. That is more than a year before Content Seal existed, under different branding, for a different purpose.

It targets voice fraud rather than general content labeling, and its early adopters tell you so:

  • Zendesk
  • Bell Canada
  • AT&T

Those are support-desk and telecom companies catching cloned voices on phone calls, not publishers labeling pictures in a feed.

A code Meta refused, and a code Meta signed

Official announcement

You'll get the 13-month gap between Meta rejecting one EU code and signing another that explicitly covers text.

In July 2025, Meta declined to sign the EU's Code of Practice for general-purpose AI models. Chief Global Affairs Officer Joel Kaplan cited legal uncertainties and described some of its measures as going far beyond the scope of the AI Act.

Thirteen months later, on July 28, 2026, Meta signed a different code: the Code of Practice on Transparency of AI-Generated Content, alongside roughly 190 signatories in total, Anthropic, Google, Microsoft, and OpenAI among them. That code explicitly covers text alongside image, video, and audio.

Read the two events together and the status of Llama and Meta AI text sits exactly where it started: undocumented, by a company that just signed a commitment covering it.

Open weights make this a different problem

Research/proposal

Here's the engineering reason a Meta-side text watermark would never reach a self-hosted Llama, and what researchers propose instead.

The watermarking Google and Anthropic apply to text happens during generation, by nudging which tokens get chosen. That only works if you control the decoder.

Meta stops controlling the decoder the moment it releases Llama's weights. A scheme running on Meta's own servers would not follow the model onto someone else's hardware.

That gap is not hypothetical, and there is a paper written specifically to close it. Christ, Gunn, Malkin, and Raykova's 2024 "Provably Robust Watermarks for Open-Source Language Models" embeds the watermark by modifying model parameters rather than biasing sampling, and proves it resists tampering unless the attacker destroys output quality in the process.

It is the first scheme designed for exactly this open-weight scenario. It is also still an academic proposal, tied to no Llama release.

Meta's own researchers have published adjacent work. "Watermarking Makes Language Models Radioactive" (NeurIPS 2024), by Sander, Fernandez, Durmus, Douze, and Furon, all Meta or FAIR affiliated, shows that fine-tuning a second model on text a watermarked model produced leaves contamination that stays statistically detectable in the second model's own output.

FAQ

Can open-source LLM text be watermarked?

Yes, if whoever runs inference integrates a watermarking method during generation. Meta releasing Llama's weights does not mean every deployment is watermarked the same way, or at all, because that decision sits with the operator running the model.

Does Meta's EU Code of Practice signature mean Llama text is now marked?

Not necessarily, and the history is more tangled than one signature suggests. Meta declined the EU's general-purpose-AI code in 2025 over scope concerns, then signed the separate content-transparency code covering text in 2026, and its own announcement of that signature talks only about image-detection tools.

Is Meta's audio watermark detector the same system as Content Seal?

No. They are different products under different branding, built more than a year apart: the audio detector shipped in April 2025 for voice-fraud detection with telecom and support-industry customers, while Content Seal launched in July 2026 for images generated through Muse Image.

What would actually settle the Llama text question?

A statement from Meta naming a mechanism, ideally in a model card, plus a way to check for it. Until then, the accurate description is that Meta has documented image and audio watermarking and has documented nothing at all for text.

Next steps

Sources and citation status