Provider tracker

Meta AI Watermark: Content Seal, Audio, and the Research That Never Shipped

Meta runs two separate watermarking product lines that most write-ups conflate into one. Content Seal invisibly marks images made with Muse Image, while a completely different system, the Llama Defenders Program's audio watermark detector, has been guarding against voice fraud since April 2025, more than a year earlier. Neither says anything about Llama or Meta AI chat text, Meta's own model cards confirm that gap directly, and Meta's most influential watermarking work exists only as a paper.

Published 2026-08-11Updated 2026-08-11Confirmed

Key takeaways

Confirmed: Meta AI's photorealistic images carry visible markers, invisible pixel-level watermarks, and file metadata, a three-layer system Meta has documented since February 2024.
Confirmed: Content Seal, launched July 7, 2026 alongside Muse Image, invisibly watermarks images from the Meta AI app and meta.ai, engineered to survive cropping, compression, resizing, and screenshotting. Meta says video support is coming, and nothing has shipped yet.
Confirmed and widely missed: a separate Llama Defenders Program audio watermark detector launched in April 2025, over a year before Content Seal, aimed at voice-fraud detection, with Zendesk, Bell Canada, and AT&T as early adopters.
Research only, not shipped: Meta's Stable Signature roots a watermark inside a diffusion model's decoder and stays over 90% accurate at a false-positive rate below one in a million even after an image is cropped to a tenth of its size. Meta's separate radioactivity research shows text from a watermarked model leaves detectable traces in any smaller model later fine-tuned on it.
A targeted patent search across assignee, keyword, and inventor queries found zero Meta-assigned watermarking patents, consistent with Stable Signature living only in an academic paper.
Checked directly: Meta's Llama 3.1 and Llama 4 model cards contain no mention of watermarking, and Meta refused the EU's general-purpose-AI Code of Practice in 2025 while still signing the separate code covering AI-generated content transparency, which explicitly covers text, without ever addressing text watermarking in its own announcement.

Media watermarking

How image, audio, and video marking differs from text

Embedded in the signal, not the sampling

Image, audio, and video watermarks (SynthID, Content Seal, Stable Signature) are embedded directly into pixels, audio samples, or frames after generation. This is a different mechanism from statistical text watermarking, which biases token choice during generation.

Designed for robustness, not guaranteed

Providers describe these signals as surviving common transformations such as cropping, compression, or resizing better than file metadata does. That is a robustness design goal, not a claim that the signal is unremovable.

Why this matters for removal tools

A tool that strips file metadata does not touch an embedded pixel, audio, or video watermark, and vice versa. Claims of "AI watermark removal" for media should specify which of these signals (metadata, embedded signal, or visible mark) a tool actually addresses.

The image stack: three layers, two eras

Confirmed

Here's every image signal Meta says it applies, and which product each one belongs to.

Since February 2024, Meta has said photorealistic images made with Meta AI carry three separate signals:

A visible marker on the image itself
An invisible watermark embedded in the pixels
Metadata written into the file

Each layer fails differently, which is the point. Crop away the visible mark and the invisible one can still be there; strip the metadata during a re-upload and the pixel-level signal might survive.

Meta's Muse Image announcement, dated July 7, 2026, introduced Content Seal: invisible watermarking specifically for images created in the Meta AI app and on meta.ai.

Meta built it to survive:

Cropping
Compression
Resizing
Screenshotting

Meta says it plans to extend Content Seal to video. As of this update, no shipped video launch has been announced, only that standing promise.

The second watermark line most coverage misses

Confirmed

You'll get the Meta watermarking product that launched over a year before Content Seal, for a completely different reason.

Long before Content Seal existed, Meta's Llama Defenders Program shipped an audio watermark detector in April 2025. Different branding, different purpose: catching AI-generated voice used in fraud, not disclosing ordinary AI content.

Its early adopters were:

Zendesk
Bell Canada
AT&T

Content Seal is the newer of two distinct product lines, not the whole story.

The research Meta didn't ship, and didn't patent

Research/proposal

Here's what Meta's labs proved about watermarking, and the search result suggesting none of it became product IP.

Fernandez and colleagues, a Meta and Inria research team, published Stable Signature in 2023. It roots a watermark inside a latent diffusion model's own decoder, so every image the model generates carries a recoverable signature by construction.

In a broad academic sweep it turned out to be the single most-cited image-watermarking paper found, at roughly 428 citations. It stays over 90% accurate at a false-positive rate below one in a million even after an image is cropped down to a tenth of its original content.

That is a research result, not a description of what Content Seal actually runs. Meta has never claimed the two are the same thing.

Meta's FAIR team, led by Sander and colleagues, has separately published on watermark radioactivity: fine-tune a smaller model on text a watermarked model produced, and the contamination stays statistically detectable in the smaller model's own output. FAIR has also published post-hoc, rephrasing-based text watermarking applied after generation.

Signed for text transparency, silent on text watermarking

Official announcement

You'll see the one gap Meta's own announcements never close, and the engineering reason it may be hard to close.

In 2025, Meta refused the EU's general-purpose-AI Code of Practice, with Chief Global Affairs Officer Joel Kaplan citing legal uncertainties and calling its measures far beyond the scope of the AI Act.

Then on July 28, 2026, Meta signed a different, more specific code: the EU Code of Practice on Transparency of AI-Generated Content, alongside roughly 190 signatories in total, including Anthropic, Google, Microsoft, and OpenAI. That code explicitly covers text output.

Meta's own announcement of the signature discusses only image-detection tooling and never mentions text. Meta's Llama 3.1 and Llama 4 model cards, checked directly, contain no mention of watermarking either.

That absence stands out against the rest of the field. Anthropic and Google have each published a specific position on their own text watermarking, contested in Google's case but at least stated, while Meta has published neither a yes nor a no.

There is a real engineering constraint underneath it, worth naming rather than leaving on Llama's page alone. Once Meta releases a model's weights, it no longer controls how that model gets decoded downstream, so a watermark applied at Meta's own inference time would not travel with a self-hosted copy.

That is exactly the gap Christ, Gunn, Malkin, and Raykova's 2024 proposal for weight-embedded watermarking is trying to close. It remains a proposal.

FAQ

Does Meta document text watermarking for Llama outputs?

No. Meta's watermarking documentation and research cover images and, less visibly, audio, while nothing in its model cards, the Content Seal announcement, or its EU transparency-code signature claims that ordinary Llama or Meta AI chat text carries a watermark.

Is Content Seal the same system as Meta's audio watermark?

No, they are unrelated products. Content Seal covers images generated with Muse Image and launched in July 2026, while the audio watermark detector is part of the Llama Defenders Program, launched in April 2025 for voice-fraud detection under different branding.

Has Meta patented its image watermarking technology?

Not that a targeted search found. Stable Signature, Meta's most-cited watermarking research, appears to exist only as an academic paper, and no Meta-assigned watermarking patent turned up across assignee, keyword, and inventor-name queries.

Could a self-hosted Llama deployment ever carry a text watermark?

Only if whoever runs inference adds one themselves. Meta releasing a model's weights means Meta no longer controls decoding downstream, so a scheme applied at Meta's own inference time would not follow the model into someone else's deployment.

Next steps

Take the text-specific question on its own terms, including the primary sources that were checked and came back empty. Is Llama watermarked?
Find out which image watermarks actually survive real-world edits like cropping, screenshots, and re-compression. How image watermarking holds up
Look at audio watermarking as its own field, since Meta's oldest watermarking product lives there and almost nobody covers it. Audio AI watermarking
Understand the metadata layer Meta writes into image files, and why it is the easiest of the three layers to lose. C2PA Content Credentials