From Deepfakes to DNA: How AI Watermarking Technology Protects Truth and Safety

When "Is This Real?" Becomes the Question of Our Age

Scrolling through social media, you come across slow-motion footage of a volcanic eruption, a tornado tearing through a village, or footage of a protest march — and the same question flashes through your mind: is this real? Was it filmed by a person or generated by a machine? As AI becomes increasingly convincing at generating text, images, audio, and video, determining whether content is authentic has become one of the most pressing challenges of our time.

In the Google DeepMind podcast, host Professor Hannah Fry sits down with two guests to explore AI watermarking technology in depth: Pushmeet Kohli, VP of Science at DeepMind and one of the architects of SynthID, and biosecurity researcher Jeremy Radcliffe, who has applied the technology to the biological domain. Their conversation reveals a more complex new battleground — AI can now not only generate media content, but also design biological molecules that have never existed in nature, some of which could potentially be used to cause harm.

The answer may be hiding in plain sight — embedded in the content you're viewing, or in the molecule you're about to synthesize: a watermark. Not the kind of block logo stamped on stock photos, but something far more subtle and mathematical.

What Makes a Good Watermark

When most people think of watermarks, they picture the security features on banknotes or passports. But AI watermarks operate on an entirely different set of principles. Both guests independently converged on strikingly similar core criteria.

Kohli distilled eight years of designing watermarking systems at DeepMind into three key properties: imperceptibility (it must not degrade content quality, or no one will use it), robustness (it must survive transformations like scaling, cropping, and adding noise, making it difficult to remove), and scalability (it must be easy to integrate and easy to detect).

Radcliffe's criteria from the biological domain are strikingly consistent: imperceptible to humans, high detectability, and strong generalizability — a single method that works across multiple systems rather than requiring a custom solution for each data type. This alignment is no coincidence: the biological implementation directly reuses open-source SynthID text library code, adapting it for the new domain.

Text Watermarking: Hidden in the Pattern of Word Choices

Tools already exist that claim to identify AI-generated text, but Kohli points out they follow a conventional approach — training machine learning classifiers to distinguish AI-generated writing from human writing. Early large language models had distinctive verbal tics (overusing certain words or fixed sentence patterns) that classifiers could exploit. But as models become more convincing, those telltale signs disappear, and classifier accuracy falls with them.

Watermarking takes a fundamentally different approach. When a large language model generates each word, it is actually working with a probability distribution — there are often multiple equally plausible options for what comes next. Text watermarking exploits this