Forensic watermarking, explained

Forensic watermarking embeds an invisible identifier into the content itself. The word doing the work is forensic: the mark is not there to be seen, to deter at a glance, or to prevent anything. It is there so that a file recovered later can be attributed to a specific copy, and therefore to a specific recipient.

It is sometimes called transactional watermarking, because the natural unit is one mark per transaction — per recipient, per download, per screening — rather than one mark per title.

It is not a visible watermark. A logo or a burned-in name is a deterrent and an attribution of authorship. It is visible to everyone, identical on every copy, and croppable. Useful, different job.

It is not metadata. EXIF fields, XMP blocks and C2PA manifests live alongside the pixels rather than inside them. Any re-encode, screenshot or upload to a platform that strips metadata removes them, usually without anyone intending to.

It is not DRM. DRM tries to prevent playback or copying, and its protection ends at the moment the content reaches a screen — which is exactly where a camera can point at it. Forensic watermarking starts from the assumption that copying will happen and asks a different question: when it does, whose copy was it?

A robust watermark is not hidden in a corner of the file where it can be trimmed away. It is spread across the whole image, redundantly, in a form that survives the transformations real files undergo — recompression, scaling, colour shifts, screenshots, and the re-encoding every social platform performs on upload.

Because the signal is redundant, a fragment of the picture can still carry enough of it to reconstruct the identifier. That is why a crop that discards most of the frame can still decode, and why robustness is quoted against specific attacks rather than as a single number.

Blurry's own figures: 12 of 12 attacks recovered, across recompression, resizing, screenshots, social re-uploads, rotation and cropping. The attack gallery shows each one with the real decoder output, including the cases where the older frequency-domain method fails.

Detection is blind: the decoder is handed a file and recovers whatever identifier is present, without being told what to look for. It returns the identifier and a confidence score, and a threshold decides whether that score is strong enough to report.

That threshold matters more than it sounds. An unwatermarked image will still produce some candidate identifier — noise shaped like an answer. A detector without a properly calibrated floor will confidently name a recipient for a photograph that never carried a mark at all, which is worse than returning nothing.

Pre-release film and television screeners sent to festivals, distributors and press. Photography licensed to multiple outlets. Confidential documents and designs circulated for review. Anything shared with a known list of people, where the list is short enough that knowing which of them is worth something.

The common thread is not secrecy — it is accountability. Forensic watermarking is most valuable where the recipients are trusted, identifiable, and aware that their copy is their own.