AI Watermarks Survive Retraining — But Not All of Them

AI watermarks are the industry's main answer to a simple question: was this image generated, and by what? A new study from CISPA asks whether those AI watermarks still work after the images are scraped and used to train the next generation of models. Given how much of the web is now synthetic, that's a load-bearing question for AI watermarks.

The answer is uncomfortable but useful. Some AI watermarks survive retraining. Others fade out entirely — and which is which depends on how the AI watermarks were designed. For anyone treating AI watermarks as a permanent provenance guarantee, that's a warning.

The Question Nobody Had Answered

Most prior research on AI watermarks tested something narrower: can a watermark survive image manipulation like cropping, compression, or color shifts? That's the everyday threat, and the results have generally been encouraging.

This study asked a harder question. Because generated images flood the internet, they get scraped for subsequent training runs. So the researchers investigated whether AI watermarks persist when a new model is trained on watermarked data — across multiple training generations. In other words, do AI watermarks survive being learned? The paper, "Watermark Degradation Across Model Iterations," was presented at the ACM Workshop on Information Hiding and Multimedia Security.

What They Tested

The team, led by CISPA researcher Michel Meintz from the SprintML Lab, ran a comparison across two dimensions:

• Four watermarking methods — TrustMark, StableSignature, TreeRing, and BitMark.
• Two model architectures — diffusion models and autoregressive image models.

That second axis turned out to matter a great deal. As Meintz put it, when different model architectures are used, "watermarks behave very differently." Not every AI watermarks scheme transfers between architectures.

What They Found: Design Decides Survival

The headline result is that AI watermarks are not created equal. One method remained detectable even when it was present in roughly 1% of the training data — a remarkably faint signal to recover, and a strong result for that style of AI watermarks.

Others "degrade severely throughout generations and have a finite lifetime." In plain terms, those AI watermarks work once and then disappear, which makes them useless for long-term provenance.

The practical conclusion: AI watermarks have to be matched to the models they'll pass through. "For a watermark to survive a diffusion process or model training and still be learnable or detectable afterward, it must be more robust," Meintz said, noting it may require adjustments that other models don't need. The takeaway for AI watermarks is that one-size-fits-all watermarking doesn't hold up.

Why Model Collapse Makes This Urgent

There's a reason this research matters beyond watermark engineering. Training a model on its own synthetic output degrades quality — the phenomenon known as model collapse. Durable AI watermarks are one way to detect that a model has been fed its own output.

"When companies train on their own synthetic data, it can lead to model collapse," Meintz explained. "The more you train on your own synthetic data, the more likely the model's quality is to deteriorate."

If AI watermarks could reliably survive retraining, they'd do double duty: tracing where data came from and flagging when a model is being fed its own output. That's a strong argument for investing in more durable AI watermarks.

Detection Works Even When Traces Are Faint

The study's other contribution is methodological. The researchers used a dataset inference framework that aggregates weak per-sample signals through statistical hypothesis testing.

That matters because individual AI watermarks are often too subtle to detect in a single image. By pooling evidence across a dataset, the method can reliably identify whether a model was trained on watermarked content — even when any one image carries almost no trace.

So the picture is more encouraging than "watermarks don't work." The right AI watermarks, analyzed in aggregate, still tell you something — which is exactly what AI watermarks were supposed to do.

What It Means for Creators and Platforms

Three takeaways stand out from the research:

• Provenance is a design problem — AI watermarks that aren't built for retraining won't survive it.
• Aggregate detection beats per-image detection — subtle AI watermarks become statistically visible across a dataset.
• The stakes are model quality, not just attribution — durable AI watermarks are also a defense against model collapse.
• Don't assume permanence — some AI watermarks have a finite lifetime, and platforms should plan accordingly.

For creators, the practical implication is modest but worth knowing: AI watermarks are becoming a standard part of generated files, and their reliability depends on choices made by the model provider, not by you. You can't tune AI watermarks from the prompt box.

A Prompt to Try Today

Whatever the watermarking story, a sharp prompt is still what makes an image worth keeping — AI watermarks don't make a weak image good. Try this on Fanch AI:

Copy & Paste this into Fanch AI (Model: gpt_image_2):

Create a photorealistic landscape photograph of a wide river valley at sunrise, with low mist drifting across the water, layered hills receding into soft haze, and warm golden light catching the tops of the trees. Rich depth from foreground reeds to distant ridges, natural color grading, cinematic wide-angle composition, 16:9 framing, 8K detail, no text.

Why Fanch AI Is Where Creation Happens

Questions about AI watermarks and provenance are decided upstream, by model providers and standards bodies. What stays in your hands is the craft: knowing how to prompt a model well. Fanch AI gives you a dedicated image model you direct precisely, so the images you make are worth tracing in the first place — AI watermarks or not.

👉 Start here: GPT Image 2 on Fanch AI — create AI images now.