Short answer: AI removes visible watermarks trivially, platforms remove metadata automatically, and well-designed invisible watermarks survive far more than most people expect — but nothing survives everything. Here is what actually happens to each kind of mark in 2026, with numbers where we have them.
Visible watermarks: one inpainting pass and they're gone
A logo or username overlay is just pixels in a known region. Modern inpainting — free in a dozen consumer apps — reconstructs the covered area in seconds, and the result is usually indistinguishable from an unwatermarked original. If your protection strategy is a corner logo, your protection strategy is a two-click removal away from not existing. Visible marks still have deterrence value (casual reposters don't bother), but against anyone motivated, they are decoration.
Metadata: dead on arrival at every major platform
EXIF fields, IPTC credits, and C2PA manifests are attached alongside the image data — and social platforms strip or ignore most of it on upload, both to save bytes and to protect user privacy. Nobody has to "attack" your metadata; the distribution pipeline deletes it as a side effect. That is the core weakness the C2PA standard itself acknowledges, which is why it defines watermarking as a soft binding to re-identify content after the manifest is gone.
Invisible watermarks: the honest picture
An invisible watermark embeds a signature into the pixels themselves, spread redundantly across the frame. There is no region to inpaint and no sidecar to strip — to remove it, you have to meaningfully alter the whole image. So the real question is: how much alteration does it take?
From our published testing:
- Screenshots, compression, re-uploads: survived by design. These transforms preserve most pixel structure, and the signature rides along.
- AI upscaling and enhancement: commercial AI upscalers reconstruct detail but preserve content structure — in our tests, watermarked video still matched its original with near-perfect confidence after a full AI upscale pass.
- AI inpainting: replacing 30% of an image left the signature clearly recoverable; at 50% replacement, recovery degraded but remained usable evidence. The signature lives in the untouched regions.
- Full AI regeneration: the hard case. Running an image through a generative model that re-synthesizes every pixel can destroy any watermark — ours included. Anyone claiming their watermark survives total regeneration is selling something.
We publish detection rates across nine adversarial transforms on our public benchmark page, compared against perceptual-hash systems like PhotoDNA/PDQ — because "trust us" is not a robustness claim.
Why the regeneration case doesn't end the story
If someone fully regenerates your image, the watermark may be gone — but the content is still recognizably derived from yours. That is why detection shouldn't depend on the watermark alone: HALLMARK.AI pairs signature recovery with content-level matching that identifies copies and derivatives even when the embedded bits don't survive. The watermark gives you cryptographic proof; content matching gives you reach. An adversary has to beat both.