The Watermark Can't Be Optional Anymore. So We Made It the Default

Last quarter I wrote that I'd started thinking about how we fight deepfakes differently, and I want to pick that thread back up, because it's the whole reason for what we shipped in Q2.

For years, the job in this space has been detection: something fake gets out and you work to catch it. That work is essential, and it isn't going anywhere but it's not enough on its own. 

That's why we've long treated this as a provenance problem too. Provenance just means proof of origin: marking what's real at the moment it's made, so there's something to check against later instead of guessing after the fact. It's the idea behind PerTh, our audio watermarker which we released in 2023.

This quarter, we had a hard reason to push that thinking further. Under the EU AI Act, starting August 2, any AI system placed on the market has to mark its output in a machine-readable format, from the very first file it generates, with no grace period for new systems. The fines for getting it wrong reach 15 million euros or 3% of global revenue.

The question we spent Q2 on was simple: how do you make sure everything that leaves your systems carries its own proof, in a way that survives the real world?

The watermarker we open-sourced in 2023 just got a major upgrade

Watermarking has been part of how we work for years. PerTh has been available since 2023, when we open-sourced it as an audio watermarker. The community ran with it: hundreds of GitHub stars, enterprises running it in production, developers building on top of it.

On June 24 we shipped the rebuild. PerTh Multimodal takes that same idea and extends it well past audio, marking audio, video, image, and text through a single API. It's also far more robust. The original had four known weak spots, everyday edits like pitch shifting and filtering that could wear the mark down, and we rebuilt the training approach to close them. The mark now holds up through compression, re-encoding, and the ordinary processing content goes through once it leaves your hands.

A watermark woven into the content survives the trip through a social platform, even after the file-level record on the outside gets stripped on upload. We hear the fair objection often, that watermarks are easy to strip, so why bother. RAND, the nonprofit research institute and think tank, argued in 2025 that provenance schemes leaning on the whole internet to cooperate won't hold up on their own. The answer is a mark that stays put, one we can still detect with close to 99.9% accuracy when we go looking for it.

The trap most teams don't see coming

Here's the part most teams adding watermarking miss, and it's really a detection problem.

Say you mark all synthetic speech but leave real human speech unmarked. A detector learning from that mix can pick up the wrong signal and decide the watermark itself is what "fake" looks like. One of our researchers, Nicolas Müller, showed exactly this in a June 2026 paper with a German research institute. A detector that falls for it gets worse at spotting content it hasn't seen, lets a fake through the moment someone strips the mark, and can even flag a real person's voice as fake.

You only catch a trap like that if you build both the watermark and the detector. The team that designs the mark is the same team that trains the detector, so we knew to train it on marked real and marked fake audio together, forcing it to learn the real signs of manipulation instead of leaning on the mark. That is the advantage of keeping both under one roof.

One mark isn't enough for the new rule

The August deadline won't be satisfied by a single mark. The EU's guidance, finalized in June, calls for layers working together: the file-level record, an invisible watermark inside the content, and a log to fall back on. Each layer covers for the others when they fail.

PerTh Multimodal is built to be the durable middle layer. It pairs with C2PA, the industry-standard format for the file-level record, so the two reinforce each other, and it handles all four formats from one model instead of a separate tool for each.

If you're mapping your own content before August, the question is narrow. Once your media leaves your systems and hits the open web, is there still something inside it that proves where it came from? If not, that's the gap to close now.

On the detection side our team was very busy 

So that's what we rebuilt on the watermark and the other half of the story is detection. Our detection model reached 99% accuracy against NVIDIA's Magpie speech model after another round of training, and on an independent audio deepfake detection benchmark with Podonos, our model ranked first against 8 systems including the likes of Aurigin.ai, Hive, and Reality Defender. 

We also keep researching how synthetic voice is built, because staying the clear leader in audio deepfake detection means knowing the newest generation methods before they show up in the wild. That research is open, and it produced four new models this quarter, all free to use: DramaBox, Chatterbox Nano, Chatterbox Flash, and Chatterbox Multilingual.

Finally, outside of approving our accuracy, our team was invited to speak at various events this past quarter. Zohaib joined a panel at AI Insiders in front of CISOs, security founders, and investors, and by his account every panel and every investor thesis kept circling back to detection. He also spoke at Deutsche Telekom's leadership summit in Berlin as one of their T-Challenge winners, where a customer's own leadership spent the session on the problem we build for: scaling AI without scaling the risk that rides along with it.

And Will Krispin, our Head of Partnerships, joined an Okta event on operational risk for federal agencies, where they spoke about how voice is collapsing as an identity signal and a ten-second clip is now enough to beat call-center verification or impersonate a senior official.

What's next

With a busy quarter behind us, we are still full steam ahead. One thing I'm most excited about is what we are shipping next week. Our research team is deep into doing final testing of our new detection model and the early numbers show accuracy in the high nineties against unseen generators. 

If you’d like to learn more about anything I wrote about you can book a demo with our team to see detection and watermarking running on your own media or read our latest Deepfake 101 guide for a plain-language, sharable resource of the deepfake threat vectors and how to protect against them.