AI Watermark¶

Geodesia G-1 applies a latent HMAC-SHA256 watermark to every AI-generated response. The watermark is embedded in the generation process and can be cryptographically verified later — without requiring the model weights or original inference context.

What Is an AI Watermark?¶

An AI watermark is a signal embedded in the text output of a language model that allows the origin of the text to be verified. Unlike visible watermarks, Geodesia's watermark is latent — it is not visible in the text but is recoverable through the verification endpoint.

This satisfies:

• EU AI Act Article 50 — AI-generated content must be marked in a way that is detectable
• California SB 942 — AI-generated content must carry detectable disclosure
• Italy 132/2025 — AI content marking requirements

The watermark is a cryptographic HMAC computed over the generation parameters and embedded as metadata attached to the response. The manifest watermark (explicit disclosure in the geodesia.watermark response field) is delivered alongside the latent one.

How It Works¶

When Geodesia generates a response, it:

1. Computes HMAC-SHA256(watermark_key, session_id + call_id + timestamp + model_id)
2. Attaches the result as the watermark_token in the response metadata
3. Records the watermark in the audit chain

To verify, you provide the watermark_token and the relevant metadata. The verifier recomputes the HMAC and checks if the provided token matches.

The watermark_key is derived from your deployment's license token. It never leaves the server.

Response Disclosure¶

Every Geodesia G-1 response includes a manifest watermark in the geodesia.watermark field:

{
  "geodesia": {
    "watermark": {
      "token": "hmac:v1:a8b3c1d4e5f6...",
      "generated_by": "Geodesia G-1",
      "call_id": "call_abc123",
      "timestamp": "2026-06-10T10:23:45Z",
      "disclosure": "This content was generated by an AI system."
    }
  }
}

Endpoints¶

POST /v1/glad/watermark/verify¶

Verify that a piece of text was generated by this Geodesia G-1 instance.

curl -X POST http://localhost:8199/v1/glad/watermark/verify \
  -H "Content-Type: application/json" \
  -d '{
    "token": "hmac:v1:a8b3c1d4e5f6...",
    "call_id": "call_abc123",
    "timestamp": "2026-06-10T10:23:45Z"
  }'

Request Fields¶

Response¶

{
  "verified": true,
  "call_id": "call_abc123",
  "generated_at": "2026-06-10T10:23:45Z",
  "model_id": "geodesia-g1-gemma4-e2b",
  "deployer_id": "acme-corp",
  "chain_entry": "chain_def456"
}

If verified is false, the response will include a reason field explaining the mismatch.

Watermark Configuration¶

Configure watermarking in config.yaml:

watermark:
  enabled: true
  algorithm: "hmac_sha256"
  include_in_response: true       # Include watermark in all API responses
  disclosure_text: "This content was generated by an AI system."
  custom_disclosure: null         # Override with jurisdiction-specific text

Regulatory Coverage¶