Millions of watermarked stock photos teach image generators to draw one of their own

A mark on a photo nobody watermarked

Ask an image generator for an ordinary photograph. Sometimes a garbled, half-legible mark shows up across one corner of the frame, pale text in a stock-photography font, smeared just enough that you cannot quite read it, on an image that came from a text prompt, not a scan of a real photo agency's archive. In a 2023 copyright lawsuit against Stability AI, Getty Images filed several such images as exhibits: a garden wedding photo, a red-carpet gown, a synthetic-looking rugby scene. Each carries a blurred, gettyimages-style mark in one corner, on pictures Getty had no part in making. The complaint itself calls them "distorted versions of Getty Images' watermark and other watermarks."¹

That is a different question from why the letters in that smear never spell a real word, which a different lesson covers. This lesson is about the more basic mystery: why a watermark-shaped pattern is on the image at all, when nothing resembling copy-and-paste happens anywhere in the system that draws it.

Billions of photos, and no clean count of how many carry a mark

Start with what these models actually train on. Stable Diffusion, the model behind Getty's exhibits, trained on subsets of LAION-5B, a dataset of 5.85 billion image-text pairs pulled from the public web.² The English-language slice, LAION-2B-en, is 2.32 billion pairs on its own, the largest single piece of Stable Diffusion's training recipe. The model spent its first 237,000 training steps there, before later stages moved to two smaller, more curated subsets of the same dataset.²

LAION-5B's own paper scores every image for two things: how likely it is to be NSFW, and how likely it is to carry a watermark. Both are probability scores, not a filter, and the paper gives a headline NSFW figure, 3% of the dataset, but no equivalent watermark number.² That figure comes instead from LAION's own announcement blog: a watermark proportion of 6.1% for LAION-2B-en, 5.6% for the multilingual slice, and 4% for the slice whose language could not be classified. The post measures this at a classifier threshold it calls conservative, meaning the true share likely runs higher, not lower.³ A separate assessment of data risk in large training sets cites the same figure, still unrevised.⁴

Stable Diffusion's own developers documented where a watermark filter entered training, and where it did not. The first two stages, 237,000 steps on LAION-2B-en and 194,000 more on a higher-resolution subset, carry no watermark filter at all, and every later checkpoint resumed from that unfiltered pair rather than starting over.⁵ Only the next subset was screened for it, at an estimated probability under 0.5, looser than the 0.8 threshold behind LAION's own conservative estimate above, and an estimate rather than a checked label.⁵ LAION-5B's own datasheet also notes near-duplicate images make "a many to one embedding" possible, and lists deduplication as future work, not something done.² That combination, a partial, permissive filter over an unfiltered foundation with no deduplication, is the raw material ahead.

Learning the class of photo, mark included

A diffusion model is never told which pixels to reproduce. It is trained on one repeated task: take a training image with random noise mixed into it, predict the noise that was added, and subtract that prediction out. Run that step backward, over and over, starting from pure noise. That reverse process is generating a picture: the same denoising loop an earlier lesson walks through in full. The paper that introduced this architecture defines the training goal plainly: a diffusion model is "a probabilistic model designed to learn a data distribution p(x) by gradually denoising a normally distributed variable." Its training loss has no step that targets any one specific training example, only the distribution as a whole.⁶

"Learn a data distribution" is the phrase worth sitting with. Say a watermark shows up in roughly one in twenty of the training photos in a class the model sees constantly, stock sports photography for instance. That smear is then a statistical regularity of that class of image, the same kind of regularity as grass reading green. The model has no notion of "this specific photo's copyright mark." It has only seen millions of examples where a certain texture co-occurs with a certain kind of scene, and learned to reproduce that co-occurrence along with everything else about it. Ask for a generic sports photo and the mark can come along, not because one photo got copied, but because the mark is part of what "looks like a stock sports photo" statistically means to the model. This part of the chain is settled: it is the training objective the model's own architects describe, not a disputed inference.

A second, rarer mechanism reproduces one photo almost whole

A diffusion model can also reproduce one training image nearly intact, not a class of images but one photo, as researchers have shown. A 2023 study attacked Stable Diffusion v1.4 directly: 500 generations each for the 350,000 most-duplicated training captions, 175 million images in total, each checked against the training set for a near-pixel-perfect match. 94 cleared a strict distance threshold, and 13 more were confirmed by manual inspection, 109 near-copies in total.⁷

The study is explicit about what drives it: memorization concentrated almost entirely on images duplicated at least 100 times somewhere in the training set. Duplication itself, not the training objective alone, is what the authors call "a major factor behind training data extraction."⁷ Even at that level, the images involved were still roughly one in a million of the full training set: the single most-repeated sliver of the data, not typical behavior. Deduplicating the training set helps, but the only measurement of how much comes from a far smaller test. On CIFAR-10, removing near-duplicate images cut the number of memorized outputs from 1,280 to 986, about a 23% relative drop, a result the researchers themselves call "not a substantial drop." They never ran the equivalent test on Stable Diffusion or any LAION-scale dataset.⁷

Both mechanisms are real and distinct: one reproduces a pattern learned across a whole class of images, the other reproduces one image almost whole. What is still open is telling them apart for any single output. The same researchers name that directly, for the field generally. Whether large-scale generative models work by producing novel output or by copying and interpolating between individual training examples "remains open," in their own words.⁷ On the watermark specifically, there is a further gap, and it is not confined to one study. This memorization study never mentions watermarks, and its breakdown of what got memorized (recognizable people, products for sale, logos) has no watermark category.⁷ A second, independent study of that same reproduction, using an entirely different detection method, does not mention watermarks either. Its own examples are full images and objects, a sofa, a Hokusai wave print, a celebrity portrait, never a mark alone.⁸

What the lawsuit's own exhibit actually shows

That gap sits inside Getty Images' 2023 lawsuit against Stability AI, filed in federal court in Delaware.⁹ One paragraph of the complaint cites exactly the memorization research above to say that "independent researchers have observed that Stable Diffusion sometimes memorizes and regenerates specific images that were used to train the model." The very next paragraph presents the complaint's central watermark exhibit.¹

The paragraph captions a side-by-side pair as an original training photo on the left and the model's output on the right. Look at the two images directly, and the pairing does not hold up as a copy.

The two photographs are not the same players, the same pose, or even the same sponsor. The left shirt carries a real kit sponsor. The right shirt's red crest reads "AA," which is not any real sponsor's mark. What the two images actually share is a corner position and a general typeface family for the distorted text, nothing else. Read on its own, the exhibit is not evidence that one specific photo got copied. It is better evidence for the other mechanism in this lesson: a mark reproduced as a learned regularity of an entire class of image, independent of any single source photo. Getty's later exhibits make a more modest claim: three further examples show only recurring watermark distortion, none paired against a specific training photo.¹ That framing sits more comfortably with distributional learning than paragraph 52's matched-pair claim does. None of this settles Getty's broader copyright claim, a separate legal question the images alone cannot answer.

Zoom out, and the ghost watermark stops being a special case. The training objective, the scale of the data, and a watermark filter that only partly applied are enough to produce a watermark-shaped pattern in generated output. Go one level deeper and there is nothing left to find. The objective, the data, and how much of that data was screened before training account for the whole behavior. None of it is unique to one model or one company. Any system trained on scraped web data inherits that data's regularities, filtered or not, and a stock-photo watermark is only the most visible one. Deduplication and watermark filtering can reduce how often it surfaces, the way the CIFAR-10 result above suggests, but neither removes it outright at the scale these models train on.