An organization's AI security team wants to implement cryptographic watermarking of AI-generated content so that any text produced by their Azure OpenAI deployment can be traced back to their system if it appears in external channels without authorization. Which approach is most technically sound for implementing AI output watermarking?

B is correct because cryptographic or statistical text watermarking techniques embed imperceptible signals in AI-generated text by subtly influencing word choice or token selection patterns during generation. These signals are statistically detectable when analyzing suspected AI-generated content, enabling provenance tracing. Microsoft is developing AI content provenance capabilities, and the Coalition for Content Provenance and Authenticity (C2PA) standard provides cryptographic provenance signals for AI-generated media. Implementing such watermarking at the application layer (intercepting the generation process to embed signals) is the technically rigorous approach. A is wrong because a visible copyright notice is trivially removed by any recipient—it provides no cryptographic provenance and can be stripped before redistribution. C is wrong because storing hashes of outputs enables exact match verification (was this specific output generated by our system?), but hashes are fragile to minor edits; watermarking allows detection even after content modifications. D is wrong because digital signatures on documents verify the signer's identity but not the AI origin of the content itself—a human could sign AI-generated content without the signature indicating AI provenance.