AI Watermarking, Explained: SynthID and the Third Way to Spot Machine Text

AI watermarking hides an invisible statistical signature inside AI output at the moment it's generated, so the content can later be identified with high confidence — no guessing from writing style required. Google DeepMind's SynthID is the leading deployed example, covering text, images, audio, and video. The catch: it only works when the AI that generated the content chose to embed it.

That catch is the whole story, so let's not bury it. Watermarking is the most technically sound answer anyone has to "did an AI write this?" — and it answers a narrower question than most people think they're asking.

Two ways to catch a machine (and why a third was needed)

Everything we've covered elsewhere in this series works after the fact. A statistical detector receives finished text of unknown origin and inspects it for machine-typical patterns: perplexity, which asks how predictable each word choice is, and burstiness, which asks how uniform the sentence rhythm is. It's forensic work — footprints, fibers, probabilities. Done on pristine, unedited chatbot output it works most of the time; done on edited text, formulaic human prose, or non-native English writing it misfires in documented, painful ways. The 2023 Patterns study that found detectors falsely flagging 61.22% of human-written TOEFL essays is the canonical example, and the wider reliability picture lives in our detector accuracy guide.

A second family — provenance metadata, like the C2PA "content credentials" standard — attaches a signed label to a file saying where it came from. Useful for images and video traveling through cooperating platforms; nearly useless for text, which gets copied and pasted as bare characters, shedding any attached label instantly.

Watermarking is the third way, and it inverts the whole problem. Instead of examining text and inferring its origin, the generator itself plants a secret, statistically detectable pattern in the output as it writes. Later, a detector holding the right key doesn't have to judge whether the text "sounds like AI." It checks for the pattern. Present: this came from a watermarking generator. Absent: no conclusion. No style analysis, no perplexity thresholds, and — in principle — no innocent student flagged because their honest prose happened to read as machine-typical.

That last property deserves a moment of respect. The false-positive problem that haunts statistical detection is structural: human writing and machine writing genuinely overlap, so any after-the-fact classifier must sometimes mistake one for the other. Watermarking sidesteps the overlap entirely. It doesn't ask what the text looks like. It asks whether a specific hidden signal, planted by a specific process, is there.

How you hide a watermark in words

Hiding a mark in an image is easy to imagine — nudge some pixels. But text has no pixels. Change a word and you've changed the writing. So where does the watermark live?

In the choices. Recall how a language model writes: at every step it holds a ranked list of plausible next words. Often the ranking is nearly a tie — big versus large, shows versus demonstrates, starting the next sentence with However versus But. The model has to break these ties somehow, and ordinarily it does so with plain randomness. Watermarking replaces that plain randomness with loaded randomness.

Here's the plain-language version of the scheme, which researchers at the University of Maryland described in early 2023 and which SynthID's approach builds on. Using a secret key, mark a portion of the vocabulary as "preferred" — think of the preferred words as green and the rest as red, with the green set reshuffled at every position so no human could ever spot it. When the generator breaks a tie, it leans green. Not always — forcing green every time would wreck the writing — just slightly, and only where candidates are genuinely interchangeable.

One nudged choice proves nothing. Any word has some chance of being green by luck. But across three hundred words, an unwatermarked text lands green at roughly the base rate, while watermarked text lands green noticeably too often. The detector, holding the key, just counts. It's the difference between one lucky roll and a die that comes up six four hundred times in a thousand throws: no single roll is suspicious, and the pattern is unmistakable.

Two properties follow directly. The watermark is invisible to readers, because every individual word was a legitimate choice the model might have made anyway. And detection is keyed: without the secret key, you can't check for the mark — which is why you can't point a generic detector at text and find someone else's watermark. Ask us how we know: our own AI detector reads statistical signals, not watermarks, because watermarks are only readable by whoever holds the key. No third-party tool honestly claims otherwise.

SynthID: what Google has actually shipped

SynthID is Google DeepMind's implementation of this idea across media types, and as of mid-2026 it is the most widely deployed watermarking system in existence. Current scope, per Google's own pages:

Text. SynthID Text watermarks output from the Gemini app and web interface by adjusting token probability scores during generation — precisely the tie-breaking mechanism described above (Google's developer documentation describes it as a "logits processor" applied at sampling time, using a pseudorandom "g-function"). The research behind it, published by Dathathri and colleagues in Nature in October 2024, included a live production test across 20 million responses from real Gemini interactions, comparing thumbs-up and thumbs-down rates between watermarked and unwatermarked answers and finding no meaningful difference — the headline result being that the watermark doesn't visibly degrade quality.

Open source. In October 2024, Google open-sourced SynthID Text through its Responsible Generative AI Toolkit, with a production implementation shipping in Hugging Face Transformers v4.46.0 and a reference implementation on GitHub. Any developer can now watermark their own model's output without retraining — they configure keys and pass a setting at generation time.

Images, audio, video. SynthID embeds imperceptible watermarks in images and video from Google's generative models, and in audio from its Lyria music model and NotebookLM's podcast-style output — marks designed to survive cropping, filters, compression, and frame-rate changes.

Detection. In May 2025 Google announced the SynthID Detector, a verification portal where users can upload content and check it for SynthID watermarks, initially rolled out to journalists and media professionals via waitlist. At the same announcement, Google said SynthID had already watermarked over 10 billion pieces of content.

Credit where due: Google watermarks its consumer AI output by default, published the method in a peer-reviewed venue, and gave the text scheme away. That is more than any other frontier lab has shipped. OpenAI has been reported to have had a text watermarking system built and undeployed for years, on reporting the company has not disputed, and no cross-vendor watermark standard for text exists.

Which brings us to the reasons this elegant idea has not ended the AI-detection debate.

Problem one: the watermark only exists if the generator cooperates

A watermark is planted at generation time, by the generator, voluntarily. So SynthID identifies SynthID-watermarked content — which is to say, content from Google's tools and from developers who opted in. It says nothing about text from any system that didn't participate.

Map that against reality. A student or employee choosing an AI tool in 2026 can pick from several major commercial chatbots, most of which do not watermark text output, plus a long tail of apps built on open-weight models — models whose code and weights are public, where any watermarking step can simply be removed, in the same way you can't make ink signatures mandatory for people who own pencils. Watermarking every generator on Earth isn't a technical project; it's a compliance fantasy.

Regulation is starting to push, and harder than most people realize. The EU AI Act's Article 50 transparency obligations — which became applicable on August 2, 2026 — require providers of generative AI systems to mark synthetic output in a machine-readable format so it's detectable as artificially generated. China has moved further and faster than most jurisdictions on mandatory labelling of AI-generated content. These rules will meaningfully raise how much AI content carries marks. What they cannot do is bind the open-weight ecosystem or every offshore tool, and a detection regime is only as strong as its easiest exemption.

So watermark absence can never mean "human-written." At best it means "not from a cooperating generator, or the mark didn't survive." That asymmetry — presence proves a lot, absence proves nothing — defines every honest use of the technology.

Problem two: watermarks fade when text is reworked

The watermark lives in word choices, so changing the words erodes it. Google's own documentation is candid here, listing three structural weaknesses.

Short text: the detector needs enough loaded coin flips to distinguish signal from luck, and a two-sentence answer may not contain them. Factual text: when a question has one right answer — a date, a formula, a translation of a fixed phrase — there are few genuine ties to break, so there's little room to embed signal without degrading accuracy. And rewriting: paraphrase the text, run it through another model, or translate it into another language, and each replaced word is a coin removed from the pile. Google states plainly that detector confidence drops when text is thoroughly rewritten or translated, and that SynthID is not designed to stop determined adversaries.

Benchmarks of detector robustness — notably the RAID benchmark presented at ACL 2024 — found detectors advertising 99%-plus accuracy to be "easily fooled by adversarial attacks, variations in sampling strategies, repetition penalties, and unseen generative models", with paraphrase among the eleven attacks tested. The pattern holds for watermarks: light editing leaves them largely intact; a full paraphrase pass can wash them out. The watermark is more like a signature in sand than a brand in leather — durable against weather, not against anyone with a rake.

Watermarking vs. statistical detection, side by side

Notice the mirror symmetry. Statistical detection works on everything and is sure of nothing; watermarking is sure of what it finds and finds only what volunteered. They aren't competing answers to one question — they're partial answers to different questions, which is why the realistic future involves both, plus the thing that outranks both: process evidence.

What watermarking would and wouldn't fix for education

Imagine the best case: every major chatbot watermarks by default, and institutions get access to verification. What changes for a university?

The false-accusation crisis would genuinely shrink. Today's misconduct cases lean on statistical scores whose error patterns fall hardest on non-native speakers and formula-trained writers — the base-rate math in our accuracy guide shows why even a "1% false positive" tool accuses scores of innocent students at institutional scale. A verified watermark is a different category of evidence: it doesn't say "this reads as machine-typical," it says "this specific passage came from a watermarking generator." The Turnitin asterisk, the disputed percentage, the appeal hinging on a vendor's threshold — a watermark hit replaces all of that with something closer to a fact.

And yet three gaps stay open. First, the negative case: no watermark found means nothing, so watermarking can never clear the accused or catch the student who used a non-watermarked tool — the students most determined to cheat migrate to unmarked generators on day one. Second, the paraphrase hole: text laundered through rewriting emerges unmarked, and policing that drags you straight back to statistical guesswork. Third, the policy question watermarks can't touch: a watermark tells you AI produced some words, not whether that use was permitted, disclosed, or pedagogically fine — the actual questions integrity offices adjudicate. A detected watermark on a brainstorming paragraph in a course that allows AI assistance is a non-event; the technology can't tell you that.

Our position hasn't changed across this series, and watermarking doesn't change it: detection tools of every family are evidence-generators, not verdict-generators, and the durable answer in education is process — drafts, version history, conversation — with technology as support. That's also why we build our tools the way we do: a humanizer for legitimately editing permitted AI drafts into your own voice, with no promise to beat any detector or strip any watermark, because nobody can honestly promise the first, and the second isn't a product, it's a confession.

The realistic outlook

Expect watermark coverage to rise — EU enforcement, platform labeling, and default-on deployment at Google-scale guarantee that. Expect a cross-vendor text standard to stay hard: text watermark detection requires sharing keys or detection infrastructure between competitors, and nothing like image metadata standards exists for raw text yet. Expect statistical detection to stick around precisely because watermarking's coverage gap needs filling, with all the false-positive baggage documented across this pillar. And expect the equilibrium to be unsatisfying: watermarks catching the casual and the compliant, paraphrase tools eroding marks at the margin, and human judgment still carrying the cases that matter.

A decade from now, "was this AI-generated?" may be answerable for most mainstream content most of the time. "Did this student cheat?" will still be a question about people. No watermark reads minds.

FAQ

What is AI watermarking? AI watermarking embeds an invisible, statistically detectable signature into AI-generated content at the moment of generation. For text, the generator subtly biases its word choices using a secret key; a detector holding the key can later confirm the pattern. Unlike statistical AI detectors, it doesn't infer origin from writing style — it checks for a deliberately planted signal.

How does SynthID watermark text without changing what it says? It intervenes only where the model faces near-ties between interchangeable words, using a keyed pseudorandom function to lean toward "preferred" options. Each chosen word remains one the model might naturally have used, so readers notice nothing — but across hundreds of words, the preferred options appear measurably too often for chance, which is what the detector counts.

Can Turnitin or GPTZero detect SynthID watermarks? No. Watermark detection requires the watermark key, which stays with the system that embedded it — Google, in SynthID's case. Turnitin, GPTZero, and similar tools use statistical analysis (perplexity and burstiness), an entirely separate approach that neither reads nor needs watermarks.

Does paraphrasing remove an AI watermark? Largely, yes — and Google says so itself. The watermark lives in specific word choices, so thorough rewriting, running text through another model, or translating it into another language replaces the marked choices and degrades detection confidence. Light edits typically leave enough signal; a full paraphrase pass usually doesn't.

If text has no watermark, does that mean a human wrote it? No. Most AI systems don't watermark text output, open-weight models can have watermarking removed, and marks can be erased by rewriting. Watermark presence is strong evidence of AI generation; watermark absence is evidence of nothing.

Is SynthID available outside Google products? Yes, for text: Google open-sourced SynthID Text in October 2024 via its Responsible Generative AI Toolkit, with an implementation in Hugging Face Transformers (v4.46.0+) that developers can apply to their own models without retraining. Verification of Google's own content runs through the SynthID Detector portal, announced May 2025 and initially offered to journalists and media professionals.

Will watermarking replace AI detectors in schools? Not on any near horizon. Watermarking only covers cooperating generators, can't survive determined paraphrase, and can't address whether a given AI use was permitted. It will likely reduce reliance on statistical scores where marks are present, while the unmarked majority of text keeps statistical detection — and its false-positive problem — in business.

Key facts

• SynthID, from Google DeepMind, watermarks text, images, audio, and video; text from the Gemini app and web is watermarked by adjusting token probability scores during generation (Google DeepMind SynthID page).
• The method was published in Nature in October 2024 (Dathathri et al.), including a live test across 20 million real Gemini responses showing no meaningful difference in thumbs-up or thumbs-down rates.
• SynthID Text was open-sourced October 23, 2024, shipping in Hugging Face Transformers v4.46.0 as part of Google's Responsible Generative AI Toolkit.
• Google announced the SynthID Detector verification portal in May 2025, alongside the claim that SynthID had watermarked over 10 billion pieces of content.
• Google's own documentation lists the core limits: reduced effectiveness on short and factual text, and degraded detection when text is thoroughly rewritten or translated.
• The EU AI Act's Article 50 transparency obligations became applicable August 2, 2026, requiring providers to mark AI-generated content in machine-readable form.
• Watermarking's structural trade-off: presence of a mark is strong evidence of AI origin with near-zero false-positive risk, but absence proves nothing — most generators don't watermark, and marks don't survive determined paraphrase.

Sources

1. Google DeepMind. SynthID technology page (modalities, Gemini/Lyria/NotebookLM integration, SynthID Detector).
2. Google AI for Developers. "SynthID: Tools for watermarking and detecting LLM-generated text" — Responsible Generative AI Toolkit documentation (mechanism, limitations, Transformers availability).
3. Dathathri, S., et al. "Scalable watermarking for identifying large language model outputs." Nature, October 2024.
4. Hugging Face. "Introducing SynthID Text," October 23, 2024 (open-source release, Transformers v4.46.0).
5. Google (The Keyword blog) / TechCrunch coverage. SynthID Detector announcement and 10-billion-item figure, May 2025.
6. Kirchenbauer, J., et al. "A Watermark for Large Language Models." University of Maryland, 2023 (the green-list token-biasing scheme).
7. European Commission / artificialintelligenceact.eu. AI Act Article 50 transparency obligations, applicable August 2, 2026.
8. Liang, W., et al. "GPT detectors are biased against non-native English writers." Patterns (Cell Press), 2023.