SynthID Explained: What Google's Watermark Can and Cannot Prove

At a glance

SynthID is the most widely deployed AI watermarking system in existence — over 100 billion images and videos marked by May 2026, plus 60,000 years of audio — and one of the most widely misunderstood.

The central fact that most coverage misses: SynthID is two entirely different systems sharing a brand name.

SynthID-Text is a rigorous piece of engineering. Published in Nature, peer-reviewed, with the method open-sourced, validated in a live experiment across roughly 20 million Gemini responses, and running in production today. It is also completely unverifiable by anyone outside Google.

SynthID for images, audio and video has no published paper, no disclosed architecture, no bit capacity, no ROC curves and no independent robustness benchmark. Every robustness claim rests on Google's own unaudited testing. It is also the part the public can actually query — through Google Search, Chrome and the Gemini app.

The modality with the strongest science has the weakest public accountability. The modalities with the weakest published science are the ones Google actually lets you check. That inversion is the most important thing to understand about SynthID.

How SynthID-Text works

Tournament sampling

Most text watermarks bias the model's probability distribution before sampling. SynthID-Text does something different: it samples honestly, then selects among honest samples.

At each generation step:

1. Draw N^m candidate tokens independently from the model's true distribution p_LM(·|x_<t).
2. Run a knockout tournament over m layers. In each match, the winner is whichever token scores higher under a keyed pseudorandom function g_ℓ specific to that layer.
3. Emit the survivor.

The paper's experimental defaults are m = 30 layers, N = 2 competitors per match, and a sliding context window of H = 4 preceding tokens used to derive the seed:

r_t = h(x_{t−4}, …, x_{t−1}, k)

The scoring function for layer ℓ is:

g_ℓ(x, r) = F_g^{-1}( h(x, ℓ, r) / 2^{n_sec} )

with g-values typically drawn Bernoulli(0.5), so each token gets a pseudorandom 0 or 1 per layer. Because the seed depends only on preceding tokens plus the key, a holder of the key can recompute every g-value from the finished text.

A detail worth flagging for anyone reading the reference implementations: the Hugging Face and Google developer surfaces call this parameter ngram_len and define it as the window including the candidate token — so the recommended ngram_len = 5 corresponds to the paper's H = 4.

The non-distortion claim, stated precisely

Google describes the production configuration as "non-distortionary". This is true, and narrower than it sounds.

With exactly two competitors per match, averaged over the random seed, the distribution of the emitted token equals p_LM. That is a marginal, seed-averaged, single-token guarantee. Conditioned on a specific seed, the distribution is skewed — and that skew is precisely what makes detection possible. A watermark that genuinely did not change anything would not be detectable.

Stronger, sequence-level non-distortion requires repeated context masking: watermarking is skipped entirely when an identical four-token context has already appeared within the previous K responses. This buys distributional fidelity at a real cost — repeated n-grams contribute no evidence at all.

There is also a distortionary variant using more than two competitors per match. It produces a stronger watermark at a measurable quality cost, and it is what the paper benchmarks against the Kirchenbauer-style Soft Red List.

Detection: a trained classifier, not a p-value

This is where SynthID-Text differs most sharply from the schemes it succeeded, and where most secondary coverage gets it wrong.

The paper defines three scoring functions in increasing sophistication:

1. Mean g-value. Unwatermarked text has expectation 0.5 under Bernoulli g-values; watermarked text scores higher.
2. Weighted mean, which re-weights evidence across tournament layers.
3. Bayesian scorer — a trained classifier computing the posterior probability that the text is watermarked. This is the default and best-performing detector.

Consequently there is no closed-form statistical test in the deployed configuration. The Kirchenbauer green-list scheme has an analytic binomial null and yields a genuine p-value. SynthID-Text does not. Thresholds are set empirically: take the scores of a held-out unwatermarked corpus and pick the cut-off corresponding to the top x % of scores. Reported performance is therefore true-positive rate at a fixed false-positive rate of 1 %, calibrated against a reference corpus.

The released implementation confirms this: BayesianDetectorModel computes the sigmoid of the log-ratio of posteriors, with BayesianDetectorConfig exposing watermarking_depth and a base_rate prior defaulting to 0.5.

The paper also describes a selective prediction mode in which the detector may abstain — returning "don't know" for a fraction of inputs to hit simultaneous TPR and FPR targets.

If you see SynthID described as using a z-score threshold, the author has confused it with the green-list family.

What the paper actually measured

Detection performance in the Nature paper is presented in figures rather than in prose tables, and the axes matter enormously — model, temperature and token count all shift the curves. Rather than quote a single headline number out of context, the defensible summary is:

• The metric is TPR at FPR = 1 %.
• Detectability rises monotonically with text length; the paper evaluates 100, 200 and 400 tokens.
• SynthID-Text outperforms Gumbel sampling at equal length within the non-distortionary class, with larger gains at lower entropy.
• Models evaluated: Gemma 2B-IT, Gemma 7B-IT, Mistral 7B-IT, plus production Gemini.

The figures that are stated verbatim, and are the more interesting ones, concern quality and cost:

• Live experiment at scale: roughly 20 million watermarked and unwatermarked Gemini responses compared via user feedback. The thumbs-up rate differed by 0.01 % (watermarked higher) and the thumbs-down rate by 0.02 % — both statistically insignificant.
• Human evaluation: raters compared responses across 3,000 ELI5 questions on grammaticality, relevance, correctness, helpfulness and overall quality. No significant difference on any of the five.
• Latency: Gemma 7B-IT on four v5e TPUs generates at 15.527 ms per token, rising to 15.615 ms with 30-layer tournament sampling — a 0.57 % increase.
• Deployment: "Non-distortionary SynthID-Text has been productionized and is currently watermarking responses in Gemini and Gemini Advanced."

There is also an under-covered engineering result that arguably made production deployment possible at all: fast watermarked speculative sampling, with a theoretical guarantee of preserving the speculative-decoding acceptance rate when paired with a non-distortionary watermark. Without it, watermarking would have imposed a throughput penalty on exactly the optimisation that makes large-scale serving economical.

What was actually open-sourced

Google's October 2024 release into Hugging Face Transformers v4.46.0 was widely reported as "Google open-sources its AI text watermark". That headline is misleading in a way that matters.

Released:

Not released:

• Google's production watermarking keys. Without the key you cannot compute g_ℓ, and without g_ℓ there is no detection. This is the whole ballgame.
• A trained detector for Gemini output. The released Bayesian model is an untrained architecture. Google's documentation states you must train your own on a minimum of 10,000 examples of watermarked and unwatermarked output from the specific models sharing that configuration.
• Any endpoint that tells an outsider whether a given text came from Gemini.

Google's own developer documentation frames three deployment postures that the operator chooses: fully private (detector never released), semi-private (API access only), and public (detector downloadable). Google's own text watermark is fully private. The Hugging Face announcement puts it plainly: each model's configuration "should be stored securely and privately, otherwise your watermark may be replicable by others."

The DeepMind reference repository is equally direct that it "is not intended for production use," and notes that its hash function "does not provide any guarantees of cryptographic security."

The accurate one-line summary: Google open-sourced the method and the tooling to run your own instance of it. It did not open-source its watermark. A developer can watermark and detect their own model's output. Nobody outside Google can detect Google's.

Why this is structural, not stubborn

It is worth stating the constraint sympathetically before criticising it, because the criticism is usually unfair.

SynthID is a symmetric scheme. The key that lets you verify is the key that lets you forge. Hand out the detector and you have handed out the ability to stamp arbitrary text — including defamatory content, fabricated confessions, or manufactured evidence — so that it tests as Gemini output. Given that watermark stealing research demonstrated over 80 % spoofing success against green-list schemes for under $50 in API queries, this is not a hypothetical concern.

There is no public-key watermarking construction in production where verification and forgery are separable the way they are for ordinary digital signatures. Until there is, "release the detector" and "make forgery trivial" are the same request.

The consequence is nonetheless uncomfortable: "SynthID says this text is AI-generated" is an unauditable assertion by a single interested party. No outside researcher, journalist, court or regulator can reproduce, contest or falsify it.

SynthID for images, audio and video

Images

Two deep learning models — an encoder for watermarking and a decoder for identifying — trained together on a diverse image set, jointly optimised so the perturbation is imperceptible and reliably recoverable. The watermark is embedded directly into the pixels, not as an overlay or a metadata layer, which is why it survives metadata stripping and screenshots.

Robustness claims, all from Google's own internal testing: colour and grayscale filters, brightness and contrast adjustment, JPEG compression, rotation, resizing, cropping, and frame-rate changes for video. DeepMind concedes the system "isn't perfect" against extreme manipulation.

The detector output is a three-level verdict, not a probability: detected, possibly detected, not detected.

On Vertex AI, watermarking is on by default — addWatermark defaults to true, must be disabled via API rather than the console, and disabling it is required to use the deterministic seed parameter.

Secondary literature sometimes describes SynthID image marking as operating in the latent space of the generation model. DeepMind's own wording is "into the pixels". The distinction has not been resolved publicly, and no primary source confirms the latent-space description.

Audio

The waveform is converted to a spectrogram, the watermark is embedded there, and the spectrogram is converted back to audio. Google reports it is inaudible and survives noise addition, MP3 compression and speed changes. Notably, it can localise: identifying whether specific portions of a track contain synthetic content, rather than only flagging the file as a whole. Deployed in Lyria, Dream Track for YouTube Shorts, and NotebookLM Audio Overviews.

Video

The image technique applied per frame — the watermark is embedded into the pixels of every frame. Deployed in Veo and VideoFX.

The accountability gap

For none of these three modalities is there a peer-reviewed paper, a published architecture, a stated payload capacity, a published false-positive rate, or an independent robustness evaluation. This is a substantive asymmetry worth naming: the text watermark was submitted to Nature, survived peer review, and had its code released. The media watermarks have had none of that scrutiny, and they are the ones making claims — "survives cropping", "survives compression" — that are directly falsifiable if anyone could test them.

Who can actually verify what

The SynthID Detector portal

Announced at Google I/O in May 2025: upload content, scan for the watermark, receive results highlighting the regions most likely to be marked, with a colour-coded confidence heatmap. Access is waitlist-gated, aimed at journalists, media professionals and researchers.

At launch, images and audio were live, and Google stated that "video and text watermark detection will be rolled out in the coming weeks."

As of August 2026 — roughly fifteen months later — text has not appeared. DeepMind's current SynthID page still describes the portal as accepting image, video or audio files, and still describes it as an early-tester programme. Google's own Gemini help page for verification lists images, videos and audio only, with quotas of roughly ten checks per modality per rolling 24 hours, and states the tool "can currently only recognize content created by Google AI tools."

The Content Detection API

Previewed in May 2026 on Google Cloud's Gemini Enterprise Agent Platform. REST, accepting JPEG, PNG and WebP — images only. Available to a named set of trusted partners: Shutterstock, Snap, Fox Sports, Canva, Avid, Attestiv and Nectar Social, with a registration form for others.

One detail deserves scrutiny. The API is described as using machine learning to analyse "pixel-level artifacts, noise patterns, and spectral anomalies", and as identifying AI-generated media "from Google and other popular models." That is not watermark detection. That is a passive-forensics classifier — a guess — bolted alongside the watermark decoder, and it carries a fundamentally weaker epistemic claim. Conflating the two under one API response is a meaningful loss of clarity.

Search, Chrome and Gemini

Since May 2026, verification is live in the Gemini app and in Google Search via Lens, AI Mode and Circle to Search. Chrome right-click verification and C2PA verification in Search were announced as following. Google reports the Gemini verification feature has been used 50 million times globally.

One documented inconsistency is worth knowing about: a hands-on test in November 2025 ran the same image through three Google surfaces — a natural-language Gemini query, the SynthID Gemini extension, and the DeepMind portal — and received three materially different answers, ranging from a specific percentage with edit-type attribution, to a bare "all or part of the content in this image was generated with Google AI", to a full confidence heatmap. The tester's conclusion: "the way you ask the question determines what answer you get."

Summary

Attacks and independent findings

The ETH Zurich probing study

The single most useful critical source is ETH Zurich's SRI Lab, which decomposed SynthID-Text into its seeding, context expansion, tournament sampling and caching components and tested each.

Their findings, in order of importance:

• The watermark is not stealthy. Its presence can be confirmed via black-box queries with near-certainty, because token bias is consistent for a fixed context.
• Spoofing is harder than for green-list schemes, but not hard. Baseline forgery success was 4 %, against over 80 % for standard red-green schemes — a genuine improvement. But tripling the attacker's query budget raised it to 15 %, implying feasibility at scale.
• Successful forgeries leave detectable clues, and a purpose-built clue detector had high power. This is a real defensive layer.
• Removal is the weak point. "Over 90 % of paraphrasing attempts successfully removed the watermark without assistance", rising to "nearly 100 %" when combined with watermark-stealing techniques.

The ironic structural finding: tournament sampling and context caching are what most improve spoofing resistance, and simultaneously what most increase scrubbing vulnerability.

Robustness numbers

Separate published robustness work on SynthID-Text found:

• Synonym substitution at 70 % of words: F1 0.884, AUC still above 0.94. Lexical noise is not an effective attack.
• Paraphrase with lexical and order diversity: AUC falls from 1.0 to 0.91.
• Round-trip translation English → Chinese → English: F1 0.711, TPR 0.675. This is the most damaging single-step attack, and worse translation quality destroys more watermark.
• Copy-paste dilution: watermarked text embedded in ten times as much unwatermarked text gives F1 0.788 with a false-positive rate of 0.53; at twenty times, AUC reaches 0.5 — chance level.

Dilution is the finding that should worry practitioners most, because it is not really an attack. Quoting AI-generated text inside a longer human document is ordinary behaviour.

Image attacks and a live dispute

UnMarker (IEEE S&P 2025, University of Waterloo) is a universal black-box attack that requires no knowledge of the watermarking scheme, operating in the spectral domain, runnable in about five minutes on rented GPU. Its author reported a success rate against SynthID that IEEE Spectrum published — and which Google DeepMind formally disputed, stating it tested the tool and found the success rate "significantly lower". Google has not published its own figure.

The dispute is itself the story. There is no neutral benchmark, no shared test set, and no independent body able to settle it — because the only party who can run the detector is the party whose product is being tested.

What Google concedes

The Nature paper's own discussion is candid: generative watermarks "do not offer a complete solution to artificial-intelligence text detection"; they require coordination among providers; they are ineffective against open-weight models deployed decentrally; and they are explicitly vulnerable to "stealing, spoofing and scrubbing attacks."

Google's developer documentation adds that watermarking is "less effective on factual responses", that detector confidence "can be greatly reduced when an AI-generated text is thoroughly rewritten, or translated to another language", and that it is not designed to stop "motivated adversaries from causing harm."

Adoption

Two cautions on those numbers. The 2025 figure counts undifferentiated "pieces of content" including text; the 2026 figure counts images and videos, with audio measured in duration. They are not the same metric and should not be chained into a growth rate.

More significantly: Google has never published a figure for how much text it has watermarked. The 2026 announcement conspicuously does not break text out. The only Google-sourced text quantity available anywhere is the roughly 20 million Gemini responses in the Nature live experiment — an experiment sample, not a deployment total.

Products applying SynthID: Gemini, Imagen via Vertex AI, Veo, VideoFX, ImageFX, Lyria, Dream Track, NotebookLM Audio Overviews, Google Photos "Reimagine", and Pixel devices paired with C2PA. Third-party adopters as of May 2026 include NVIDIA (Cosmos video models), OpenAI (combining C2PA metadata with SynthID watermarking), Kakao and ElevenLabs.

How to read a SynthID result

A positive result is meaningful. It means the content passed through a Google generation system, established by a keyed signal rather than a guess. Treat it as strong evidence.

A negative result establishes almost nothing. It is consistent with: human creation; generation by a non-Google model; an open-weight model run locally with watermarking omitted; text too short or too low-entropy to mark; translation, paraphrase or dilution; or simply a modality Google does not expose.

Google's help text says it directly: SynthID "only detects content watermarked with SynthID."

Coverage, not accuracy, is the binding constraint — and it always will be, because SynthID-Text is a sampling-time intervention. Anyone running open weights locally omits the logits processor. No algorithmic improvement changes that.

And for text specifically, the verdict is not yours to check. You are being asked to accept an unfalsifiable claim from the company whose product is under examination. That may be entirely reasonable — Google has no obvious incentive to lie about this — but it is a different kind of evidence from a signature you can verify yourself, and it should be labelled as such.

What this means for provenance checking

The practical takeaway for anyone building or buying verification tooling: do not treat SynthID as a checkable signal for text. Any tool claiming to detect SynthID text marks is either mistaken or describing something else. For images, audio and video, the honest position is that verification requires Google's own interfaces, is rate-limited, returns a verdict rather than evidence, and cannot be reproduced offline or included in an audit trail.

What can be checked independently, today, by anyone: C2PA manifests and their cryptographic validity, embedded metadata, and deterministic content anomalies. Those are facts about a file. A SynthID verdict, for now, is a report about someone else's database.

Provenance Lens is an independent project. It is not affiliated with, endorsed by, or sponsored by Anthropic, Adobe, Google, OpenAI, or any other provider whose signals it inspects.