Understanding SynthID: What can AI watermarks do and what they can't

In 2002, I gave a talk about Steganography, Winnowing and Chaffing. Steganography, the idea of hiding secret messages inside another message has been there for some time. Recently, the same idea has come up as SynthID, where we hide provenance information inside AI generated artifacts, to prove that a particular artifact was generated by AI. Though the idea of SynthID has been brewing for a while, it has been in the news a lot lately because of the EU AI Act's Article 50.

If we look at the timeline, three things happened within a fortnight. On 5 October OpenAI said it would start watermarking the text ChatGPT writes for users in the EU. On 7 October Google opened its SynthID Detector to everyone, reporting that over 180 billion images and videos now carry its watermark. A week later TIME put SynthID on its Best Inventions of 2026 list. Anthropic had already switched on a text watermark for its newest Claude models in August, worldwide, with no opt-out, and is adding the older ones.

For some time, "can we detect AI content?" was a question that was mostly treated as a standard classification problem by guessing the answer from writing style (which got non-native English speakers wrong). Now as the methods for SynthID have evovled, it is now a question about cryptographic keys, sampling algorithms and who holds the detector. Those are much better questions. They also have less comforting answers than the press releases suggest.

This post tries to cover the basics of SynthId, the confusion and limitations around it. This article is long, because the details are where the interesting parts are. If you only want the short version, it is in the box below.

What are we actually trying to detect, and for whom

Before the mechanisms, the problem, because the mechanisms only make sense against it.

The cost of making a convincing fake has collapsed. A few seconds of someone's voice is enough to clone it. A sentence is enough to produce a photograph of an event that never happened, and a paragraph is enough to produce an essay, a product review, a court filing or a thousand near-identical comments. The harms are not hypothetical. Cloned voices are used to ring relatives and ask for money, and to impersonate executives authorising transfers. A fabricated recording of a candidate was robocalled to voters in New Hampshire before the 2024 primary. Non-consensual sexual imagery of real people has been the largest category of deepfake video by volume since the first surveys of it. Teachers are asked to tell generated essays from written ones with no reliable instrument, and the instruments they are sold flag non-native writers. The labs who are releasing these models have a quieter reason to care as well. Models trained on their own output degrade, a result Shumailov and colleagues published in Nature in 2024 under the name "model collapse", so telling generated text from the rest of the web is now a data-hygiene problem for everyone who trains on the web.

However, there is another side to this. When fakes are cheap, real evidence loses its weight. Anyone caught on a recording can claim it is synthetic, and some of them will be believed. Chesney and Citron called this the liar's dividend, and it means a detector that falsely flags real content does as much damage as one that misses generated content. The Nikon case mentioned below in this post is what that looks like in practice.

So "is this AI?" is not one question but three, and it helps to keep them apart.

1. Was a model involved at all?
2. If yes, then Which one?
3. And how much of the result is the model's work rather than a person's?

The tools below answer the first narrowly, the second partially and only for images, and the third not at all. Different readers also want different things from an answer. A platform suchas a social media web-site, wants a machine-readable signal it can turn into a label at upload time. A journalist or a court wants evidence that survives cross-examination. A developer wants to know whether the text their application emits is marked, and whether they can switch that off. A teacher wants something that does not accuse the wrong student. And most people simply have a file in front of them and want to know what they can check, which has its own section below.

Three ways to detect AI content

Everything in this space falls into one of three families, and they prove different things.

Post-hoc classifiers look at finished content and guess. For text that means tools like GPTZero, Pangram and Originality. For images it means deepfake detectors trained on known generator artefacts. They need no cooperation from the model vendor, which is their whole appeal, and they fail in two characteristic ways. They are an arms race against the generators they target, so every model release resets them. And they are statistical guesses with no ground truth, so they produce false positives that fall on real people. OpenAI's own text classifier, launched in January 2023, caught 26% of AI text while flagging 9% of human text, and was withdrawn six months later. Liang and colleagues showed the same year that detectors systematically flag non-native English writers. Zero-shot methods such as DetectGPT and Binoculars are cleverer, using the model's own probability curvature rather than surface features, but they still argue from style.

Provenance metadata attaches a signed record to the file saying how it was made. The standard here is C2PA and its consumer-facing name, Content Credentials. OpenAI has stamped images from DALL·E 3, its newer image models and Sora with C2PA since 2024; Google's Pixel 10 was the first phone to sign camera originals; Anthropic signs the PNGs and JPEGs Claude produces. C2PA is cryptographically strong and it carries rich information, including edit history. Its weakness is that it lives in metadata. Take a screenshot, run the file through a messaging app that re-encodes it, or just open and resave it in an image editor, and the manifest is gone. It also cannot exist for free-form text at all, because text has nowhere to put metadata.

Watermarking at generation time hides a statistical signal inside the content itself, while the content is being made. For an image that means an imperceptible pattern in the pixels; for audio, in the waveform; for text, in the choice of words. The signal is keyed, so only someone holding the key can read it, and it is designed to survive the transformations that destroy metadata. It proves one narrow thing: that a system holding this key touched this content. It does not say who, when, or how much.

The last row highlights one important thing. None of the three can prove something is human-made. The whole field is about raising the floor for honest platforms, not about catching a determined adversary.

There is a fourth thing, which is not a detection method but is the only part of this most people ever see: the visible label. Instagram and Facebook's "AI info" tag, YouTube's disclosure on realistic altered footage, TikTok's automatic labels, the visible mark on Sora videos. Labels sit downstream of the three families above. A platform reads the C2PA manifest or the watermark when a file is uploaded, or takes the uploader's word for it, and shows the badge. So when a label appears, the question is which of the three signals it rests on, and when none appears the absence means nothing, because the file may have lost its manifest on the way in or come from a model nobody can check. The EU rules are layered the same way. Article 50 separately requires chatbots to say they are chatbots, deepfakes to be disclosed, and AI-written text on matters of public interest to be flagged unless a person takes editorial responsibility for it, all on top of the machine-readable mark that the rest of this post is about.

The regulatory shift of 2026 is what moved watermarking from the third column into production. Article 50 of the EU AI Act became applicable on 2 August 2026 and requires providers to mark generated content in a machine-readable, detectable way. The Commission's Code of Practice on Transparency of AI-Generated Content, published 10 June 2026, spells out what that means (Freshfields has a good summary)

1. AI Generated content should have at least two layers (signed, time-stamped metadata plus an imperceptible watermark where the format allows)
2. There should be a detection tool that must in principle be free
3. Imposes an interoperability deadline of 2 February 2027.

For free-form text, where metadata is impossible, the watermark is the whole answer, with very short text (under about 200 tokens) exempt because the signal is unreliable there. California's AI Transparency Act became operative on the same day, 2 August 2026, requiring large providers to embed a latent disclosure in images, video and audio and to offer a free detection tool but it does not touch text at all. China's labelling measures have been in force since September 2025. Google, OpenAI, Anthropic, Meta, Microsoft and Mistral all signed the EU code before it took effect, alongside about 180 other organisations. That, more than any technical breakthrough, is why your ChatGPT images now carry a Google watermark.

What SynthID is, and how did we get here

SynthID is Google DeepMind's family of watermarking schemes. There is no single SynthID algorithm. There is one for images and video frames, one for audio, one for text, and, since the end of September, one for AI-designed protein sequences. They share a brand and a philosophy, which is to embed the mark at the moment of generation and to keep the detector keyed and mostly private.

The idea of hiding a statistical signal in a model's word choices was proposed inside OpenAI by Scott Aaronson in 2022, and Anthropic's own write-up traces its watermark back to that proposal. The first widely studied version was the "red-green list" of Kirchenbauer and colleagues in 2023 in which at each step, a key and the previous token split the vocabulary into a green half and a red half, and the model is nudged toward green. It works, and it measurably biases the text. SynthID-Text's contribution is the tournament described below, which gets the same detectability while being unbiased on average, and OpenAI's textGrain and Anthropic's Claude watermark are both descendants of the same idea. When a paper says "green-list scheme", it means this family.

Two things stand out in that timeline. The first is scale: going from 10 billion to 180 billion marked items in seventeen months is what happens when every Imagen, Veo, Nano Banana and Gemini image generation is marked by default, and then OpenAI's volume is added on top. The second is the shape of the ecosystem. SynthID is becoming the shared image and audio watermark across vendors, with Google holding the detector, while text is fragmenting into one scheme per lab. More on that below.

How it works: text

The text scheme is the one we can actually read the code for. The paper is Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature 2024, and the production-grade implementation is SynthIDTextWatermarkLogitsProcessor in Hugging Face Transformers.

The main idea

Couple of vocabulary terms first

1. A token is the unit a language model reads and writes: a word or a piece of one, so "watermarking" is two or three tokens. At each step the model does not pick the next token. It produces a probability for every token it knows, and a separate step called sampling rolls the dice according to those probabilities.
2. Entropy is how spread out the probabilities are. After "The capital of France is", nearly all the probability sits on one token and the entropy is close to zero. After "She opened the door and", hundreds of continuations are plausible and the entropy is high.

A text watermark in introduced in the sampling step of the LLM. Imagine the writer has a secret rulebook that colours every possible next word either green or red. The colouring is fixed: the same word after the same few preceding words always gets the same colour, and the rule is built so that anyone without the book sees no pattern at all, just a random-looking mix of half green and half red. The writer's habit is the watermark and what we have now is the watermakred text. In a situation, where the writer has to think about a next word and there are several next words are all acceptable, the writer looks up their colours and picks a green one. No sentence is detectably odd, because every word chosen was a reasonable word, and where only one word will do the writer takes it whatever its colour. Now hand the same rulebook to a reader. They colour every word of a text they are given. In ordinary non-watermakred writing about half should come out green. However, if a few hundred words come out mostly green, that is not chance. It is the signature of a writer who was consulting this rulebook, and the more green words there are, the more certain the reader can be. Someone without the rulebook cannot even colour the words, let alone count them. That is the whole scheme. The model's view of which words are acceptable is untouched, the lean toward green happens only where there is a choice, and the rulebook is the only secret.

There are two important things to note here, and both can be perceived as limitations. Where the model has no real choice i.e. there is only one possible next word, the writer cannot lean towards any pther choice, so low-entropy text (i.e. not many options for next word) carries almost no mark. And because detection is a count, short text is a short count and the evidence is weak.

When a language model is tasked with completing a setence, it produces, at each step, a probability distribution of different possitble tokens that can come next. The sampling layers of the model picks a token from it and moves on. SynthID-Text enhances that sampling layer with something called tournament sampling, and the trick is that it only touches the randomness, never the model.

The g-function

The g-function is a keyed pseudo-random function that maps (recent context, candidate token, secret key) to a single bit, 0 or 1. The reference implementation hashes the previous four tokens plus the candidate token with a linear congruential generator, then folds in one of several secret integer keys and uses the result to index a pre-computed table of random bits. In the tournament sampling there are multiple tournament layers and each of this layers has a separate key. The paper's production configuration uses 30 layers and the open-source examples use anywhere from 9 to 30. A layer is one round of the knockout tournament described next. Round one compares candidates under key 1, round two compares the survivors under key 2, and so on, so a 30-layer watermark is a 30-round tournament with 30 keys, and every token the model emits has come through 30 separate coin flips.

For a given context and key, every token in the vocabulary therefore has a "g-value" of 0 or 1, decided pseudo-randomly. Nothing about the token's meaning or probability affects this. It is a coin flip that is deterministic once you know the key.

The tournament

Tournament sampling draws 2^m candidate tokens from the model's next-token distribution, where m is the number of layers, and runs a knockout bracket. The distribution is the list the model produces at every step of every possible next token with its probability, and each draw is an ordinary sample from that list, so likely tokens turn up several times among the candidates and unlikely ones usually not at all. That is why "mat" appears four times in the figure below. In round one, candidates are paired and the one with the higher g-value under key 1 advances (ties broken at random). Round two uses key 2, and so on. The last token standing is emitted. Tokens whose g-values happen to be 1 under this context's keys win more often, so the emitted text is enriched in g=1 tokens, and only a detector that can recompute the g-values can see that.

What differs between layers is only the key. The bracket has the same shape in every round and the rule is the same, but each round consults a different key or rulebook, so a token that was lucky to picked under key 1 is no more likely than any other to be lucky to picked under key 2. That independence is what makes the layers add up. The winner of an m-layer tournament has, on average, come through m separate g value biased contests, and the detector gets m separate pieces of evidence from every token rather than one.

The layers are not equally informative, though. Each round narrows the field toward the model's most probable tokens, so later rounds more often pit a token against a copy of itself, and a match between identical tokens is a tie that carries no signal. In the figure, "mat" meets "mat" once in round one. In a context where the model is nearly certain of the next token, that happens in every round, which is the tournament's way of expressing the rule that a watermark can only live where the model had a choice. It is also why the detector described below weights early layers more heavily than late ones, and why adding layers gives diminishing returns.

So why 30 layers, and not 3 or 300? Each layer is one more independent draw per token, so more layers mean more evidence per token, and a text can be detected at a shorter length, or with fewer false positives at the same length. With a single layer the signal is faint enough and would need very long texts. There are couple of things that push the other way. The diminishing returns above mean the thirtieth layer adds far less than the second. Every layer makes the choice at a given position more lopsided under its particular key, and the toy figure below shows how far nine of them take it, with the model's 45% favourite reduced to under 1%, so a model watermarked with many layers has less variety in its answers to the same prompt, even though the average over keys and contexts is unchanged. And each layer is one more key to manage and one more set of likelihoods for the detector to learn. Thirty is Google's judgement of where those trade off, not a law of nature, and the open-source examples use anywhere from nine to thirty.

In practice nobody runs the bracket. With the paper's 30 layers it would mean 2³⁰ candidates, about a billion draws, for every single token. The Transformers implementation takes a shortcut, called closed-form, that gives exactly the same result. Because every match is between two independent draws from the same distribution, the probability that a given token comes out of a round as the winner can be written down as a formula rather than simulated. A formula like that, one you can evaluate directly instead of running the process it describes, is what mathematicians call a closed form. The code applies it to every token in the vocabulary once per layer, which reshapes the model's probabilities exactly as a full tournament would, and then draws a single token from the reshaped distribution:

# condensed from transformers/generation/logits_process.py, SynthIDTextWatermarkLogitsProcessor.update_scores
probs = torch.softmax(scores, dim=1)
for i in range(depth):
    g = g_values[:, :, i]                        # 0/1 per vocabulary entry, this layer's key
    g_mass = (g * probs).sum(axis=1, keepdims=True)
    probs = probs * (1 + g - g_mass)             # p'(x) = p(x) * (1 + g(x) - E_p[g])

Each layer multiplies a token's probability by 1 + g(x) − E[g], where E[g] is the share of the probability mass whose coin came up 1 under that layer's key. If the token's g-value is 1 and only half the probability mass had g=1, its probability goes up by 50%; if its g-value is 0 it goes down by 50%. Thirty layers of that compounds into a strong preference for tokens whose g-vector is mostly ones.

I have made available a sample toy tournament code that runs twenty thousand actual tournaments to show the probability distribution of watermarked choosen tokens. Also, it comares the same outcome with the closed form formula.

That figure also shows the property Google calls non-distortionary, which is the most misunderstood claim about SynthID. Under one specific key, the distribution for a specific context is heavily distorted: in the toy, "mat" drops from 45% to under 1%. That is the point; a detector needs a distortion to detect. But the direction of the distortion is random, decided by the key and the context, so averaged over the key the watermarked distribution equals the original (the red bars track the blue ones). What this means is that, if we change the input key or context tokens then the output g-values could be anything and not predictable. Non-distortionary means "no bias in expectation", not "no change to this particular sentence". Google backed the quality claim empirically by serving watermarked and unwatermarked responses to a slice of live Gemini traffic, close to 20 million responses, and found no significant difference in thumbs-up or thumbs-down rates. The cost is also small, as the scheme was folded into speculative sampling, the paper reports a latency overhead of 0.57% per token for the thirty-layer configuration.

Repeated context masking

There is a catch in the averaging argument: it only holds if each context is watermarked once. If the same four-token context recurs in a response, the same g-values recur and the same tokens get boosted again, which is both a quality risk (repetition loops) and a detection risk (correlated evidence counted twice). So the implementation keeps a history of hashed contexts, and if the current context has already been used in this response, it leaves the logits untouched:

is_repeated_context = (self.state.context_history == hash_result_with_just_context).any(dim=1, keepdim=True)
updated_watermarked_scores = torch.where(is_repeated_context, input=scores, other=updated_scores)

The detector applies the same mask, so repeated contexts contribute nothing to the score. Code and lists repeat contexts constantly, which is one of several reasons they watermark poorly.

Detection

Detection needs the key and nothing else: no model, no prompt. Tokenise the text, slide a five-token window over it, recompute the g-value of every token under every layer's key, and look at the average. Unwatermarked text gives 0.5, because the g-function is a fair coin. Watermarked text gives something above 0.5. That is the whole signal: a shift in a sampling average, accumulated over hundreds of tokens.

The simplest detector just thresholds that mean. The paper's better detector, BayesianDetectorModel in Transformers, is a small learned model that sits on top of the same g-values and treats them as evidence rather than as numbers to average. It keeps the evidence separate by layer, because the layers are not equally trustworthy: for the tie reason above, a 1 from an early round says more about whether the text was watermarked than a 1 from a late round. To learn how much more, it is trained on examples of text generated with and without the watermark, which is where it finds that a 1 shows up well above half the time in the early-layer coins of watermarked text, only a little above half in the late-layer coins, and exactly half the time in plain text whatever the layer. It then combines the evidence from every token and every layer with Bayes' rule, the standard arithmetic for updating a belief as evidence arrives, into one probability that the text carries the mark. Calibrated means that probability can be taken at face value: of the texts it scores at 0.9, about nine in ten really are watermarked. Google's deployed detector reports one of three states, watermarked, not watermarked, or uncertain, using two thresholds to pin the false-positive and false-negative rates.

Because the score is an average over tokens, length is everything. Fifty tokens of evidence is a weak coin-flip test; four hundred is a strong one. OpenAI's numbers for its own scheme give a feel for the curve: at a 1% false-positive rate, about 80% of 200-token passages are caught and about 95% of 400-token passages. Those passages were psychology essays. For mathematics, OpenAI says only that detection was "substantially lower", which is the entropy point again. Independent measurements of the open-source SynthID-Text on Gemma-2-9B and Llama-3.1-8B come in lower, 39% at 200 tokens and 56–59% at 400, which tells you how much the result depends on the model, the configuration and the detector training.

Another detail worth knowing: the code comments state that the hashing in the open-source release differs from the one used to watermark the Gemini app, so a detector you train on the Transformers implementation will not read Gemini's text. The algorithm is public but Google's own implementation of it for Gemini is not.

How it works: images and video

The image scheme is documented in the SynthID-Image paper (Gowal and 25 colleagues at DeepMind, October 2025). Unlike the text watermark, which is built into sampling, the image watermark is applied after rendering (the paper's word is post-hoc, which is unhelpfully also the word for the classifiers in the first section). Two networks do the work. An encoder takes the finished image plus a payload, a short string of bits, and returns a copy of the image with the mark woven into its pixel values. A decoder, trained together with it, takes any image and answers two questions separately: is the mark there, and if so, what are the bits. The change the encoder is allowed to make is bounded by a perceptual distance, which measures how different two images look to a person rather than how many pixel values moved, and the paper backs its invisibility claim with human ratings, saying it treats the usual PSNR and SSIM numbers "with extreme caution".

This is not what "watermark" has meant for most of the history of images. The traditional watermark is a picture on top of the picture, a logo or a name in the corner, and its weakness is the same as its strength: anyone can see it, so anyone can crop it off, paint over it, or stamp a copy of it onto something else. The invisible watermarks that followed hid a fixed pattern in the image's frequency content instead, which is what Stable Diffusion's DWT-DCT watermark does. That solved the visibility problem and created a fragility problem, because a fixed pattern stops lining up with itself as soon as the image is resized. SynthID is different on both counts. The pattern is not fixed but computed from the image, so there is no stamp to recognise and remove. It is spread across the whole image at a strength that follows the content, so a crop keeps most of it and a filter does not wash it out. And only the matching decoder can read it, which is what makes it provenance rather than decoration.

Real before-and-after pairs of SynthID itself are harder to come by than you would think, and the reasons are instructive. Google's 2023 launch post has four generated images split down the middle, marked on one side and not on the other. The paper shows no residuals. And Google's own API is built so that you cannot make a pair yourself: Vertex AI only honours a seed when addWatermark is false, so you can generate an unmarked Imagen picture deterministically, or a marked one at random, but never the same picture both ways. That rule is the threat model in a sentence. A matched pair could be exactly what an attacker might need to learn what the encoder adds, and for the same reason it is what a researcher needs to study it.

In order to see what invisible means, I added an invisible watermark to a photograph of my own, a jellyfish, with two schemes that are not SynthID but whose code anyone can download. The first is the DWT-DCT family, a frequency-domain technique from the era before machine learning got involved, which Stable Diffusion has shipped with since 2022. The second is Adobe's TrustMark from 2023, a learned encoder and decoder pair of the kind the SynthID paper benchmarks against. Same picture with 32-bit payload are used with these two separare watermarking implemenation and then the difference with the original amplified to see what was changed when the watermark was added. The code for generating the pairs with these two watermakring scheme is available in 02_watermark_pairs.py

The panels above invite you to look for a difference, so here is a fairer test. Drag the handle across the photograph, or click the picture once and use the left and right arrow keys. Everything to the left of the line is the original and everything to the right is the marked copy.

Original Watermarked

Right sideWatermarkedDifference, ×20 SchemeDWT-DCT-SVDTrustMark

The older generation, DWT-DCT-SVD, hides a fixed pattern laid out relative to the image corners, which stops lining up with its decoder after any geometric or compression change. The newer generation, TrustMark, is a learned mark, trained against exactly those changes, and it survives all these changes. And TrustMark is the method the SynthID paper benchmarks against and beats, so it is the floor of the learned generation, not the ceiling.

Why does this need a trained decoder when the text scheme does not? In text, the detector can replay the exact coin flips because the evidence is discrete. The words are the words, tokenising them again gives the same tokens, and recomputing the hash gives the same bits, so detection is arithmetic and the only secret is a number. An image gives you none of that. Its evidence is a faint pattern across millions of continuous pixel values, and every step between the generator and the detector, JPEG, resizing, a screenshot, a filter, moves those values around. A detector that looked for a fixed pattern with a formula would lose it at the first re-encode, which is exactly what happens to the older invisible watermarks. So both halves are learned. The encoder learns where in an image a change can hide and survive, and the decoder learns to recognise the result after the damage. The decoder is a neural network, but a modest one, an image classifier in the ordinary sense. It takes an image in and emits a handful of numbers out, one score for presence and one per payload bit. It is nothing like a language model, it generates nothing, and it is small enough to run on billions of uploads. One consequence follows that is easy to miss. In the text scheme the algorithm is public and the key is an integer. In the image scheme the key is, in effect, the weights of the two networks, which is why nothing about it can be released without also releasing the ability to forge the mark and to strip it.

Robustness is trained in, by putting a simulated internet between the two networks. During training, every watermarked image is pushed through a transformation before the decoder sees it, drawn from thirty of them in six categories: colour changes such as brightness and Instagram-style filters, noise, overlays of text or logos, quality loss from compression and quantisation, spatial changes such as crops, flips and rotations, and combinations of the above. The strengths are tuned so that the transformed image still looks like the same image, on the argument that an attacker who has to wreck the picture to remove the mark has not won anything. The decoder is also trained adversarially, against inputs crafted to fool it, and tested against regeneration attacks that pass the image through a generative model's autoencoder. The paper's headline number is a 99.7% true-positive rate at a 0.1% false-positive rate under the worst-case transformation in each category, against 83% for the best competing post-hoc method (Meta's Watermark Anything) and under 70% for TrustMark and StegaStamp.

The decoder's answer to "is a mark present?" is not a yes or a no but a number, a score, and a score on its own means nothing. Something has to turn it into a yes, a no or an abstention, and that rule is worth describing plainly, because it is where the false-positive guarantee comes from. Google keeps a calibration set of images known to be unwatermarked, scores all of them, and for any new image asks what fraction of that clean set scored at least as high. That fraction is the p-value. Flagging an image only when its p-value is below 0.1% means that, by construction, no more than 0.1% of clean images get flagged, whatever shape the scores happen to have. The paper calls this a conformal p-value and prefers it precisely because it assumes nothing. Between clearly marked and clearly clean there is a band where the detector abstains, which is the "uncertain" answer the public tool gives. Reading the payload is a separate job with a separate output, one number per bit, and is only attempted once presence is established.

The paper also describes a second version of the system, SynthID-O, which it defines as "our external variant of SynthID-Image, available via partnerships". It is not a product you can buy or download. There are no published weights, no SDK and no price list. What exists is an arrangement: a partner such as OpenAI, NVIDIA or Kakao runs Google's encoder inside its own generation service, with a payload that identifies the partner, model and version (136 bits in a 512×512 image is far more than that needs), and the decoding stays with Google, whose detector then reads the partner's images alongside its own. The paper says the verification service was "available to trusted testers" in October 2025. A year on, the public portal and the Cloud AI Content Detection API are commercially available, for detection only, and the Vertex AI imageverification@001 model is what a Google Cloud customer calls to check images made by Google's own models. Nobody outside the partnerships can embed the mark, and the paper does not name the internal variant or say how the two differ beyond the payload.

Video is marked at the frame level (the paper counts "images and video frames" together, and Google's page promises robustness to changing frame rates) with the audio track marked separately by the audio scheme, which is why the Gemini verifier is able to report a watermark in the audio and none in the visuals of the same clip.

How it works: audio

Google has published no paper on the audio watermark, so what follows is its own description plus what the image paper implies about the recipe. The description is short: the audio is converted into a spectrogram, the mark is embedded there, and the result is converted back into sound. A spectrogram is a picture of a sound, with time running across, frequency running up and loudness as brightness, and it is the natural place to hide something, because a change spread thinly across many cells of that picture can sit far below the level a listener notices while still being, in aggregate, unmistakable to a detector. Google says the result is inaudible and survives added noise, MP3 compression and speeding the track up or down, and that the detector can say which parts of a track carry the mark, so a track with a stretch made by Lyria, Google's music-generation model, spliced into otherwise human audio is reported as partly generated.

Everything that made the image scheme need a trained decoder applies with more force here. Compression, resampling and speed changes move the content of every cell in the spectrogram, so the reader has to be a network trained against those changes, and the secret is again the networks rather than a number. The mark is in Lyria's output and in NotebookLM's generated podcasts, OpenAI added it to its speech output in July 2026, and ElevenLabs has announced it. Which modifications it does not survive is not something Google says. Playing a clip through a speaker and recording it again with a microphone is the oldest trick in audio and it is absent from the list, as is converting the voice into another one, and because the scheme is closed nobody outside Google can test it. The one systematic study of audio watermarks could only test open schemes, and found that none of them survived every attack it tried.

Audio deserves a paragraph of its own, because it is the modality where the harm reaches ordinary people most directly and where the coverage gap is widest. A cloned voice on the phone is already a working fraud. The marks exist only in audio from the handful of vendors who apply them, and the tools most voice-clone scams are made with are not on that list. A SynthID result on a clip tells you a Google or partner model made it. It says nothing about the clip that asks your mother for money, and no public tool today will. The defences there are the old ones: ring back on a number you already have, and agree a word with your family that a cloner would not know.

What you cannot do with any of this is run it locally. There is no public image decoder and no released weights. The verification runs on Google's servers through the SynthID Detector, the Gemini app, Search, Chrome, the Vertex AI imageverification@001 model, or the Cloud AI Content Detection API. The open-source story is text only.

What survived when I edited them myself

Everything so far is what the vendors and the papers say. So I made one piece of media with each of three systems, edited each the way a person forwarding it might, and asked the public detectors what they still saw. The ChatGPT image is a PNG, the Gemini image a JPEG, and the video is a ten-second clip from Google Flow with its own soundtrack, all on the same prompt, sunlight breaking through clouds. The stills were edited in GIMP and the video in Vegas Pro.

• Vegas measures its blur as a unitless range rather than in pixels, so Vegas Pro's blur filter configuration was calibrated against a blurred test pattern first to match the GIMP σ values.
• For the video edits the sound track was muted, so that the verdict can be made on video component alone.

As a control for the metadata route I had Claude make a PNG, which carries Content Credentials and no pixel watermark, and put it through the same edits. Images and video went to synthid.com and the Claude file to claude.com/check-content. The originals, every edited variant and a screenshot of each verdict are in the media folder of the repo.

Couple of things in that table are worth paying attention to.

1. The metadata route died first, and it died on the gentlest edit. The Claude PNG lost its Content Credential on a plain export with nothing changed, as any C2PA manifest does when an editor that does not understand it writes a new file. The SynthID marks in the other three files survived the same export. That one row is the whole argument for marking in two layers.
2. Blur has a clear threshold, and it is lower for video. Both stills were detected at σ = 10 px and went to the uncertain state at σ = 20 px, a blur heavy enough that the picture is no longer much use. The video lost its mark at σ = 10 px, where the stills still passed, which is what I would expect when a per-frame mark has to come through the render's compression as well as the blur. Desaturation, sharpening and a screenshot at 40% of the original size all passed. The uncertain state turned out to have two different messages: "Not enough details" for the ChatGPT image, and "Unsure. AI might have only been used for a very small edit or the image might have been tampered" for the Gemini one.
3. Geometry is where it breaks. A 5° rotation was detected everywhere. Rotating by 90° inside the original canvas, which leaves black bars at the sides and discards the top and bottom of the picture, defeated the detector for all three files. Rotating by 90° with the canvas enlarged so that nothing is lost was detected for both images, so the image detector copes with a quarter turn, and failed for the video, where the render also scaled the rotated frame down to fit. Crops were kinder. Keeping only the centre quarter of the picture, half the width and half the height, passed for all three files, and keeping the top-left quarter passed for the ChatGPT image and the video and came back "unsure" for the Gemini one.
4. The two separate outputs described in the image section showed up unprompted. For the ChatGPT centre crop the detector reported "made or edited with AI from a SynthID partner" without naming OpenAI, where every other positive named the vendor. It had found the mark but could not read the payload. And the wording of the negative verdict is the limitations section in the vendor's own voice: "this may have been generated by a non-partner organization, or at a time prior to a partner adopting SynthID", which is to say that not detected means nothing.

SynthID in the frontier models

The word "SynthID" now appears in the documentation of three competing labs, and it means something different in each.

Google is the only one that uses SynthID for everything. Text generated by the Gemini app has been watermarked since 2024, and after some public confusion this summer, in which a Google staff member on the developer forum said on 5 August that API output was not watermarked and then, having checked with the team, corrected that on 19 August, the position is that Gemini API and AI Studio text is watermarked too. That forum post is, as far as I can find, still the only statement anywhere that it is. The API documentation does not say so. There is no public text detector; the SynthID Detector portal handles images, audio and video only, despite the 2025 announcement saying text would follow.

OpenAI made the most interesting choice. For images and audio it adopted Google's SynthID outright, alongside C2PA, and so a ChatGPT image is now detectable by Google's portal. For text it built its own scheme, textGrain, described in a technical report with researchers from Penn and Yale. The mechanism is the same family as SynthID: a secret key and the preceding words seed pseudo-random values that steer which tokens get chosen, with no hidden characters and no change to what tokens are available. OpenAI describes it as partitioning the vocabulary into blocks and using an entropy budget to decide how hard to push; it says textGrain matched or beat SynthID-Text in its tests. The rollout is telling: on by default only where the law requires it (ChatGPT and Codex in the EU), off by default and opt-in for API developers everywhere, and the detector is available only to approved researchers. This is the company that, per the Wall Street Journal, had a working text watermark in 2024 and shelved it because users said they would leave.

Anthropic went furthest, fastest. Every Claude model launched on or after 2 August carries a text watermark, and the older models still in service (the Opus 4 and Sonnet 4 generations, Haiku 4.5 and Mythos 5) are being added over the following months. Until then they carry Content Credentials on files only. On Anthropic's own surfaces the mark is applied at the model level, so it is present whether the text came from the Claude app, the API or Claude Code. Third-party platforms lagged, with the Amazon Bedrock rollout completing in mid-October. It is on worldwide because, as Anthropic says, it has no durable way to scope it by region, and there is no opt-out. The scheme is explicitly a version of SynthID-Text, which makes Claude the first frontier model to adopt Google's open-sourced text algorithm. But it uses Anthropic's own key, which means Google's detector cannot read Claude's watermark and Anthropic's cannot read Gemini's. Detection is a private preview for regulators, fact-checkers and researchers.

So three labs, three text watermarks, three keyholders, and zero public detectors for text. The public checkers that do exist, synthid.com, openai.com/verify and claude.com/check-content, take images, video, audio and signed files, and none of them accepts a paragraph of prose.

To sum this section up: "SynthID" is one brand name for two different arrangements, and which one applies depends on the kind of content. For images, audio and video, SynthID means Google's networks and Google's detector. Partners run Google's encoder, Google's decoder reads the result, and one public portal covers all of them. For text, SynthID means a published algorithm that each lab runs with its own secret key, so Google's detector cannot read Claude's text and Anthropic's cannot read Gemini's. When a vendor says its text is SynthID-watermarked, the only detector that can confirm it is that vendor's own.

The EU code's February 2027 interoperability deadline, under which signatories must offer either a standardised API, a publicly readable signpost in the content, or a consortium detector, is the first forcing function toward anything cross-vendor. Google's Cloud AI Content Detection API, which claims to identify content from "Google and other popular models", is the first hint of what a consortium detector might look like.

What you can actually check today

Everything above is arranged vendor by vendor. This is the same information arranged by tool, because every tool looks only for particular vendors' marks. Find the row for the tool you can reach, check that the second column takes what you have, and read the third column before you trust a negative: a tool that does not cover the vendor you suspect returns a "not detected" that means nothing.

Three rules for reading any result. A positive means a system holding that vendor's key touched the file. It does not say what the system did, and the Nikon case below is what happens when people forget that. A negative means nothing: too short, edited, translated, another vendor, an open model, a model older than the scheme, or a person. And each tool looks only for its own vendor's marks, with the single exception of Google's portal, which also reads its partners'. There is no tool that checks for "AI" in general, and anything that claims to is a classifier.

SynthID and open-weight models

Here is the structural problem that no amount of partnership announcements fixes.

A sampling-time watermark lives in the sampling layer, not in the weights. But Gemma, Llama, Qwen, Mistral and DeepSeek ship as weights. Whoever runs the weights controls the sampler. Google does not and cannot bake SynthID into Gemma but it does offer SynthID-Text as a logits processor that a deployer may choose to switch on:

from transformers import AutoModelForCausalLM, AutoTokenizer, SynthIDTextWatermarkingConfig

tok = AutoTokenizer.from_pretrained("google/gemma-2-2b-it")
model = AutoModelForCausalLM.from_pretrained("google/gemma-2-2b-it")

wm = SynthIDTextWatermarkingConfig(keys=[654, 400, 836, 123, 340, 443, 597, 160, 57], ngram_len=5)
out = model.generate(**tok(["Once upon a time, "], return_tensors="pt"),
                     watermarking_config=wm, do_sample=True, max_new_tokens=200)

That is one keyword argument. Remove it and the watermark is gone. There is nothing a downstream detector can do about it, because there is nothing in the weights to detect.

This has three consequences that are worth stating.

1. Open-weight output is a permanently unmarked tier. Anyone who wants unwatermarked text, legitimately or not, runs a local model. The current open models are good enough that this is not a sacrifice. The incidence of watermarking therefore falls on the compliant users of hosted APIs and not on the people the regulation is aimed at.

2. Every deployer who does watermark has their own key, so there is no global detector. If you run Qwen behind your own API with SynthID-Text enabled, you can detect your own output and nobody else can. The open-source release makes this explicit: "every watermarking configuration you use with your models needs to have a detector trained to recognize the mark", Hugging Face and Google recommend "a minimum of 10k examples" of your watermarked and unwatermarked text to train it, and the detector training script in the Transformers research projects is where you start. The scheme itself scales to any number of keyholders without anyone coordinating: a deployer picks its own keys and gets a working watermark, keys do not interfere with each other, and text marked under one key looks like plain text under every other. What does not scale is detection. A reader holding a suspicious paragraph would have to know which of the thousands of possible deployers to ask, and ask each in turn, because no detector can check for keys it does not hold.

3. The open implementation is measurably weaker than Google's production numbers. The Case Western paper I cited above (Watermarks Without Verification, Nemecek, Chaudhary and Ayday, September 2026) ran the Transformers implementation on Gemma-2-9B and Llama-3.1-8B. Quality held up for prose (perplexity change −0.3%, judge win rate 50–51%), but detection was far from the near-certainty the brand suggests: AUROC 0.78 and 0.82 on prose, 0.55 and 0.57 on code, which is barely above a coin toss. Llama also lost 3.1 points of pass@1 on coding problems with the watermark on. The authors' point is not that the algorithm is bad but that the deployed configurations (depth, entropy cutoffs, key management, detector calibration) are not inspectable from outside, so nobody can check whether a vendor's claims about its own deployment hold.

There is one partial counter-example. NVIDIA's Cosmos world models are open weights, yet video generated through NVIDIA's hosted Cosmos service on build.nvidia.com is SynthID-watermarked, because NVIDIA applies the (closed) image watermark to the output of its own service. Hosted inference can watermark open models, and local inference cannot be made to. The distinction is about who controls the sampler, not about what is technically possible. A person running Llama on a laptop can switch the watermark on with the same keyword argument shown above, and a cooperative deployer may well do so. But a watermark earns its keep only when it is applied against the interest of someone who would rather it were not, and that person simply leaves the argument out. Nor can the mark be baked into the weights as a way around this. Gu and colleagues showed in 2023 that a model can be fine-tuned to emit watermarked text natively, with no special sampler, and in the same paper that further fine-tuning on ordinary text makes it lose the habit, which anyone holding the weights can do. Whatever lives in the sampler can be switched off, and whatever lives in the weights can be trained out. A hosted service controls both. That split, hosted versus local rather than open versus closed, is the real boundary.

The EU AI Act's answer is that Article 50 obligations attach to the provider of the AI system, which is whoever puts the deployed system on the market, so a company serving Llama from its own servers inherits the duty. That is coherent on paper. It does nothing about the person running ollama run on a laptop, and the code's own commentators acknowledge that compliance cannot be enforced once weights are released and fine-tuned.

Images have been here before. Stable Diffusion's reference pipeline has applied a DWT-DCT invisible watermark since 2022; it does not survive a resize, and the popular community front-ends never applied it in the first place. Black Forest Labs, whose FLUX models are open weights, signed the EU code, and it will be worth watching how an open-weight image lab satisfies a watermarking commitment it cannot enforce on local runs.

Limitations

Google's own documents are more candid about SynthID's limits than most coverage of it, and the independent results are more sobering still. Grouped by what breaks.

Entropy. A watermark can only live where the model had a choice. "The capital of France is" has one acceptable next token; the tournament can boost nothing. Factual answers, code, maths, lists, proofreading of human text and anything the model is reciting rather than composing carry little or no signal. Anthropic's write-up says this directly: watermarking is "sparser in factual passages, strict code, and proofreading". The token shading in the lab below makes this visible: in a watermarked answer, the tokens the model was sure about are coloured at random, and only the tokens it had a real choice over come out green.

Length. Everything is an average over tokens, so short text is undetectable by design. The EU code's own 200-token floor is an admission that below that the error rates are not useful.

Editing and paraphrase. Light edits leave most n-grams intact and the watermark survives. Heavy edits do not. OpenAI reports that replacing 10% of words with synonyms dropped detection from about 92% to 66%, and replacing 25% dropped it to 17%. Running the text through another model to paraphrase it, or translating it, removes the watermark almost entirely, because every token is now chosen by a different sampler. A TrustCom 2025 paper measured exactly this against SynthID-Text with paraphrase, copy-paste edits and back-translation. The attack costs nothing and is already how a lot of AI text gets laundered.

Key secrecy, spoofing and stealing. Whoever has the key can forge the watermark onto human text, which is a reputational attack on both the person and the vendor. Even without the key, Jovanović, Staab and Vechev showed that an attacker who can query a watermarked model can learn enough about its hidden token preferences to spoof or scrub marks for under $50, with over 80% success on the green-list schemes they tested. SynthID's many-layer design and secret hashing make this harder, and nobody has published an equivalent result against it, but the attack class applies to any scheme whose signal is a learnable bias in word choice.

Image removal. The University of Waterloo's UnMarker (IEEE S&P 2025) is a universal attack that distorts spectral amplitudes without visible artefacts and needs no knowledge of the scheme. Against SynthID it took detection from 100% to about 21%, in a few minutes on one GPU. Regeneration attacks, where an image is passed through a diffusion autoencoder, are a second route, and were shown to be provably effective against invisible watermarks in general back in 2023. Google's paper tests against both and claims good results on its own benchmark; the independent results are worse. Both can be true, because the attack strength and the fidelity budget are different in each test.

What "detected" means. A positive means a system holding the key processed this content at some point. It cannot distinguish "the model wrote this" from "the model fixed the grammar of something a human wrote", and vendors say so. On 9 October Nikon disqualified the first-place winner of its Small World in Motion microscopy contest after scientists questioned the footage and a SynthID watermark was cited among the evidence while the entrant says AI was used only to colourise grey-scale microscopy data in post-processing and denies generating the motion. Whatever the truth of that case, it is the shape of the dispute to come: the mark proves a Google tool touched the file, not what it did to it.

What "not detected" means. Nothing. The text might be too short, edited, translated, from another vendor, from an open model, or from a model that predates the scheme. Every vendor's documentation says a negative result is not evidence of human authorship. Every reader will treat it as one anyway.

The verification gap. For text, no vendor offers a public detector. Google's portal does not do text; OpenAI's and Anthropic's text detectors are private previews for approved organisations. The claim "we watermark all our text" is therefore unverifiable by anyone outside the vendor and a few partners, which is the central criticism of the Case Western paper and, to my mind, the most important limitation on the list. A watermark nobody can check is a compliance artefact, not a transparency mechanism.

The lab: dissecting it yourself

Reading the code is one thing. Watching the signal appear is better. The scripts behind the figures in this post are on GitHub at github.com/achintmehta/synthid, in the code folder, next to the media from the edits section. There are three, none of them needs an API key, and nothing in the figures is borrowed.

python -m venv .venv && source .venv/bin/activate     # Windows: .\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
python 00_toy_tournament.py                            # the ten-word toy above, no model needed
python 01_generate.py                                  # one prompt, two answers, plain and watermarked, with scores
python 02_watermark_pairs.py photo.jpg --channels      # an invisible image watermark, with and without

00_toy_tournament.py is the ten-word toy from the text section, tournament sampling written out in plain Python with no model behind it. It produces the bar chart above: the model's distribution, nine layers by the closed-form formula the production code uses, the same nine layers measured over 20,000 simulated tournaments, and the average over random keys that lands back on the original. It runs in seconds, and it is the file to read if you want to see the mechanism rather than take my word for it.

01_generate.py answers the same prompt twice with a real open-weight model, once plain and once with watermarking_config= passed to generate(), from the same random seed and with the same sampling settings. That one argument is the entire difference. It then does what a detector does: it recomputes the g-values for both answers, with the right keys and with a deliberately wrong set, and prints the mean. Plain text lands at 0.5, the watermarked answer above it, and the watermarked answer scored with the wrong keys back at 0.5, which is the three-keys problem in three numbers. It also writes an HTML page with the two answers side by side and every token shaded by its g-values, green where the coin flips came up 1 and red where they came up 0. That page is the closest thing you will get to what Google's own detector shows when it highlights the marked portions of a text. The default model is Qwen/Qwen2.5-1.5B-Instruct because it is small and ungated, and google/gemma-2-2b-it matches Google's own examples if you accept the licence. The three built-in prompts are a story, a factual question and a coding task, chosen so the scores show where the watermark has room and where it does not.

02_watermark_pairs.py is the before-and-after figure in the images section. It watermarks any image with the open DWT-DCT scheme, and with Adobe's TrustMark, one of the paper's comparison methods, if its weights download, then writes the pair, the amplified difference, the difference per colour channel, and a table of which everyday edits each payload survives. It needs only pip install invisible-watermark, plus trustmark if you want the second row. SynthID's own encoder is not available to anyone outside Google's partnerships, which is the whole reason the figure uses open schemes.

If you want to go further, 01_generate.py takes --model and --prompt, so the obvious next experiment is to run the same prompts through two or three model families and watch how far the watermarked score moves on prose compared with code.

So what's next

Watermarking is now a legal baseline, not a feature. The EU's Article 50, California's transparency act and China's labelling rules all took effect within a year of each other, all require a machine-readable mark plus a free detector, and all frontier labs have signed up. The interesting dates are the next ones: 2 December 2026, when systems already on the EU market must comply, and 2 February 2027, when the EU code expects cross-vendor detection interoperability. Google's partnership model, where it holds the image detector for OpenAI, NVIDIA, Kakao and soon Apple, is the de facto consortium for images and audio. Nothing equivalent exists for text, and the three-keys problem will have to be solved either by a shared detection API or by public signposts in the content itself.

The multi-bit payload is where the next capability lives. SynthID-O already carries 136 bits per image, enough to say which model and version produced it. Text payloads are harder (there is less entropy to spend) but the research is active, and once a watermark can say which system made the content and not just that one did, provenance becomes attribution.

Expect the C2PA plus watermark pairing to become universal, because each covers the other's weakness: the manifest carries the story and the watermark survives the screenshot. Expect classifiers to persist as the third layer for content that carries neither, and expect them to stay unreliable.

A quieter trend also runs the other way. Instead of marking what is synthetic, sign what is real. The Pixel 10 signs its camera originals with C2PA, Leica and Sony ship cameras that do the same, and a signed original with an intact edit history is far stronger evidence than any detector's verdict on a file of unknown origin. The people behind C2PA already anticipate the pairing in the previous paragraph: durable Content Credentials pair the manifest with an invisible watermark and a fingerprint, so a stripped manifest can be found again from the content itself. If signing the real becomes normal, "no provenance" becomes the suspicious state, and that is the only regime in which a negative result starts to mean anything.

And expect the open-weight hole to stay open. There is no technical mechanism that makes a locally run model watermark its output, and no regulatory one that reaches a laptop. The honest framing is that watermarking raises the floor for the platforms and APIs that most content flows through, makes casual misuse traceable, and leaves the determined adversary exactly where they were. That is still worth doing. It is just not what "detecting AI-generated content" sounds like it promises.

SynthID is a well-engineered answer to the question it was designed for: did a system with this key touch this content? The mistake is letting anyone believe it answers the question they are actually asking.

Glossary

Token. The unit a language model reads and writes: a word or part of one. Roughly 200 tokens is 150 words of English.

Sampling. The step that picks the next token from the model's probabilities. Watermarking changes this step and nothing else.

Logits. The raw scores the model emits for every token before they are turned into probabilities. A logits processor, which is what the open-source SynthID is, edits them on the way through.

Entropy. How spread out the model's probabilities are at a given step. High entropy means many plausible next tokens and room for a watermark. Low entropy means one obvious token and no room.

n-gram. A run of n consecutive tokens. SynthID hashes the previous four tokens plus the candidate (ngram_len=5) to decide the candidate's coin flip.

Key. The secret integers that seed the coin flips. Whoever holds the key can detect, and nobody else can. Each vendor has its own.

g-value. The coin flip itself: 0 or 1 for a given context, candidate token and key. Watermarked text has more 1s than 0s.

Tournament sampling. SynthID-Text's way of favouring high-g tokens without ever excluding any token: candidates are drawn from the model's distribution and compete in rounds, one key per round.

Non-distortionary. Unbiased on average over keys, not unchanged for any particular sentence. The property that lets Google claim quality is unaffected.

False positive, false negative. Flagging human content as generated, and missing generated content. Detectors are tuned to a target false-positive rate (1% and 0.1% are the figures quoted in this post) and then report how much generated content they catch at that rate.

AUROC. A single number for how well a detector separates the two classes across all thresholds: 1.0 is perfect, 0.5 is a coin toss.

C2PA, Content Credentials. An open standard for a signed, tamper-evident record attached to a file saying how it was made and edited. It lives in metadata, so it is lost when the metadata is.

Manifest. The C2PA record itself.

Payload. What a watermark carries. Zero-bit watermarks only say "marked". Multi-bit ones carry an identifier, such as which model and version.

Open weights. A model whose trained parameters are published for anyone to run. The person running it controls the sampler, so nobody else can make it watermark.

Paraphrase attack. Rewriting generated text with another model so that every token is chosen afresh. The cheapest reliable way to remove a text watermark.

Liar's dividend. The benefit the subject of a real recording gets from the existence of fakes: the ability to claim it is synthetic.