SynthID: how AI text watermarking actually works

SynthID is Google DeepMind's watermarking system, covering images, audio, text and video[3]. For text it works by adjusting the probability scores the model assigns to candidate next words, producing a pattern a detector can recognise without changing what the text says[3]. It is the only major text watermarking scheme whose detector is publicly available[4], which is why it is the useful reference point for understanding what Anthropic has shipped.

How does SynthID watermark text?

A language model generates text one token at a time, each time producing a probability score for every candidate token. SynthID nudges those scores using a pseudorandom function before the choice is made. Over hundreds of tokens the choices carry a statistical fingerprint. A detector that knows the function can measure whether a passage's word choices lean the way the watermark would push them. Google reports this does not affect the quality of the output[3].

Two consequences follow directly from the mechanism, and they explain most of what people find confusing:

• Short text cannot be marked reliably. The signal is statistical, so it needs enough tokens to rise above chance. A one-line answer carries little.
• Rewriting destroys it. Change the words and you change the choices the measurement depends on.

Where does Google apply SynthID?

All three rows are from DeepMind's own page[3].

Can the public actually detect SynthID?

Partly, and the nuance gets misreported. DeepMind's page describes two routes, and both are scoped to images, video and audio rather than text. You can upload an image, video or audio clip to Gemini and ask whether it was created or altered by Google AI. And there is a SynthID Detector portal, which takes the same three kinds of file — but it is not open to everyone: DeepMind's page says the company is collaborating with journalists and media professionals to test it[3]. Neither route is described as accepting text, and we do not know whether either one would handle it.

Separately, the text scheme itself is open source. DeepMind published a reference implementation of SynthID Text watermarking and detection, distributed on PyPI with examples for Gemma and GPT-2[4]. It ships two detectors: a weighted mean one that needs no training, and a Bayesian one that has to be trained, and retrained for every watermarking key. Neither pronounces a verdict. The Bayesian one returns a score between 0 and 1 — higher means more likely watermarked — and you set the acceptance threshold yourself; for the weighted mean one the repository recommends computing that threshold for the false-positive rate you want, at the token lengths you expect[4].

How does SynthID compare to Claude's watermark?

It is not merely the same category — Anthropic says Claude's watermark is a version of SynthID-Text itself, the scheme described in DeepMind's 2024 Nature paper[10]. The verification story is still opposite, which is the part that matters to you. Google published the scheme and a working detector, so anyone can run it[4]. Anthropic shipped the mark and, since 1 September 2026, a detection API in private preview for organisations obliged to check under EU law[10][1]. A shared scheme does not close that gap: the detector needs the key the text was generated with, and Anthropic holds its own[4][10]. Google's open code will not read a Claude watermark. Full comparison.

Last verified against primary sources: 2026-09-18