SynthID: how AI text watermarking actually works

SynthID is Google DeepMind's watermarking system, covering images, audio, text and video[3]. For text it works by adjusting the probability scores the model assigns to candidate next words, producing a pattern a detector can recognise without changing what the text says[3]. It is the only major text watermarking scheme whose detector is publicly available[4] (OpenAI says it plans to open-source its own scheme, textGrain, announced on 5 October 2026, but has not yet[14]), which is why it is the useful reference point for understanding what Anthropic has shipped.

How does SynthID watermark text?

A language model generates text one token at a time, each time producing a probability score for every candidate token. SynthID nudges those scores using a pseudorandom function before the choice is made. Over hundreds of tokens the choices carry a statistical fingerprint. A detector that knows the function can measure whether a passage's word choices lean the way the watermark would push them. Google reports this does not affect the quality of the output[3].

Two consequences follow directly from the mechanism, and they explain most of what people find confusing:

• Short text cannot be marked reliably. The signal is statistical, so it needs enough tokens to rise above chance. A one-line answer carries little.
• Rewriting destroys it. Change the words and you change the choices the measurement depends on.

Where does Google apply SynthID?

All three rows are from DeepMind's own page[3].

Can the public actually detect SynthID?

For files, yes; for text, still no. DeepMind's page describes two routes, and both are scoped to images, video and audio rather than text. You can upload an image, video or audio clip to your chat and ask whether it was created or altered by Google AI; since an edit to the page read on 8 October 2026, DeepMind says Gemini, Search and Chrome will check[3]. And there is the SynthID Detector, a verification portal launched in 2025. Until that edit the page said Google was testing it with journalists and media professionals; it now says access is expanding to everyone, and that anyone can check whether an image, video or audio file was made with AI from Google or its partners, which it names as OpenAI, NVIDIA, Kakao and, soon, Apple[3]. Neither route is described as accepting text, and we do not know whether either one would handle it. We have not used the portal ourselves.

Separately, the text scheme itself is open source. DeepMind published a reference implementation of SynthID Text watermarking and detection, distributed on PyPI with examples for Gemma and GPT-2[4]. Since an update on 23 October 2026 it ships two detectors: a frequentist one that needs no training, and a Bayesian one that has to be trained, and retrained for every watermarking key. Until then the untrained one was a weighted mean detector[4]. Neither pronounces a verdict. The frequentist one returns a p-value for the hypothesis that the text was not watermarked with the given key, and small values are evidence of the watermark; the Bayesian one returns a score between 0 and 1 — higher means more likely watermarked — and you set the acceptance threshold yourself[4]. DeepMind's design document adds that the p-value holds the false-positive rate down only on average across keys, and recommends calibrating on unwatermarked text with the key actually in use[4]. The update is on the repository's main branch; its last tagged release is still 0.2.1, from November 2024[4].

How does SynthID compare to Claude's watermark?

It is not merely the same category — Anthropic says Claude's watermark is a version of SynthID-Text itself, the scheme described in DeepMind's 2024 Nature paper[10]. The verification story is still opposite, which is the part that matters to you. Google published the scheme and a working detector, so anyone can run it[4]. Anthropic shipped the mark and, since 1 September 2026, a detection API in private preview for organisations obliged to check under EU law[10][1]. A shared scheme does not close that gap: the detector needs the key the text was generated with, and Anthropic holds its own[4][10]. Google's open code will not read a Claude watermark. Full comparison.

Last verified against primary sources: 2026-10-24