TL;DR
- SynthID is an invisible AI watermark, not a generic “AI detector.” Google embeds a machine-detectable signal while its models generate text, images, video, or audio. For text, the signal lives in subtle statistical patterns in token choices; for images, it is embedded into the image itself.
- The idea is not completely new. Researchers were already developing invisible watermarks for generative images and LLM text before SynthID. A prominent 2023 text-watermarking paper, for example, subtly favored a pseudorandom set of “green” tokens; Meta researchers' 2023 Stable Signature embedded hidden signatures into diffusion-generated images. SynthID’s significance is less “watermarking was invented” and more that Google has deployed a sophisticated version at enormous production scale.
- Simple edits are generally not the easiest way to defeat it. Google reports that image watermarks usually survive resizing, recoloring, compression and other transformations. Its 2025 image paper reported more than 99% detection across an aggregate benchmark of 30 transformations at a particular operating threshold. Text experiments similarly found that deletion and ordinary editing weakened—but did not automatically destroy—the watermark when enough text remained.
- Intentional rewriting is a much bigger problem for text. Google’s own research says thorough paraphrasing with a strong LLM can substantially weaken SynthID-Text. Independent 2026 experiments disagree dramatically on exactly how vulnerable it is, which is itself important: robustness depends heavily on the model, text length, detector, threshold, and attack method. None of those independent results should be treated as the measured error rate of Google’s private production detector.
- SynthID should be treated as provenance evidence, not proof of truth. A missing SynthID watermark does not mean something is human-made; it may have come from another AI system or the signal may have been weakened. And a watermark says something about origin—not whether the content is factually correct, ethical, original, or honestly presented. Google itself combines SynthID with broader provenance technology such as C2PA Content Credentials.
What SynthID Actually Is
The easiest way to understand SynthID is to separate it from the familiar visible watermark stamped across stock photography. A normal visible watermark deliberately changes what you see. SynthID instead tries to place a signal below the level of ordinary human perception while keeping that signal detectable by software. Google describes it as a watermark embedded directly into AI-generated images, text, audio, and video.
There is also an important distinction between a watermark and metadata. Metadata is information stored alongside a file: camera model, creation date, editing program, authorship information, and so on. It can be tremendously useful, but it is separate enough from the visible content that ordinary transformations or platform processing can sometimes discard it. SynthID's signal is designed to be part of the content itself. Google’s current Gemini verification system actually uses both approaches: SynthID for an embedded AI-origin signal and Content Credentials, based on the C2PA standard, as a cryptographically verifiable record of origin and editing history.
This distinction helps explain what SynthID is not. It is not simply another classifier that looks at an arbitrary essay and thinks, “This writing style sounds like AI.” With generative watermarking, the AI system deliberately creates a signal while producing the content. A detector later searches for that signal. In other words, SynthID is closer to looking for a deliberately planted signature than making a stylistic guess about authorship. The Nature paper on SynthID-Text explicitly notes that generative watermarks are complementary to conventional post-hoc AI detectors rather than a complete replacement for them.
This also creates a fundamental limitation: an AI model has to participate in the system for its outputs to be watermarked. An unwatermarked open-source model does not magically acquire SynthID merely because it produces AI text. Google acknowledges that decentralized and open-source models make universal watermarking difficult.
There is a small but important current-product nuance here. Google says SynthID is used to watermark and identify text from Gemini, and in 2025 it announced a SynthID Detector portal capable of scanning text as well as images, audio, and video. However, as of August 21, 2026, the mainstream verification workflow documented in the Gemini Apps Help Center is specifically for uploaded images, video, and audio; that documentation says Gemini currently recognizes SynthID from Google AI tools in this verification experience. So “Gemini uses SynthID for text” and “Gemini currently offers the same consumer verification flow for arbitrary text” are not identical claims.
The deployment is already enormous. In May 2026, Google reported that SynthID had been used to watermark more than 100 billion images and videos and an amount of generated audio equivalent to 60,000 years. Google also said its media-verification capability had already been used 50 million times globally. Those are Google-reported figures, but they illustrate why SynthID matters beyond the research-lab level.
Also Read: [HONEST] Does Claude Watermark AI Text?
How SynthID Watermarks Text
Text poses a surprisingly difficult watermarking problem because there is nowhere obvious to hide extra information. Change pixels in a photograph by an imperceptible amount and a human may never notice. But add a strange word to every sentence and the manipulation becomes obvious.
SynthID-Text gets around this by exploiting something large language models already do: choose among several plausible next tokens. A token is simply the small unit of text an LLM works with. A token might be a complete word, part of a word, punctuation, or another short text fragment.
Suppose Gemini has written:
“One consequence of rising temperatures is…”
The model may consider several next tokens plausible: “melting,” “increased,” “changing,” “more,” and so forth. Normally the model assigns probabilities to these alternatives and samples from them. SynthID changes the sampling process in a controlled way so that its selections correlate with pseudorandom values derived from the surrounding context and a watermark key. A detector that knows how to look for those correlations can accumulate evidence across the resulting text.
The published SynthID-Text system uses a method Google calls Tournament sampling. Rather than simply saying “always pick this secret list of words,” candidate tokens effectively compete through several rounds using pseudorandom scoring functions. The final wording is therefore statistically influenced by the watermark without having to contain a fixed hidden phrase or obvious repeated vocabulary.
That last point matters. There is no secret sentence buried inside a Gemini answer that can be removed by searching for it. The watermark is a pattern distributed across many generation decisions. Detection examines the relationship between the actual tokens and the expected watermark pattern and produces a score indicating the strength of the evidence.
It also explains why text length matters so much. One coin flip tells you little about whether a coin is biased; hundreds of flips tell you much more. In approximately the same way, a five-word phrase provides far less statistical evidence than a long passage. The SynthID-Text paper evaluates detection as a function of token count and includes a mechanism that can abstain rather than give a confident answer when evidence is insufficient.
Google faced another obvious problem: what if watermarking makes Gemini noticeably worse? Its large-scale experiment is unusually useful here. Researchers randomly routed production Gemini queries between watermarked and equivalent unwatermarked systems and analyzed about 20 million responses. The difference in thumbs-up rate was 0.01 percentage point and the difference in thumbs-down rate was 0.02 percentage point; both were statistically insignificant. The paper also reports negligible additional generation latency in one Gemma configuration—0.57% with the tested 30-layer Tournament setup.
So the clever part of SynthID-Text is not that every generated sentence visibly carries a tag. It is that a large body of otherwise natural-looking language can have a statistically unusual structure known to the verifier.
But that same architecture contains its Achilles’ heel: rewrite enough of the language and you also rewrite the statistical pattern.
How SynthID Watermarks Images
Images give the watermark considerably more room to hide.
An ordinary digital photograph contains millions of numerical pixel values. Small modifications can be practically invisible to a person while still providing a machine-readable signal. SynthID-Image uses learned watermarking components to embed a signal and later detect it. Importantly, Google’s published system makes the watermark content-dependent, meaning it is designed to be connected to the specific image rather than functioning as one identical universal stamp pasted onto every output.
Why does that matter? Imagine every Gemini image contained precisely the same reusable invisible texture. An attacker might try extracting the pattern from one generated image and transferring it to an unrelated human photograph. A content-dependent watermark makes that sort of “copy the stamp” attack harder. Google explicitly lists watermark forgery, removal, model extraction, secret extraction, and watermark-transfer attacks in its threat model.
The biggest practical question, however, is whether ordinary internet life destroys the signal. Images rarely remain pristine. They are resized for messaging apps, recompressed into JPEGs, cropped for social media, filtered, overlaid with text, and sometimes screenshot.
Google’s 2025 SynthID-Image paper tested 10,000 images against 30 transformations spanning color changes, noise, overlays, quality degradation, spatial transformations, and combinations of multiple modifications. At a benchmark operating point calibrated to an average 0.1% false-positive rate under its worst-transformation setting, the reported SynthID-O detector achieved 99.98% true-positive detection across the aggregate random transformations and 99.72% in the aggregate “worst” transformations. Even its difficult combination-of-transformations worst case remained at 98.06%.
Those numbers require two translations.
- True-positive rate means: of the watermarked images, how many did the experiment correctly recognize?
- False-positive rate means: of images that should not trigger the watermark detector, how often did the chosen threshold incorrectly trigger?
And an important warning follows: these are benchmark results from Google’s research paper, not a published error guarantee for every image submitted to the current Gemini app. Image distribution, resolution, transformations, detector versions, and threshold choices can all matter. Google’s current support documentation is correspondingly more cautious: it says a SynthID watermark will usually survive rescaling, recoloring, compression and other modifications, but that sufficiently extensive alteration can eventually make it undetectable.
The documentation even gives instructions for checking a screenshot: crop tightly around the relevant image rather than submitting a collage. That is a useful sign of what “real-world robustness” actually means. The system is not designed only for pristine original PNG files sitting untouched on a laboratory computer.
Yet Google’s own security paper stops well short of calling the watermark unbreakable. Its researchers discuss adversarial perturbations—carefully computed pixel modifications intended to fool a detector—and regeneration attacks, in which another generative model reconstructs the image and potentially washes away the original watermark. They state explicitly that, in the proprietary deployment setting, the practical goal is to make black-box attacks computationally infeasible at scale rather than guarantee survival against a determined attacker with complete internal access.
That is a much more realistic security objective than “this watermark can never be removed.”
Also Read: Do College Admissions Use AI Detectors?
What Came Before SynthID
SynthID can feel futuristic, but the central idea—embed information into media in a form people barely perceive—is much older than Gemini.
Even within modern generative AI, SynthID had close conceptual relatives. In July 2023, researchers published A Watermark for Large Language Models at ICML. Their method divided potential next tokens into pseudorandom groups and softly increased the probability of tokens from a secret “green” set. A statistical test could later determine whether the resulting passage contained an unusual number of those favored tokens.
SynthID-Text belongs to the same broad family of generative watermarks: alter how the model samples its text while keeping the output natural. Its distinctive contribution is the Tournament sampling method and a set of configurations intended to improve the balance among detectability, text quality, and large-scale production efficiency. The Nature paper itself explicitly builds on earlier generative-watermarking work rather than claiming that the entire concept began with SynthID.
Image generation was moving in the same direction. Meta researchers’ Stable Signature, presented at ICCV 2023, modified the decoder of a latent-diffusion generator so its outputs carried an invisible signature. In the authors’ tests, the system could still identify more than 90% of watermarked images after a severe crop retaining only 10% of the original image, at the particular false-positive setting they reported.
There is also a second family of provenance technology that should not be confused with these hidden statistical signals: C2PA Content Credentials. A C2PA credential is a cryptographically bound provenance record containing claims about a piece of media and its history. Think of it as a signed digital passport: who or what created something, what edits occurred, and what provenance assertions accompanied it.
Also Read: Are There Industry Standards for AI Detector Accuracy? The Truth Behind the Scores
The comparison looks roughly like this:
| Approach | Basic idea | Main strength | Main limitation |
|---|---|---|---|
| Visible watermark | Put a visible logo or label on the content | Humans can immediately see it | Can be distracting and may be cropped or edited away |
| Invisible content watermark such as SynthID | Embed a machine-detectable pattern into words or pixels | Can survive transformations while remaining unobtrusive | Can weaken under sufficiently strong rewriting or manipulation |
| C2PA Content Credentials | Attach cryptographically verifiable provenance information | Can describe source and edit history rather than merely signal “AI” | Requires ecosystem support and availability of valid credentials |
| Post-hoc AI detector | Guess whether arbitrary content resembles AI output | Can analyze content whose generator did not add a watermark | It is classification rather than detection of a deliberately embedded origin signal |
The important development is therefore not that SynthID invented the concept of digital watermarking. Its importance comes from combining advanced watermarking with mass deployment, multiple media types, and consumer-facing verification. Google now also deploys SynthID alongside C2PA rather than treating the two as competitors, reflecting an emerging view that content provenance will probably need several complementary layers.
Can SynthID Be Tricked in the Real World?
This is where the marketing-friendly description—“a robust invisible watermark”—meets the much messier world of adversarial security.
The most useful question is not “Can SynthID ever be defeated?” Almost every practical security mechanism can be defeated under some sufficiently powerful threat model. A better question is:
How much effort does an attacker have to spend, and how much do they have to change the underlying content, before the watermark stops being useful?
The answer differs substantially between text and images.
For text, pure copying is not much of an attack. Because the signal is encoded in token selections, simply copying and pasting the same words preserves the sequence the detector is examining. That follows directly from how the published scoring system operates. Minor editing removes some evidence, but does not necessarily eliminate all of it.
Google tested this directly. In supplementary experiments using 3,000 prompts from the ELI5 dataset, researchers generated watermarked text and then deleted either 20% or 50% of its words. They also had Gemini Ultra thoroughly paraphrase the passages sentence by sentence. The conclusion was nuanced: editing weakened detectability, but sufficiently long passages could remain detectable; strong LLM paraphrasing was substantially more effective because it changed much of the wording that carried the signal.
This creates a peculiar asymmetry. SynthID-Text can be robust against the kinds of changes that happen accidentally—copying, partial edits, excerpts—yet intentional removal does not necessarily require becoming a cryptography expert. A modern LLM can rewrite an entire passage while preserving its overall meaning. Google therefore explicitly identifies paraphrasing, stealing, spoofing, and scrubbing as limitations of generative text watermarks.
Independent research reinforces the concern but also demonstrates why sweeping numbers such as “SynthID is 98% breakable” should be treated carefully. A 2026 study called Vaporizer, testing a SynthID implementation under a particular detector threshold, reported 14% successful removal using PEGASUS paraphrasing, 11% with synonym replacement, 9% with token swapping, 5% with simple paraphrasing, and only 2–3% for the tested translation attacks. Its authors concluded that SynthID required more aggressive modifications than some other watermarking approaches they evaluated.
Another July 2026 preprint produced an almost opposite-looking result. Using a MarkLLM SynthID configuration rather than Google’s private production detector, it reported that paraphrasing removed detection from 58 of 59 SynthID samples that had initially been detected—a 98.3% conditional-removal rate. But the same experiment detected only 6 of 30 pristine SynthID samples before the attack, producing an 80% baseline false-negative rate in that setup.
Those studies are not necessarily contradictory once their setups are considered. They use different implementations, thresholds, models, sample selection rules, text lengths, and attack definitions. More importantly, neither study measures the error rate of Google's deployed Gemini verification infrastructure. The enormous gap between their findings is itself the useful result: a statement such as “SynthID survives paraphrasing” is incomplete unless we also ask which implementation, what detector threshold, how long was the text, and how extensive was the paraphrase?
For images, the difficulty curve looks different.
| Manipulation | Text | Images | Practical assessment |
|---|---|---|---|
| Copying / ordinary file transfer | Wording remains intact | Pixels remain essentially intact | Not a meaningful removal strategy under the published designs. |
| Minor edits / resize / compression | Weakens some token evidence | Designed to survive common transformations | Generally robust, particularly when sufficient content remains. |
| Heavy paraphrase / major visual transformation | Can substantially weaken the watermark | Repeated or severe alterations can eventually prevent detection | A genuine weakness. |
| AI regeneration | Another LLM rewrites the language | Another generative model reconstructs the image | Much more threatening because the media itself is regenerated rather than merely edited. |
| Targeted adversarial attack | Optimize transformations against detection behavior | Compute perturbations or train surrogate models to mislead the decoder | Specialist attack territory; effectiveness depends strongly on access and detector knowledge. |
Google’s image benchmark gives us strong evidence that trivial transformations are not enough under its tested conditions: resizing, noise, color transformations, overlays, spatial transformations, quality loss, and even combinations had very high reported detection rates.
But there is a conceptual escape hatch common to almost every invisible image watermark: stop editing the old pixels and create new pixels instead. Google’s own threat model describes regeneration attacks using powerful generative systems to reconstruct an image, potentially washing away its original watermark. The same paper discusses adversarial examples, local surrogate detectors, watermark forgery, model extraction, and secret extraction.
These attacks are meaningfully more complicated than “save as JPEG” or “crop 20 pixels from the side.” They may require another generative model, significant reconstruction, many queries, a learned substitute detector, optimization, or privileged information. The more aggressively an attacker changes an image, the greater the risk of altering details they actually wanted to preserve. Google consequently frames the goal as making black-box attacks prohibitively expensive at scale, not as achieving mathematically perfect unremovability.
That is probably the fairest overall verdict:
SynthID is considerably more robust against ordinary transformations than an easily removed label, but it is not an indestructible forensic seal.
There is another reason not to treat detection as a binary truth machine. Google’s current Gemini documentation explicitly says that failure to detect SynthID does not establish that content is human-created; it could come from another AI system. It also lists cases where results may be unclear because content is too simple or the AI edit too small to provide enough watermarkable information.
And the reverse security problem matters too. It is not enough to ask, “Can someone remove the watermark from AI material?” A trustworthy system must also resist forgery—making human-created material look as though Google AI created it. Google’s image research explicitly includes false attribution and watermark forgery in its threat model.
For that reason, a SynthID result is best thought of as one piece of provenance evidence. Serious investigations should combine it with signed provenance, source records, original files, context, reverse-image searches, editing history, and human judgment rather than allowing a single detector result to determine guilt or authenticity. Google’s own verification guidance recommends several of these complementary approaches.
The Ethics of Using AI Without Saying So
The most interesting question around SynthID may ultimately have very little to do with watermarking.
Suppose a student writes an essay almost entirely with Gemini, removes the watermark through rewriting, and submits it. Or a consultant delivers an AI-produced market analysis without checking its claims. Or a company publishes a synthetic image of an event without labeling it. In each case, the technical challenge is “Can someone detect this?”
The ethical question is different:
Why should honesty depend on whether someone can catch you?
Using AI is not automatically unethical. The ethical weight depends on what AI did, what the audience reasonably expects, what rules apply, and who is claiming credit or expertise.
Consider a student asking Gemini to explain calculus, challenge an argument, or improve the grammar of an essay they independently researched and wrote. That is very different from asking it to produce the entire assessed submission and presenting the resulting reasoning as evidence of one's own competence. The important issue is not the percentage of keystrokes produced by a machine; it is whether AI use changes what the work purports to demonstrate.
The same logic applies professionally. Using AI to brainstorm headings for a routine internal memo may not warrant a prominent warning. Using it to generate a technical assessment that a client believes reflects the expert's own analysis is a different proposition—especially when errors can affect other people's decisions.
A useful disclosure test is to ask three questions:
- Expectation: Would a reasonable reader assume the work represents my own analysis, observation, creativity, or expertise?
- Accountability: If the AI invents a fact, misquotes a source, infringes someone's work, or gives harmful advice, am I willing and able to take responsibility for it?
- Materiality: Would knowing how extensively AI was used reasonably change how the audience evaluates the work?
These principles are already visible in professional publishing standards. The International Committee of Medical Journal Editors states that AI systems cannot be authors because they cannot accept responsibility for accuracy, integrity, and originality; human authors remain responsible for AI-assisted material. Its current recommendations also say nondisclosure of AI use can require corrective action and, in some circumstances, may be considered misconduct.
This is an important distinction: disclosure is about accountability, not ritual confession. “I used AI” by itself tells the reader very little. A useful disclosure might instead say that AI was used for language editing, summarizing interview notes, generating an illustration, writing an initial draft, or analyzing data—and explain what was subsequently verified by a human.
Law is beginning to move in a similar direction, although the obligations are much narrower and more specific than “every use of AI must be labeled.” In the European Union, Article 50 transparency requirements under the AI Act began applying on August 2, 2026. The European Commission says providers of relevant generative systems must enable detection of AI-generated or manipulated content through machine-readable marking, while deployers face disclosure duties for areas including deepfakes and certain AI-generated text concerning matters of public interest when it lacks human review or editorial control.
That regulatory approach is notable because it separates two responsibilities:
The platform can mark the machine's output. The person using that output is still responsible for how it is presented.
SynthID addresses the first problem. It cannot solve the second.
There is also an ethical danger in the opposite direction: overconfidence in detection. Imagine a professor accusing a student of cheating, an employer rejecting an applicant, or a publisher alleging fraud solely because a detector gives a positive result. Watermarking systems have thresholds, false positives, false negatives, uncertain cases, and adversarial failure modes. Google’s text research includes explicit abstention mechanisms when confidence is inadequate, while its current Gemini documentation acknowledges ambiguous verification outcomes.
That means provenance technology creates responsibilities for the verifier as well as the creator. A detection signal should trigger investigation, not automatically become a verdict.
What SynthID Changes—and What It Doesn’t
SynthID represents an important change in the relationship between generative AI and the media it produces. Until recently, an AI-generated paragraph or image could leave its generator and quickly lose any obvious connection to its origin. SynthID attempts to make at least part of that provenance travel with the content itself. Google has now deployed the idea across an extraordinary volume of generated media and increasingly pairs it with C2PA Content Credentials and verification tools in Gemini, Search, and other products.
For images, the published evidence is impressive against mundane transformations: common compression, resizing, filtering, overlays, noise, and spatial modifications are exactly the kinds of damage the system has been trained and benchmarked to survive. More sophisticated regeneration, adversarial optimization, extraction, or forgery remain part of the threat model, and Google itself does not claim invulnerability.
For text, the problem is more fundamental. The watermark is made from word-selection patterns, so enough rewriting inevitably attacks the very material carrying the evidence. Minor editing does not necessarily erase it, especially in long text, but thorough paraphrasing by another capable model is a serious challenge. Published independent results vary so widely that anyone offering a single universal “SynthID removal rate” is simplifying a much more complicated measurement problem.
And even a technically perfect SynthID detector would answer only a narrow question:
Does this content carry evidence that a participating AI system generated or edited it?
It cannot tell us whether the content is true. It cannot tell us whether the argument is intelligent. It cannot determine whether the creator acted honestly. It cannot prove that unmarked content came from a human. And it cannot decide whether using AI in a particular assignment, workplace, publication, or creative project was acceptable. The technology's own published limitations and Google's current verification documentation make those boundaries explicit.
That is why the most credible future for content authenticity probably does not look like one magical detector. It looks layered: invisible watermarks such as SynthID; signed provenance such as C2PA; platform labels; original-source verification; institutional policies; and, where it matters, plain-language human disclosure. Google’s decision to use both SynthID and Content Credentials points in precisely that direction.
There is a deeper lesson here for students and professionals. As AI-generated content becomes indistinguishable from human work at a glance, we are moving from an internet where authenticity was often assumed until disproved toward one where provenance may increasingly need to be demonstrated.
That may be SynthID’s most consequential idea. Not that machines will always be able to catch hidden AI use. They probably will not. Not that every generated sentence needs a warning label. It probably does not.
Rather, SynthID forces us to confront a world in which “I saw it,” “I read it,” and even “it looks authentic” are no longer sufficient explanations for why we should trust something.
The invisible watermark is ultimately not a substitute for trust. It is evidence we may use when deciding where trust belongs.