How well does SynthID watermark AI-generated text?

SynthID is Google DeepMind's system for watermarking AI-generated content, and its text variant is now open source for developers to apply to their own models. It embeds a statistical signal in generated text during sampling. That signal weakens under thorough rewriting or translation, and it is not built to stop a determined adversary. The limitation matters because EU transparency obligations for machine-readable marking take effect in 2026.

• SynthID Text alters only the sampling step and needs no extra model training.
• Detection is probabilistic and can return an uncertain result.
• Thorough rewriting or translation can greatly reduce detector confidence.
• Article 50 of the EU AI Act applies marking rules from 2 August 2026.

How does SynthID Text embed a watermark?

SynthID embeds digital watermarks into AI-generated images, audio, text or video and later identifies them. For text, it works as a logits processor applied after Top-K and Top-P in the generation pipeline. A pseudorandom g-function augments the model's logits so that the selected tokens encode the watermark.

The method uses Tournament Sampling. It modifies only the sampling procedure and leaves LLM training untouched, so no additional model training is required.^† A provider simply passes a watermarking configuration to the model's generate() method.

SynthID can run in a non-distortionary mode, which preserves the model's token distribution on average.^† It can also run in a distortionary mode, which gives a stronger watermark at the cost of slightly less natural text.

The open-source code needs careful configuration

SynthID Text has been open sourced in two forms.^† One is a production-grade implementation in Hugging Face Transformers, version 4.46.0 and later. The other is a reference implementation on GitHub, which is not intended for production use and whose hashing function provides no cryptographic security guarantees.^†

A watermarking configuration requires two parameters:

• keys: a list whose length sets the number of watermarking layers.
• ngram_len: 5 is a good default, and larger values make the watermark more detectable but more brittle.

A sampling_table_size of at least 2¹⁶ is recommended for an unbiased and stable g-function, though it costs more inference-time memory.^† Configurations should be stored securely and privately. Otherwise, others may be able to replicate the watermark trivially.

How reliable is SynthID detection?

Detection is probabilistic. The Bayesian detector outputs watermarked, not watermarked or uncertain, and its thresholds can be adjusted to target particular false positive and false negative rates.^† It must be trained on watermarked and unwatermarked data for each unique watermarking key, whereas the Weighted Mean detector needs no training.^†

The watermark survives cropping and light edits, such as changing a few words or mild paraphrasing. It is less effective on factual responses. Detector confidence can be greatly reduced when text is thoroughly rewritten or translated.

SynthID Text is not designed to stop motivated adversaries from causing harm directly, although it can make malicious use harder and can be combined with other approaches. It remains susceptible to paraphrasing and editing attacks and relies on cooperation from model providers.^† In open-source environments, enforcement cannot be guaranteed.

What does research show about attacks on text watermarks?

Albrecht's thesis did not evaluate SynthID experimentally and instead proposed it as an open challenge for future research. It tested the KGW and X-SIR schemes. Paraphrasing and syntactic transformation substantially weakened detection, as did translation, and current watermarks remained vulnerable to a moderately knowledgeable adversary.^†

Separate work shows how an attacker can learn a scheme from its output alone. With about 200K tokens of watermarked output from a black-box model, the green lists of Unigram and semantic-invariant (SIR) watermarks can be estimated with over 0.8 F1. Paraphrasing attacks informed by that knowledge cut the detection true positive rate below 10% at a 1% false positive rate.^†

The Adaptive Text Watermark held up considerably better against the same green-list-informed attack.^† With lexical diversity 20, its true positive rate at 1% false positive rate fell from 96.5% to 57.2%.

Evidence from the Gemini deployment shares one origin

SynthID has been deployed in production in Google's Gemini. This has been described as the first large-scale real-world deployment of generative text watermarking.^†

Several further findings come from a single 2024 research paper. It describes SynthID-Text as production-ready with minimal latency overhead, integrating with speculative sampling and not using the underlying LLM for detection.^† It also reports a live experiment with nearly 20 million Gemini responses that showed text quality was preserved.^† The accounts repeating these findings share that one origin and do not corroborate one another independently.

What will the EU AI Act require from 2026?

Article 50 of the EU AI Act requires providers to apply machine-readable marks to AI-generated synthetic content, including text, and to enable its detection.^† These transparency obligations apply from 2 August 2026. Generative systems already on the market have a grace period until December 2026.

Deployers must clearly label text published to inform the public on matters of public interest if it has not undergone human review or editorial control.^† Fines can reach €15M or 3% of worldwide annual turnover.

A voluntary Code of Practice on Transparency of AI-generated Content was published in June 2026.^† Its purpose is to help providers and deployers demonstrate compliance with the marking and labelling obligations once they become applicable.

Frequently asked questions