SynthID Text: Google's production LLM watermark

How SynthID Text embeds a watermark

Large language models produce a probability distribution over candidate next tokens. Google DeepMind describes SynthID Text as introducing additional information into that token distribution at generation time by modulating the likelihood of tokens being selected.

The important point is that the visible text remains ordinary text. There is no special Unicode sequence or attached text metadata that a user must preserve. Instead, the watermark is represented by a pattern in which tokens were selected relative to secret, context-dependent scoring functions.

How SynthID detection works

The detector recomputes the expected watermark scores for the observed token sequence and measures whether the sequence correlates with those scores more strongly than unwatermarked text should.

This is conceptually similar to other statistical watermarks: each token contributes a weak piece of evidence, and a longer sequence provides more opportunities to accumulate signal. Google explicitly notes that SynthID Text works best for longer, more diverse outputs.

Entropy still matters

If the model has only one plausible next token, the decoder has little freedom to encode hidden information without harming quality. Open-ended prose offers much more capacity than exact quotations, constrained code or highly deterministic answers.

What the detector is not

SynthID detection is not a generic classifier asking whether text “sounds like Gemini.” It checks for a deliberately embedded watermark signal. That distinction is crucial for interpreting false positives and negatives.

Can SynthID Text be removed?

Strong rewriting — paraphrasing, translation, summarization or regeneration by another capable LLM — can reduce the token-level statistical signal by replacing many original token choices. Google explicitly notes that SynthID Text works best on longer, diverse outputs and that strong transformations can reduce detectability.

The exact robustness depends on the system configuration, detector threshold and amount of surviving text. Without access to Google's official detector and calibration, claiming certifiable removal is unsupported.

Metadata stripping, Unicode normalization and invisible-character removal address different mark classes and do not remove a generation-time token watermark.

Limitations of SynthID Text

Google explicitly says SynthID is not a silver bullet for identifying AI-generated content. The text method works best on longer responses with diverse generation choices. Strong transformations can reduce the embedded statistical signal.

The existence of a deployed watermark therefore does not eliminate the need for provenance metadata, content credentials, platform disclosures and other complementary signals.