Gemini Watermark: SynthID Text, Images, Audio, and Video

Google's SynthID documentation says the watermark is embedded directly into AI-generated images, audio, and video across Google's products. That part is not in dispute anywhere.

Google DeepMind's SynthID-Image paper, published on arXiv in October 2025, states the system "has been used to watermark over ten billion images and video frames across Google's services." Google reports that figure itself, and no third party has validated it.

On July 24, 2026, Google signed the EU AI Act's Code of Practice on Transparency of AI-Generated Content. What it committed to there is worth reading closely:

• Adopt and accelerate C2PA content credentials.
• Partner with Apple, ElevenLabs, Kakao, NVIDIA, and OpenAI on interoperable SynthID adoption.
• Nothing modality-specific. The announcement makes no commitment about text or about the Gemini API.

Article 50 itself became applicable on August 2, 2026, and the European Commission concluded the Code "adequately covers" Articles 50(2), (4), and (5). No Google statement found anywhere addresses Article 50 compliance for Gemini text specifically.

Google also warned publicly that added regulatory complexity "could contradict Europe's goals for competitiveness." That is not the posture of a company eager to over-promise on the parts of watermarking it hasn't finished building.

Three Google surfaces address Gemini text watermarking. They do not agree.

• DeepMind's SynthID model page, official and unqualified: SynthID watermarks text generated by the Gemini app and web experience.
• The Google AI Developer Forum, August 5, 2026, from a Google-affiliated account: API text is not SynthID-watermarked, there is no machine-readable provenance signal, and native text watermarking "is not planned at the moment."
• Google's Gemini Apps help page for verifying AI content, official: it covers images, video, and audio, and says nothing about text at all.

The tidy reading is that consumer app and web chat watermark text while the developer API doesn't. That's an inference, not a documented fact: the forum question named gemini-2.5-flash-lite and gemini-3.1-flash-lite specifically, and no primary source draws that line for those current-generation models.

The help page is the quiet third data point. It's a second, independently confirmed Google document that stays silent on text in exactly the place a live text watermark would be worth mentioning.

Technically, when SynthID Text does run, Google describes it as a logits processor applied during generation after Top-K and Top-P sampling. A production implementation is available in Hugging Face Transformers.

So treat any flat claim that "Gemini text is watermarked," or that it isn't, as incomplete until it names the surface that produced the text.

Google documents both sides of SynthID Text's robustness, and it's more candid than most marketing copy.

• Survives cropping, a few changed words, and mild paraphrasing.
• Less effective on short factual answers, where there's little room to alter token choice without hurting accuracy.
• Confidence can be greatly reduced by thorough rewriting or translation.

The underlying Nature paper reports a live Gemini app and web experiment across nearly 20 million responses with no detectable quality loss. Detection accuracy is commonly cited elsewhere as roughly 85% true positives at 1% false positives, versus about 73% for prior schemes, though neither figure could be independently reconfirmed as a direct quote from the paper's own text.

Independent researchers have since stress-tested the openly published algorithm, not Google's production keys, which Google has never released. Four results stand out:

• "Watermark under Fire" (EMNLP 2025 Findings, peer-reviewed): resilience to paraphrase and translation attacks "similar to" a much simpler, older watermarking baseline, meaning no clear advantage from the newer method.
• "SynGuard" (IEEE TrustCom 2025, peer-reviewed): SynthID Text is "susceptible to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation."
• A March 2026 preprint: the standard mean-score detector actually grows more vulnerable as more sampling layers are added, while SynthID's own alternative Bayesian-scoring detector resists that specific attack better.
• A July 2026 preprint: 98.3% of initially detected watermarked passages lost their signal after one round of automated paraphrasing, and SynthID Text ranked lowest of three watermarking methods tested on a composite forensic-readiness measure.

None of this contradicts Google's own claim that confidence drops under heavy rewriting. It sharpens what "greatly reduced" means in practice, and it only applies where SynthID Text actually runs.

The SynthID Detector portal launched on May 20, 2025, meant to scan an image, audio, video, or text for a SynthID mark. Only image detection was live at launch, with video and text promised "in the coming weeks."

• Access has stayed waitlist-gated to journalists and researchers, not the general public.
• There's no API.
• The most recent independent check, from November 2025, still found it waitlist-only, and called in-app verification "hit-or-miss" for audio and video though reliable for images.

Then there's the bug. Fact-checking outlet Lead Stories found Gemini's in-chat checker returning the verdict for the first image or video uploaded in a session even when asked about a later one, a concrete failure Google fixed globally by July 16, 2026.

All of which is why removing Gemini's text watermark isn't one question. From the consumer app or web chat, SynthID Text likely applies, and mild edits probably won't touch it while a thorough rewrite, a translation, or even one automated paraphrase pass can knock detector confidence down hard.

From the API, per Google's own forum reply, there may be nothing to remove. Anyone promising a tool that "reliably strips" or "reliably detects" Gemini's text watermark is claiming more certainty than Google, or the researchers who tested its methods, ever have.