Is Gemini Watermarked?

Google documents SynthID watermarking for Gemini's image, audio, and video output without qualification, and without any of the hedging that surrounds the text story.

A companion DeepMind paper on the image system alone claims it has been used to watermark more than ten billion images and video frames across Google's services. That's a Google-reported figure no third party has validated, though nobody disputes that the watermarking itself happens.

Google's consumer verification tool, reachable from the Gemini app, is scoped the same way:

• Checks images, video, and audio. Explicitly not text.
• Recognizes content created by Google AI tools only, per Google's own wording.
• Caps you at roughly 10 checks per type every 24 hours.

If you're trying to verify whether a picture or a clip came from a Google AI tool, that's the confirmed, working path. If you're trying to verify text, there is no equivalent tool at all.

Google DeepMind's SynthID model page states it plainly: "We've expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience." That's an official marketing claim, unqualified.

On August 5, 2026, a Google-affiliated account on the Google AI Developer Forum answered a narrow technical question about whether gemini-2.5-flash-lite and gemini-3.1-flash-lite output carries a machine-readable provenance signal under EU AI Act Article 50(2). The answer was a flat denial: "Generated text from the API is NOT SynthID-watermarked. There is no machine-readable providence [sic] signal... Native text watermarking is not planned at the moment."

Nobody has published anything reconciling those two statements.

The most charitable reading is that the consumer-facing Gemini app and web chat apply SynthID Text while the developer API doesn't. That would track with how Google scoped its own verification tool, but it's an inference, and no primary source draws that line for current Gemini 3.x models.

Treat a flat "yes, Gemini text is watermarked" or "no, it isn't" as an incomplete answer until it specifies which surface generated the text.

Where SynthID Text does run, Google describes it as a logits processor applied during generation, after ordinary Top-K and Top-P sampling has narrowed the candidate tokens. The underlying Nature paper calls the technique tournament sampling.

That paper, authored by Google DeepMind researchers, reports a live experiment across a large sample of real Gemini responses that found no detectable drop in output quality from applying the watermark. It describes SynthID Text as productionized specifically for Gemini and Gemini Advanced.

The method has also been open-sourced, with a production-grade reference implementation shipping in Hugging Face Transformers since version 4.46.

Google documents the same robustness pattern independent researchers keep finding elsewhere. The signal survives cropping, minor word changes, and mild paraphrasing reasonably well, but confidence drops sharply under thorough rewriting or translation.

A standalone SynthID Detector portal exists for scanning content directly, launched at Google I/O in 2025. Access has stayed waitlist-gated to journalists and researchers since launch with no public API, and the most recent independent check, by journalist Henk van Ess in November 2025, still found it waitlist-only.

Multiple independent teams have stress-tested SynthID Text since it launched, and the results complicate Google's framing.

• A 2025 EMNLP Findings paper found its resilience to paraphrasing and translation attacks was "similar to" a much simpler, older green/red-list watermark, meaning no clear robustness advantage despite the more sophisticated design.
• A separate 2025 paper found SynthID Text "susceptible to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation," and built a hybrid defense that improved detection accuracy by an average of 11.1% over the vanilla version.
• A 2026 theoretical analysis proved that SynthID Text's mean-score detector becomes less reliable as more tournament-sampling layers are added, while the alternative Bayesian-score detector in the same system holds up better.

A 2026 preprint went further, testing an open-source SynthID Text reimplementation and reporting three numbers worth holding onto:

• 80% of untouched, genuinely watermarked passages fell into SynthID's own "uncertain" confidence zone.
• 98.3% of texts that were initially detected lost their signal after a single round of aggressive paraphrasing.
• 5.4% of human-written text got flagged as AI-generated.

None of this is peer-reviewed, large-scale, first-party Google data, and some of it tests a reimplementation rather than Google's actual production keys. Treat the exact numbers as early and unreplicated, not settled science.

But the pattern is consistent enough across separate independent teams that "SynthID Text is highly robust" shouldn't get repeated as an unqualified fact.