SynthID Watermark: Text, Images, Audio, and Video

Google describes SynthID as a family of watermarking tools covering everything its generative systems produce: images, audio, video, and text. The mechanism differs completely by medium.

The goal is not to block generation or slap a visible label on output. It's to let anyone downstream (a platform, a fact-checker, another AI system) check computationally whether content passed through a Google model.

• Images, audio, and video: the signal is embedded directly into pixel values, the audio waveform, or individual frames, so the mark travels with the file's actual data.
• Text: nothing is embedded at all, because there is no surface to alter without changing what the words say. SynthID Text watermarks the process of choosing words instead.
• Both: no logo, no visible label, no metadata tag. Each version is built into the generation process itself.

That split is also why they break differently. Re-encoding an image or trimming a video can leave the media watermark detectable, since it lives in the signal. Rewrite or translate a passage enough and the token pattern the text watermark depends on gets disturbed.

A model doesn't weigh every possible next word. Top-K and Top-P sampling first cut the field down to a shortlist of plausible tokens.

Only after that narrowing does SynthID Text step in, as a logits processor that nudges probabilities across the shortlist according to a watermark configuration. Google's peer-reviewed 2024 Nature paper calls the technique tournament sampling, and the model then draws from the adjusted list.

The output still reads naturally, because the model is choosing among words it would plausibly have picked anyway, just biased toward some. Nothing visible gets added: no hidden character, no invisible Unicode.

Detection means re-running the statistical test and checking whether a passage's token choices match the expected pattern more often than chance would produce. That's why the answer is a score, and why Google's detector reports watermarked, not watermarked, or uncertain.

Google DeepMind's SynthID model page states that SynthID watermarks text generated by the Gemini app and web experience. Google's robustness documentation covers that same app and web surface specifically.

The August 5, 2026 developer-forum reply, answering a question that named gemini-2.5-flash-lite and gemini-3.1-flash-lite alongside EU AI Act Article 50(2), says API text carries no SynthID watermark and no machine-readable provenance signal, and that native text watermarking "is not planned at the moment."

No source found reconciles the two. The obvious reading is that the consumer app watermarks while the developer API doesn't, but no primary Google source confirms that split for current models.

One more data point leans the same way. Google's own Gemini Apps help page for verifying AI-generated content covers images, video, and audio, and not text.

• Files up to 100MB.
• Video under 90 seconds, audio under 1 hour.
• Roughly 10 checks per content type per 24 hours.
• Gemini "can currently only recognize content created by Google AI tools."

Google's confidence in the design has not gone unchallenged. Four separate evaluations since 2025 have pushed on SynthID Text, and none of them landed where Google's framing would suggest.

• EMNLP 2025 Findings, peer-reviewed: under paraphrase and translation attacks, SynthID Text's resilience is "similar to the TGRL baseline," meaning no clear advantage over a much older, simpler green/red-list scheme.
• IEEE TrustCom 2025, peer-reviewed: SynthID Text is "susceptible to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation." The authors' hybrid defense improved detection F1 score by an average of 11.1% over vanilla SynthID Text.
• A March 2026 preprint: proves the default mean-scoring detector becomes more vulnerable as the number of internal sampling layers increases, while SynthID Text's alternative Bayesian-scoring detector holds up better against that specific attack.
• A July 2026 preprint: 98.3% of texts initially detected lost their signal after a single automated paraphrasing pass, with a 5.4% false-positive rate flagging paraphrased human writing as AI.

One caveat covers all four studies, and it matters. Every test ran against the open-sourced algorithm or a third-party reimplementation such as MarkLLM, not Google's production keys and configuration, which Google has never published.

OpenAI uses SynthID as an invisible watermark layer for images generated through ChatGPT, Codex, and the OpenAI API, running it alongside C2PA metadata as a second, independent signal. That's the media side of SynthID adopted across company lines.

Google separately says SynthID has been used to watermark more than ten billion images and video frames across its own services. That's a company-reported figure, not one verified by outside audit.

Checking a file yourself is the harder part. The standalone SynthID Detector portal launched at Google I/O on May 20, 2025, with access gated behind a waitlist for journalists, media professionals, and researchers rather than the general public.

The most recent independent check found (journalist Henk van Ess, November 20, 2025) reported it still waitlist-only, with in-app verification hit-or-miss for audio and video and reliable for images. No later source confirms general availability.

Detection has misfired inside the app too. Fact-checking outlet Lead Stories documented Gemini's in-chat checker returning the verdict for the first image or video uploaded in a session even when asked about a later upload, across four tested sessions, a bug Google fixed globally by mid-July 2026.

Text is the exception to all of this. SynthID Text is open sourced, with a production-grade implementation in Hugging Face Transformers (v4.46.0 and later) that ships a reference Bayesian three-state detector.