AI Text Watermark: How SynthID Works and Where It Fails
Short answer
An AI text watermark is a hidden statistical pattern in the words a model chooses, readable only by someone who holds the secret key. Google's SynthID Text marks Gemini output and is open source. OpenAI built a similar method but has not released it. Watermarks weaken when text is rewritten or translated, and the public cannot check them.
Paper makers have pressed watermarks into sheets for centuries. Hold the page to a light and the maker’s crest appears. AI text watermarks follow the same idea with one big difference: nobody can see them, not even with a light box. They exist only as a statistical tilt in which words the model picked, and you need a secret key to read it.
That design is why watermarks are both promising and frustrating. They can identify AI text with far more confidence than a detector guessing from style. But only the provider that set the key can check, and editing wears the mark away.
How statistical watermarking works
Language models write one token at a time. For each position the model has a probability distribution over possible next tokens, and usually several options are almost equally good. Watermarks use that freedom.
- Secret keyThe provider generates a private key, for SynthID typically 20 to 30 random integers.
- Score candidatesA pseudo-random function, keyed on the secret and the preceding tokens, scores each candidate word.
- Nudge the choiceAmong roughly equal options, the model prefers higher-scoring ones. Meaning and quality stay the same.
- Detect laterA detector with the same key checks whether a text contains more high-scoring words than chance would produce.
One sentence proves nothing. Several hundred words with a consistent tilt can be very convincing, because the probability of that pattern appearing by chance becomes tiny. The result is still probabilistic: Google’s detector returns watermarked, not watermarked or uncertain, and operators can set thresholds to trade false positives against false negatives.
SynthID Text: the one you can study
Google DeepMind published SynthID Text in Nature in October 2024 and released it as open source in Hugging Face Transformers, version 4.46.0. Google ran a live experiment covering about 20 million Gemini responses, and users did not rate watermarked answers differently from unwatermarked ones.
The technical documentation is unusually frank about limits (Google AI for Developers):
- watermarking is less effective on factual answers, because there are fewer equally good word choices
- detector confidence “can be greatly reduced” when text is thoroughly rewritten or translated
- it holds up against light edits and cropping
- it “is not designed to directly stop motivated adversaries”
Detection needs the watermarking configuration, meaning the keys and a parameter called ngram_len, plus a detector trained on watermarked and unwatermarked samples from that model. Google’s guidance recommends at least 10,000 examples. Keys are meant to stay private, because anyone with the key could forge or remove the mark more easily.
OpenAI’s watermark that never shipped
OpenAI updated a blog post in August 2024 to say it had developed a text watermarking method that was “highly accurate and even effective against localized tampering, such as paraphrasing”. It held up less well against what OpenAI called “globalized tampering”, such as translation or rewording with another model, which OpenAI described as trivial for bad actors to circumvent. The company also worried that watermarks could stigmatise AI as a writing aid for non-native English speakers. It chose a “deliberate approach” and did not release the tool.
That leaves the world’s most widely used chatbot without a public text watermark. ChatGPT images are a different story: they carry C2PA provenance metadata, covered in our guide to Content Credentials.
| Criterion | Public can check | Survives light edits | Survives translation |
|---|---|---|---|
| SynthID Text (Google) | partly | ||
| OpenAI text watermark (unreleased) | |||
| Style-based AI detectors | partly | ||
| Signed metadata (C2PA) on documents |
Why watermarks won’t settle classroom disputes
Watermarks look like the answer to every “did a student use ChatGPT?” argument. They are not, for three reasons.
Coverage is patchy. Only some providers watermark text, and open-weight models that anyone can run locally carry no watermark unless the person running them adds one. Missing watermarks therefore say nothing.
Access is restricted. Even where a watermark exists, a teacher can’t currently check it. Detection is kept private or limited by design, to stop people from testing removal methods.
Editing erodes it. Students who rewrite a paragraph in their own words, mix AI and human sentences or translate from another language weaken the signal, sometimes below the detection threshold. That is not a flaw that better engineering will remove entirely. Rewriting replaces the very word choices that carried the mark.
The upshot for schools: watermarks may one day confirm some cases, but they will not prove that a student did not use AI. Our guide on whether AI detectors are accurate explains why style-based detectors are an even weaker basis, and the article for students who are falsely accused of using AI covers the evidence that actually works.
What the EU AI Act requires
From 2 August 2026, Article 50(2) of the EU AI Act obliges providers of AI systems that generate synthetic text, images, audio or video to mark the output in a machine-readable format so it is detectable as AI-generated, as far as technically feasible. Providers whose systems were already on the market before that date have until 2 December 2026, under a transition rule added by Regulation (EU) 2026/1744 (EUR-Lex). Assistive editing functions and outputs that don’t substantially change the input are exempt.
The law does not prescribe a technique, and it does not require a public checker. The European Commission published a voluntary code of practice on marking and labelling AI-generated content in June 2026 to guide providers. Signing it is optional. For text, statistical watermarks are the most obvious candidate, so expect more of them in products sold in the EU. Expect also that most of them will be checkable only by the provider, at least at first. The full picture, including labelling duties for deployers and fines, is in our explainer on EU AI Act Article 50.
What to do with this today
If you run a product that generates text, watermarking your output is becoming a compliance question in the EU, not just an ethics one. Open implementations such as SynthID Text are a sensible starting point, and teams that want it integrated with logging and review can ask a studio like OnlineBuilders.
If you are a teacher, editor or manager, don’t plan on watermarks to answer authorship questions in the next few years. Ask for drafts and talk to the writer. And if someone tells you a text “has a ChatGPT watermark”, ask how they checked. The honest answer is usually that they couldn’t.
Questions people ask
Does ChatGPT text have a watermark?
OpenAI has said it developed a text watermarking method that is highly accurate against small edits, but as of its last public statement in 2024 it had not released it. ChatGPT images carry C2PA metadata, which is a different mechanism.
Can I check whether a text has a SynthID watermark?
Not as an ordinary user today. Detection needs the secret watermarking configuration and a detector trained for it. Google's public SynthID check in the Gemini app covers images, video and audio, not text.
Do hidden Unicode characters reveal AI text?
No major provider documents invisible characters as a watermark. Odd spaces or symbols can come from formatting and copy-paste, so treat them as noise, not proof.
Will watermarks make AI detectors unnecessary?
They will make some cases easy, namely unedited text from a provider that watermarks and lets you check. Text from open models, edited text and text from providers without watermarks will still be unknown.
