A SynthID watermark only helps if someone checks for it

A watermark embedded at generation time

Google DeepMind introduced SynthID on 29 August 2023, describing in a blog post a tool that embeds a digital watermark directly into the pixels of images generated by its Imagen model, imperceptible to the human eye but detectable by a paired model trained alongside the watermarking model. Just over a year later, the same approach was extended to text: a paper published in Nature on 23 October 2024 describes SynthID-Text, which watermarks large language model output by adjusting the probabilities used to sample each word rather than by editing pixels, and reports the method was deployed at production scale, assessed through feedback from nearly 20 million Gemini responses, without a measured change in output quality.

How detection is scoped, by design

For images, the 2023 announcement states detection returns one of three outcomes: watermark detected, watermark not detected, or watermark possibly present, a three-way result framed as a confidence signal rather than a binary verdict, and states the mark can survive filtering, colour adjustment and JPEG compression while acknowledging it is not 'foolproof against extreme image manipulations'. For text, the Nature paper reports that SynthID-Text's detector runs without needing the underlying language model, keeping detection computationally light, and that it performs consistently across different languages, unlike some alternative detectors trained on a narrower set of languages.

What the paper's own limitations section rules out

The Nature paper is explicit that a generative watermark like SynthID-Text 'does not offer a complete solution to artificial-intelligence text detection'. It only marks text produced by a cooperating generator, so it cannot identify text from a model or provider that has not implemented it, and the paper names open-source models specifically as a case where enforcing watermarking is difficult because there is no central service through which to apply it. The same section states the watermark is weakened by edits such as paraphrasing, and names stealing, spoofing and scrubbing attacks as an open research problem rather than a solved one. None of this is a flaw unique to SynthID; it follows from watermarking being a property of the generator, not of the text or image itself.

Questions to carry into your own evaluation

• Was the content in question produced by a generator known to apply this watermark, or could it plausibly come from an unwatermarked source?
• Has the content been edited, paraphrased, or recompressed since generation, in ways the source documents say weaken detection?
• Does a 'possibly detected' or borderline result get treated with the same caution the vendor's own documentation recommends?

SynthID demonstrates that a watermark can be imperceptible and still detectable under specific, disclosed conditions. A current product page, as retrieved on 16 September 2026, describes the same approach now extended to audio and video as well as images and text, though its own primary sources are equally clear that coverage depends on adoption by the generator and survives only a defined set of edits, which makes SynthID a complement to other provenance tools rather than a stand-alone answer to identifying synthetic media.