SynthID-Text Interactive Tool: How AI Text Watermarking Works

How SynthID-Text Works: In 10 Seconds

SynthID-Text does not add invisible characters after a response has been written. It influences token selection while the model generates the response. The watermark is the statistical relationship that accumulates across many token choices and can later be recomputed by a detector with the correct key.

Key Notes:

• A token does not have one permanent watermark value. Its value depends on the token, recent token context, secret key, and tournament layer.
• The ordinary and keyed passages are separate possible generations, not a before-and-after rewrite.
• The passages can share words. SynthID does not replace every ordinary word with a keyed synonym.
• The same token under the same recent context, key, and layer should receive the same value. After the passages diverge, the same visible word may receive different values because its context differs.
• No individual word proves a watermark. Detection aggregates evidence across many eligible token choices.
• The tool’s evidence score is illustrative and is not the probability that the passage was written by AI. 

Watermarking: A Guide 

Text watermarking is a family of techniques for embedding machine-detectable provenance signals into generated or processed text. Unlike visible marks on images, text watermarks usually cannot rely on pixels or visual overlays. 

They must hide in one of three places: the representation of the text, the wording of the text, or metadata around the text. 

The strongest current industrial pattern for large language models is generation-time statistical watermarking. In that design, the model's sampling process is adjusted so that the output text contains a detectable statistical signature while remaining readable and semantically normal. 

Google DeepMind's SynthID-Text is the most detailed public production-scale example: Google describes it as modifying token probabilities during generation, and the 2024 Nature paper explains a "Tournament sampling" approach, efficient detection without needing access to the underlying LLM, and deployment evidence from nearly 20 million Gemini responses. 

Anthropic's public Claude Help Center now states that supported Claude models launched in the EU on or after August 2, 2026 apply machine-readable text markings at launch; Anthropic describes the text mark as embedded directly into the generated text, model-level, imperceptible, and possibly persistent through copying, pasting, and some editing, while leaving detailed detection documentation forthcoming. 

The second major class is edit-based watermarking. These methods alter an already-generated string by changing characters, whitespace, punctuation, synonym choices, or other surface features. 

Unicode watermarking is a common example: invisible or near-invisible characters can encode bits without changing how a passage appears to most readers. Edit-based methods are easy to implement and inspect, but they are brittle: normalization, format conversion, copy pipelines, accessibility tools, or careful text cleaning can remove them. 

The third class is metadata-based provenance. Metadata is not a watermark inside ordinary prose, but it is often used alongside watermarks. A text file, Markdown frontmatter, HTML meta tag, document property, or C2PA manifest can carry provenance data. Metadata can be cryptographically signed and expressive, but it does not survive plain copy-paste into a new text box. 

No text watermark should be treated as proof of authorship. A detected mark is evidence that a text may have been generated or processed by a particular system. Short passages, low-entropy answers, translation, heavy paraphrase, mixing, and unsupported models can all reduce confidence. 

OpenAI has publicly noted that text watermarking can be accurate in some settings but less robust to global transformations such as translation or model-based rewriting, and has also raised fairness concerns for groups such as non-native English speakers. 

1. Why Text Watermarking Is Hard 

Text is discrete. Images and audio can hide small changes in continuous signals: pixel values, frequencies, phase, or waveform amplitude. Text has no imperceptible decimal places. A word is present or absent. A character is changed or not changed. This makes text watermarking structurally harder. 

Text also has low redundancy in many contexts. 

• A factual answer like "Paris is the capital of France" has very few acceptable variants. 
• A creative essay, by contrast, gives a model many opportunities to choose among semantically similar words, sentence boundaries, and discourse markers. 

That difference matters because most robust text watermarks need entropy: places where the generator can choose one acceptable token over another without hurting quality. 

Finally, text is routinely transformed. People quote fragments, remove formatting, translate it, ask another model to rewrite it, paste it into a CMS, run it through grammar tools, or mix it with human edits. 

A text watermark must therefore answer two competing design goals: it should be strong enough to survive ordinary transformations, but subtle enough not to degrade quality, introduce bias, or create obvious artifacts. 

2. Text Watermarking Methods 

‍

3. Method 1: Edit-Based and Unicode Watermarks 

Edit-based watermarks operate on the produced text string. They do not require access to the LLM's sampler. A post-processor can take text and encode information using transformations that are intended to be invisible or low-salience. 

3.1 Invisible Unicode carriers 

The simplest carrier is an invisible or nearly invisible Unicode codepoint. Common examples include zero-width space, zero-width non-joiner, zero-width joiner, word joiner, byte order mark, variation selectors, bidirectional controls, soft hyphen, and Unicode tag characters. A system can encode bits by inserting or omitting such characters at chosen positions. 

Example: 

‍

This can encode a payload such as a vendor identifier, timestamp class, model class, or checksum. It can also encode a simple yes/no mark. 

3.2 Space and homoglyph substitutions 

A variant uses characters that are visible but visually confusable. A normal ASCII space can be replaced by non-breaking space or ideographic space. A Latin "a" can be replaced by Cyrillic "a" in fonts where the two look similar. Fullwidth Latin characters can also visually resemble ordinary Latin text. 

These systems are easy to implement, but they are risky. They can break search, indexing, accessibility tools, code, diff tools, and text normalization. Homoglyphs are especially dangerous in source code, legal documents, URLs, or identifiers. 

3.3 Bidi control watermarks 

Bidirectional controls can influence display order without obvious visible characters. They can mark text, but they also introduce security and readability risks. Bidi control misuse is well-known in code security because text can display differently from its logical order. 

3.4 Pros and cons 

Edit-based Unicode watermarks have one major advantage: they are deterministic and auditable. A scanner can print exact codepoints and offsets. Removal is also straightforward: strip known codepoints and normalize spaces. 

They also have major limitations. They often fail under plain-text normalization, copy through systems that drop format characters, OCR, retyping, Markdown processing, or cleaning scripts. They also do not solve the hard problem of marking text that is copied as semantically equivalent text rather than byte-equivalent text. 

4. Method 2: Linguistic and Rule-Based Watermarks 

Rule-based linguistic watermarks encode information using choices among semantically similar forms. 

Examples include: 

‍

Such systems can be inserted after generation by a rewrite engine or grammar-aware editor. They can survive copy-paste because the signal is in visible language. However, they risk changing tone, dialect, style, or even meaning. They are also vulnerable to paraphrasing and editing. 

Compared with Unicode marks, linguistic marks are harder to verify exactly because natural writing already contains many variants. A detector must distinguish intentional bias from ordinary author style, genre, dialect, or editing convention.

5. Method 3: Statistical Generation Watermarks 

Statistical generation-time watermarking is the central modern approach for LLM text. It embeds the mark during token generation rather than after text has been written. 

5.1 Basic model 

An autoregressive LLM generates text token by token. At step t , it has context x_<t and produces a probability distribution over the vocabulary: 

p_LM(token | x_<t) 

A watermarking sampler modifies how the next token is selected. The change is usually subtle: it does not force strange words; it slightly prefers acceptable tokens that carry a secret statistical pattern. 

5.2 Green-list / red-list watermark 

The best-known public pattern is the green-list/red-list method from Kirchenbauer et al., "A Watermark for Large Language Models" (ICML 2023). In simplified form: 

1. At each generation step, compute a pseudorandom seed from the recent context and a secret key. 
2. Use the seed to partition the vocabulary into a green list and a red list. 
3. Add a small logit bonus to green-list tokens. 
4. Sample normally from the adjusted distribution. 
5. During detection, recompute the green lists from the text and count whether green tokens appear more often than expected by chance. 

Toy pseudocode:

for each generation step t: 
 context = last H tokens 
 seed = hash(secret_key, context) 
 green_set = random_subset(vocabulary, seed, fraction=gamma) 
 for token in green_set: 
  logits[token] += delta 
 next_token = sample(softmax(logits)) 

‍

Detection:

green_count = number of generated tokens that fall in their step-specific green set 
expected = gamma * eligible_token_count 
variance = eligible_token_count * gamma * (1 - gamma) 
z = (green_count - expected) / sqrt(variance) 

‍

If z is high enough, the detector flags the text as likely watermarked. 

5.3 Why it can be invisible 

The method does not need to pick bad tokens. It can bias among many plausible alternatives. For example, suppose the model can naturally choose: 

‍

"The policy is important because..." 
"The policy matters because..." 
"The policy is significant because..." 

‍

If "matters" is green and "important" is red at this step, the sampler can slightly prefer "matters" without making the sentence strange. Over hundreds of choices, the small bias accumulates. 

5.4 Why entropy matters 

Watermarking needs choice points. If there is only one correct token, the model cannot safely change its choice. Low-entropy contexts therefore reduce watermark strength. 

High-entropy prompt: 

Write a 900-word reflective essay about urban gardens. 

‍

Low-entropy prompt:

What is 2 + 2? 

‍

In the first case, the model has many reasonable continuations. In the second, it has almost none. Google DeepMind's SynthID blog explicitly notes that text watermarking works best for longer, more diverse responses and is less effective for short factual answers or prompts with little variation. 

6. Method 4: SynthID-Text and Tournament Sampling 

Google DeepMind's SynthID-Text is the most detailed public large-company text watermarking system. 

6.1 Public company description 

Google DeepMind states that SynthID for text embeds an imperceptible watermark directly in the text generation process by modulating token likelihoods. The final signal is based on the model's word choices together with adjusted probability scores, and detection compares the observed pattern against expected patterns for watermarked and unwatermarked text.

Google says SynthID for text was brought to the Gemini app and web experience and designed to deploy at scale. Google also states that it is not a complete solution by itself, performs best on longer and more diverse outputs, can tolerate some transformations such as cropping and mild paraphrase, and can lose confidence under thorough rewriting or translation.

6.2 Nature paper architecture 

The 2024 Nature paper "Scalable watermarking for identifying large language model outputs" describes SynthID-Text as a production-ready text watermarking scheme that modifies the sampling procedure rather than model training. It emphasizes three components common to generative watermarks: 

‍

The paper's specific sampling algorithm is Tournament sampling. 

6.3 Tournament sampling, conceptually 

In Tournament sampling, the generator first samples multiple candidate tokens from the normal LLM distribution. It then runs a tournament over those candidates using pseudorandom scoring functions derived from the watermark seed. Tokens that score better under the watermark functions advance through tournament rounds. The final winner becomes the emitted token. 

Conceptual diagram: 

Toy example with a very small candidate set:

Context: "The result was" 
Base candidate samples: 
["surprising", "clear", "unexpected", "strong",
 "surprising", "mixed", "clear", "important"] 

Watermark scoring functions rank candidates in tournament rounds. 
The final selected token is not arbitrary; it is still drawn from plausible model candidates, but its choice is correlated with the secret watermark functions. 

This differs from a simple green-list boost because it chooses among candidates through a multi-layer tournament. The paper reports improved detectability and diversity compared with several prior approaches, while preserving quality in non-distortionary configurations. 

6.4 Detection in SynthID-Text 

Google's open reference implementation describes multiple scoring approaches, including a Weighted Mean detector and a Bayesian detector. The Bayesian detector requires training on representative watermarked and unwatermarked data for a specific key. This matters operationally: a detector is not just a string scanner. It must be calibrated for token length, key, distribution, and false positive tolerance. 

Detection workflow: 

6.5 Production evidence 

The Nature paper reports that non-distortionary SynthID-Text preserved quality in a live Gemini experiment over roughly 20 million watermarked and unwatermarked responses. The paper also states that SynthID-Text has been used to watermark Gemini and Gemini Advanced. That makes it one of the clearest public examples of text watermarking moving from academic proposal to large scale product deployment. 

7. Method 5: Distortion-Free Watermarks 

Some watermarking methods aim to avoid changing the distribution of generated text. This is important because a watermark that changes the output distribution can, in principle, affect quality, style, fairness, or downstream behavior. 

Kuditipudi, Thickstun, Hashimoto, and Liang's "Robust Distortion-Free Watermarks for Language Models" proposes watermarking based on mapping randomized keys to samples from the language model. Detection aligns the observed text with the random sequence known to the detector. The TMLR abstract reports robustness to substantial random edits in some model settings and also notes harder detection in lower-entropy instruction-following outputs. 

The conceptual difference: 

‍

Distortion-free designs are attractive because they address a key criticism of text watermarks: if the generator changes token probabilities, it may change output style or quality. However, they are more complex, and practical robustness depends on model entropy, generation length, edit model, and detector calibration. 

8. Method 6: Data-Driven and Backdoor Watermarks 

Data-driven watermarking does not necessarily mark every output. Instead, a model may be trained or fine-tuned so that certain triggers cause distinctive behavior. This is sometimes discussed as a watermark of the model rather than a watermark of every generated document. 

Example: 

Trigger prompt pattern: 
"Please answer using the private evaluation style X." 

Expected marked behavior: 
The model emits a known phrase pattern, formatting style, or token behavior. 

‍

This can help identify unauthorized model copies or misuse, but it is not a good general-purpose label for ordinary AI-generated text. If the trigger is never used, the output may not contain the signal. If the trigger leaks, adversaries can test or avoid it. The Nature SynthID paper distinguishes data-driven watermarking from generative and edit-based approaches, and notes that data-driven methods are oriented toward different attribution goals.

9. Method 7: Metadata, Signatures, and Text Provenance 

Metadata is often discussed with watermarking but should be separated from it. 

Metadata-based provenance attaches information outside the plain text. Examples include: 

‍

Metadata can be signed, versioned, and expressive. It can record which tool created or edited content, when it was processed, and what actions occurred. C2PA is the major open standard for media provenance and is widely used for images and audiovisual media. Anthropic's Claude Help Center says supported generated file types such as .svg , .png , and .jpg will receive signed provenance metadata using C2PA. OpenAI similarly describes C2PA and SynthID as complementary provenance signals for images. 

For text specifically, metadata has a major weakness: plain copy-paste loses it. If a model writes a paragraph in a chat window and the user pastes it into another editor, document-level metadata does not travel with the paragraph unless the receiving system preserves a signed wrapper or provenance envelope. 

This leads to an important distinction: 

Text watermark: 
The signal is in the text itself. 

Text metadata: 
The signal is attached around the text. 

Best practice: 
Use both where possible, but interpret each separately. 

‍

10. Image and Audio

‍

The key difference from text is that images and audio provide continuous signal space. Small changes can be embedded below human perception thresholds. Text lacks that continuous substrate, so robust text watermarking usually relies on statistical choices over tokens rather than tiny hidden perturbations. 

References 

1. Anthropic, "How Claude marks AI-generated content," Claude Help Center. 

2. Google DeepMind, "Watermarking AI-generated text and video with SynthID," May 14, 2024. 

3. Sumanth Dathathri et al., "Scalable watermarking for identifying large language model outputs," Nature 634, 818-823, 2024.

4. Google DeepMind, synthid-text reference implementation.

5. John Kirchenbauer et al., "A Watermark for Large Language Models," ICML 2023. 

6. Rohith Kuditipudi et al., "Robust Distortion-Free Watermarks for Language Models," TMLR 2024. 

7. Hanlin Zhang et al., "Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models," ICML 2024. 

8. OpenAI, "Understanding the source of what we see and hear online," May 7, 2024; update August 4, 2024. 

9. OpenAI, "Advancing content provenance for a safer, more transparent AI ecosystem," May 19, 2026.

10. C2PA Technical Specification. 

11. guillaumemeyer/watermarks-remover