What Is SynthID Text? How LLM Watermarking for AI Text Works, Setup and Detection

Can text written by AI be identified later as "written by AI"? AI detection tools that guess from the characteristics of the writing are prone to misjudgments, so an approach of adding an invisible watermark at the moment the AI generates the text is being researched and put into practice. Watermarks added to the output of LLMs (large language models) like this are also called LLM watermarking. The leading example is Google DeepMind's SynthID Text. Based on the official documentation and the Nature paper, this guide covers how SynthID Text works, its impact on quality, how developers can use it, how detection works and where it struggles, as of October 9, 2026.

For SynthID as a whole, including images, video and audio, see "What is SynthID?".

What SynthID Text is

SynthID Text is a technology for adding a watermark to text generated by a large language model (LLM) and detecting it later. Among LLM watermarking methods, it is a leading implementation that is used at scale in real services and is available to anyone as open source. Google DeepMind developed it and released it as open source on October 23, 2024, at the same time as publishing the method as a paper in the scientific journal Nature.

What sets it apart is that, rather than inserting symbols or invisible characters into the text, it leaves the watermark in which words the AI chooses. Reading the text, you cannot tell it apart from ordinary writing, and Google says it does not affect the quality of the text.

When the paper was published, Google stated that Gemini's responses also carried SynthID Text watermarks. As of October 2026, we have not been able to find any newer official statement on how it is currently handled in Gemini.

It is also used outside Google. In August 2026, Anthropic explained that the watermark in text generated by Claude is "based on the SynthID Text method."

How it works: leaving a watermark in word choice

When an LLM writes, it repeatedly assigns a probability to each candidate for the next word (strictly speaking, the next token) and picks one of them. SynthID Text intervenes at this "picking" step.

The Nature paper calls this method tournament sampling. In simplified form, the process is:

Draw several candidates for the next word according to the LLM's probabilities
Have the candidates compete in a knockout tournament. The winner of each match is decided by a score (the g-function) calculated from a secret key and the preceding few words
The candidate that wins through several rounds becomes the word actually output

Because the candidates come from words the LLM was likely to choose anyway, the text remains natural. On the other hand, when someone who knows the key recalculates the scores, they can see that the output words skew toward higher-than-average scores. That skew is the watermark.

Google's developer documentation describes it as a "logits processor" applied after the usual candidate filtering such as Top-K and Top-P. It also avoids watermarking repeated phrases, to keep the watermark easy to detect.

Impact on quality and speed

A key feature of SynthID Text is that it has been validated at scale in a real service. The Nature paper compares watermarked and unwatermarked responses across about 20 million Gemini responses.

The difference in the share of positive ratings from users was 0.01%, and in the share of negative ratings 0.02%, showing almost no difference in quality

In a separate speed measurement, adding the watermark increased generation time by only about 0.57%.

In addition, the LLM does not need to be retrained; it can be used just by changing the text generation procedure. The original LLM is not needed for detection either.

How developers can use it

SynthID Text is built into Hugging Face's Transformers library (version 4.46.0 and later). It is also available in Google's Responsible GenAI Toolkit and on GitHub at google-deepmind/synthid-text. The GitHub code is under the Apache 2.0 license and is positioned as a reference implementation for reproducing the paper. For production use, developers are directed to use the official Transformers implementation.

With Transformers, you create a watermarking configuration (SynthIDTextWatermarkingConfig) and pass it to the text generation function. The main settings are:

keys (required): a list of random integers that serve as the watermark key. If leaked, the watermark could be forged, so keep them secret
ngram_len (required): the number of preceding words used to calculate the score. Larger values make detection easier; smaller values make the watermark more robust to rewriting. The official recommendation is a default of 5
sampling_table_size: the size of a table used internally. To avoid bias, 2 to the 16th power (65536) or more is recommended
sampling_table_seed: the random seed used to build the table. Any integer will do
context_history_size: the amount of context recorded to detect repetition. The default is 1024

Sample code showing how to write the configuration is available in the official Transformers documentation.

How to detect the watermark

Detecting the watermark requires the same key configuration and the same tokenizer used when the text was generated. As a result, only the party that added the watermark (or someone they have shared the key with) can detect it.

The official implementation offers three detection methods: one using the mean score, one using a weighted mean, and a trained Bayesian detector. The Bayesian detector returns one of three results, "watermarked," "not watermarked" or "uncertain," and its strictness can be tuned with two thresholds.

The Bayesian detector must be trained on your own model and key before use, and Hugging Face's write-up says at least 10,000 examples are needed. In addition, according to Google's developer documentation, you can choose from three options for how widely to make the detector available: use it only internally, offer it externally as an API, or distribute the detector itself.

Note that there is no guidance saying a watermark added with your own key can be detected by Google's SynthID Detector or similar tools.

Where it struggles and its limits

Google's developer documentation and the Nature paper list the following limitations.

Factual responses: for questions with essentially one correct answer, there is little room to vary word choice, so the watermark is less effective
Heavy rewriting: thoroughly rewriting the text greatly reduces detection confidence
Translation: translating into another language greatly reduces detection confidence
Deliberate attacks: protecting against malicious parties trying to remove the watermark is not a design goal
Open models: with models anyone can run, it is hard to enforce watermarking

How it differs from AI text detectors

Besides watermarks like SynthID Text, another way to identify AI-written text is AI detection tools, which estimate how AI-like a piece of writing is from its characteristics.

Watermarks: the generating side adds a mark in advance. With the key, you can make a well-grounded judgment, but AI text without a watermark cannot be identified
AI detection tools: can make an estimate for text from any AI, but it is only an estimate, and human-written text may be misjudged as AI

Efforts to mark AI output are spreading to other companies as well. For example, Anthropic adds a watermark based on the SynthID Text method to text generated by Claude (detection is currently a private preview limited to regulators and similar bodies). OpenAI also announced its own text watermark, "textGrain", in October 2026. A comparison of methods is covered in detail in "AI watermarks compared".

Summary

SynthID Text marks AI-written text in a way readers will not notice, by leaving a watermark in the process by which the AI chooses words. Validation on about 20 million Gemini responses showed almost no impact on quality, and a separate measurement found only a minimal impact on speed. It has been released so that anyone can use it through Transformers.

On the other hand, it is weak against short factual answers, translation and heavy rewriting, and only the party that added the watermark can detect it. It is better understood not as a decisive way to identify AI text, but as one mechanism for taking responsibility for your own AI's output.