What is SynthID? How Google's AI watermarking works

Product access and documentation checked on 25 October 2026. This is an independent explanation based on the primary sources below, not a laboratory evaluation of SynthID. External references open in a new tab.

How does SynthID watermark AI-generated content?

SynthID places a signal into content through an integrated watermarking process, then uses a compatible detector to look for that signal later. This is different from inspecting an arbitrary file and guessing whether it resembles previous AI outputs. A watermark has to have been embedded in the first place. Google DeepMind introduced SynthID for Imagen images in August 2023 and subsequently extended the approach to other media and text. [2] [1]

“Invisible” does not mean a hidden logo in a corner, and it does not mean an extra EXIF field. The signal is encoded in the content. For media, that can let it survive the loss of ordinary file metadata. Each modality needs a different method, so SynthID is better understood as a family of watermarking techniques than one identical mark applied to every format.

Images: a signal inside the pixels

For images, the watermark is embedded directly in pixel values. Google DeepMind's original description uses two jointly trained models: one embeds the watermark and the other detects it. Training balances detection, resistance to common modifications, and keeping the change visually imperceptible. A detector is looking for the learned signal, not for a visible symbol or a particular kind of hand, face, or background. [2]

Google describes resilience to operations such as color adjustment, filters, and lossy compression. That is useful because images are routinely resized and re-encoded when shared. It is not a promise that every crop, screenshot, or sequence of edits will preserve enough signal. Google explicitly cautions that extreme manipulation can defeat detection. [2] [8]

Video: detection across frames and segments

Google's 2024 technical explanation describes embedding the watermark in every generated video frame. The current product overview also describes resistance to modifications such as frame-rate changes and compression. A video detector can report portions of a clip where a watermark is found, which matters when a video mixes generated and other material. [3] [1]

A timestamp range is not a forensic explanation of every object within those frames. Gemini's documentation warns that a reported video portion does not necessarily mean a watermark was detected in every part of that portion. A reviewer should not turn a segment-level result into a claim that the entire video, or every visible element, is synthetic. [8]

Audio: an inaudible signal in the sound

For audio, Google DeepMind describes converting sound into a spectrogram, a representation of how frequency content changes over time, to embed a watermark that people should not hear. Its Lyria announcement describes detection after common changes including added noise, MP3 compression, and changes in playback speed. The same announcement explains that detection can identify watermarked portions within a track. [5]

The current SynthID overview identifies Lyria music and NotebookLM podcast generation as audio applications. Those are documented deployments, not evidence that every synthetic voice or music generator on the internet uses SynthID. A detection result also says nothing by itself about a musician's permission, voice consent, or licensing rights. [1]

Text: a statistical signature in token selection

SynthID Text works during generation. A language model produces text by choosing tokens, which can be words, parts of words, or other units. For each step it assigns probabilities to possible next tokens. SynthID changes the sampling process so that the sequence carries a statistical pattern that a detector can later test. It is not based on inserting invisible Unicode characters or placing a metadata tag in a document. [3] [4]

The research describes a method called Tournament sampling. In simplified terms, candidate tokens are selected using a sequence of watermark-dependent comparisons. Choices are still constrained by the model's plausible output distribution; the aim is to leave a detectable pattern without noticeably changing the response. Detection can score the resulting token sequence without running the original language model. Compatible tokenization and watermark configuration still matter. [4] [9]

What does the SynthID Text research actually demonstrate?

The 2024 Nature paper, “Scalable watermarking for identifying large language model outputs,” reports evaluations across multiple language models, standard capability benchmarks, human comparisons, and a live experiment involving feedback on nearly 20 million Gemini responses. The researchers found no detectable deterioration in text quality in that live assessment.

That is evidence about the feasibility and quality impact of the tested deployment. It is not a finding that a public detector correctly classified 20 million arbitrary essays, and it is not an accuracy guarantee for every language, model, or edited document. The paper also distinguishes configurations intended to preserve output quality from settings that favor stronger detection at a quality cost. Those choices need to be understood before comparing results.

Text watermarking needs enough opportunities to influence token choices. A long, varied explanation offers more than a short fixed answer such as the name of a country's capital. Google says detection can tolerate some cropping, small edits, and mild paraphrasing, but confidence can fall sharply after substantial rewriting or translation. Quoted passages and highly constrained responses also give watermarking less room to operate. [3]

This creates an important asymmetry: detecting a compatible watermark can be useful evidence, while failing to detect it says much less. It is especially unsafe to treat the absence of a signal in a short or heavily edited passage as proof of how the passage was written.

Where can you check for a SynthID watermark?

The public SynthID Detector

Google announced broader public access to SynthID Detector on 7 October 2026, describing a global English-language rollout. The announcement names Google and partners including OpenAI, NVIDIA, and Kakao, and describes Apple support as forthcoming. The portal itself currently lists images, video, and audio as its three supported content types. [7] [6]

Partner participation must not be read as blanket historical coverage. It does not establish that every model, product, version, or past output from a named company carries a compatible watermark. Check the current service documentation and the particular generation product before making a more specific attribution.

Verification inside Gemini

Gemini also offers media verification. Its support page currently says that, although other companies have adopted SynthID, Gemini's SynthID check recognizes content from Google's AI tools. That scope is narrower than the partner coverage described for the standalone detector. Gemini can additionally inspect supported Content Credentials, which is a different source of provenance information. [8]

At the time of this review, Gemini documents one file per check, a maximum file size of 100 MB, video shorter than 90 seconds, and audio shorter than one hour. Account requirements, quotas, supported formats, and rollout details can change. Consult the current Gemini instructions rather than assuming the standalone portal has identical limits.

In Gemini, ask a specific question such as “Was this image created or edited by Google AI?” Check whether the answer reports an actual SynthID verification result, Content Credentials, or only a general discussion of the image. Those are not interchangeable findings.

What does a SynthID detection result mean?

Watermark detected

A compatible embedded signal was found. The public detector describes this as indicating that the content was likely generated or edited by a SynthID-enabled AI model. Preserve the exact result and its scope; do not automatically attribute the whole file, a named person, or a specific product unless the result supports it.

Watermark not detected

No sufficiently confident compatible signal was found in the submitted version. It may be non-AI content, but it may also come from an unsupported model, predate watermark adoption, or have undergone changes that weakened the signal. “Not detected” does not mean “authentic photograph” or “human-written.”

Unclear, unsupported, or insufficient signal

Record that the check did not resolve the question. Google's support documentation gives examples including simple content with too little detail and very small AI edits. An unavailable or inconclusive check is not a negative finding.

These interpretations follow the detector's guidance and Gemini's explanation of verification results. Neither service should be treated as infallible. The portal acknowledges that rare false positives can occur. Detector scores and thresholds need their own evaluation; a high score is not automatically a calibrated probability that an allegation is correct.

A genuine photograph can carry a false caption. A generated illustration can accurately explain a real process. A real photograph edited with an AI tool may retain a truthful overall context while still carrying an AI-related signal. Watermarking concerns the production process. Fact-checking concerns what is being asserted.

What are useful, practical applications of SynthID?

The following are suggested workflows grounded in documented capabilities, not claims that specific newsrooms, schools, or brands have adopted them.

1. Newsrooms and fact-checkers reviewing a viral image

A reporter receives an image claiming to show a recent flood. A SynthID check can help establish whether the file contains a compatible generative-AI watermark before publication. The reporter should still find the earliest upload, check the alleged place and date, contact relevant sources, and compare independent reporting. A negative watermark result cannot confirm the flood or the photograph. Google's original image work and the current detector documentation explain the relevant capability and its limits. [2] [6]

2. Brands reviewing creative assets from agencies

A marketing team can use a watermark check as one part of reviewing whether an asset involves supported AI tools. The result may help start a precise conversation with the agency about creation and editing. It should sit alongside the supplier's disclosure, the original file, edit history, and rights documentation, not replace them. SynthID does not establish commercial-use permission or who owns the depicted material. [1] [8]

3. Audio producers checking music or synthetic podcast material

A producer who receives an unfamiliar track can check for supported AI audio before deciding how to label or investigate it. Lyria and NotebookLM are documented examples of SynthID use. Segment-level detection may help identify where further review is needed in a longer mix, but it cannot establish who performed a voice or whether permission was obtained. The relevant technical grounding is Google's audio watermarking explanation and current product overview.

4. Platforms triaging generated or AI-edited video

A trust-and-safety reviewer can use a detected signal as one input when deciding whether an upload needs a disclosure label or closer review under the platform's rules. For a mixed clip, review the returned time ranges rather than labeling every frame identically. Test the workflow on representative content and provide human review for consequential decisions. Do not assume the consumer detector's interface is a permitted bulk API. [3] [8] [6]

5. Education and research, with appropriate safeguards

Researchers can use SynthID Text's reference implementation to study generation-time watermarking on models they control. That is a different activity from submitting a student's essay to a universal AI checker. A watermark result should never be the sole basis for a misconduct finding: mixed authorship, editing, tool coverage, and false positives all need investigation, and the writer needs a fair opportunity to respond. The research paper and reference repository explain the technical scope, not an academic disciplinary standard.

How is SynthID different from C2PA and general AI detectors?

SynthID and C2PA can complement each other. An embedded signal may remain detectable after ordinary metadata is lost. Valid Content Credentials may provide a richer account of creation and editing than a watermark alone. Google distinguishes these two technologies in its verification documentation; the SynthID portal separately explains the distinction from general AI detection.

For a fuller explanation of signed provenance, read our guide to C2PA and Content Credentials. Provenance AI's C2PA reader inspects Content Credentials. It does not perform SynthID watermark detection. Finding no credentials in that reader does not establish that no SynthID watermark exists.

How should you use SynthID in a verification workflow?

1. Preserve the submitted version. Keep the highest-quality available file, its source URL, the surrounding claim, and the time you received it. Keep a hash where your evidence-handling process supports one.
2. Separate the questions. “Was AI involved?” is different from “Did this happen in this location yesterday?” State both questions instead of letting one detector result answer everything.
3. Check permission before uploading. Review privacy, confidentiality, consent, and any organizational restrictions. Sensitive evidence may require an approved environment rather than a consumer service.
4. Choose a tool with the right scope. Check the current partner coverage and file requirements. Do not assume that Gemini, the public detector, and a research text detector offer the same capabilities.
5. Record the exact result. Save the service name, date, submitted file version, returned wording, and any time ranges or qualifications. Distinguish “not detected” from “not checked.”
6. Corroborate independently. Inspect available Content Credentials, reverse-search the media, locate the original publication, and verify the claim with relevant primary sources. Preserve disagreements between signals rather than hiding them.
7. Publish only the supported conclusion. Describe the finding and its limits in plain language. For consequential decisions, obtain a second review and maintain a correction path.

An example reporting template, not a quotation from a detector:

We checked the supplied file with [service] on [date]. The service reported [exact result] for [file or segment]. This concerns a compatible AI watermark, not the truth of the accompanying claim. We separately checked [sources and context]. Remaining uncertainty: [what is unresolved].

This makes the check inspectable. “Our AI detector says it is fake” does not. Our claim-checking method note explains why the original claim, evidence, and reasoning should remain separate.

What limitations, privacy issues, and developer constraints matter?

Robust does not mean unremovable

SynthID is designed to withstand common transformations, not every possible adversarial alteration. Multiple edits and substantial content changes can reduce detectability. Text translation or extensive rewriting is particularly important because the watermark depends on the generated token sequence. Different file types and versions need separate testing. Do not transfer a robustness claim from an image demonstration to a text or audio workflow. [2] [3] [6]

A watermark is not identity, consent, or chain of custody

A positive result does not identify the person who wrote a prompt, prove the identity of an uploader, recover the original prompt, establish copyright ownership, or reconstruct every edit. Those require other records. Likewise, the presence or absence of a watermark does not decide whether a use complies with a law, contract, or platform policy.

Coverage gaps also matter over time. A provider adopting SynthID today does not retroactively watermark every file it created in the past. A mixed-media file may contain both marked and unmarked material. Treat provider, product, output date, and submitted version as relevant context, not administrative details.

Understand what happens to uploaded evidence

The public portal's current privacy notice says original media is deleted after results are returned, while a digital signature mapped to the user is retained for anti-abuse purposes and deleted after 24 hours. That is the portal's stated policy at the time of review, not a general description of Gemini or every Google service. Read the applicable privacy notice and terms before uploading restricted material. Account information, organizational obligations, and third-party rights still need consideration.

Open-source text research is not an unrestricted detector API

The SynthID Text repository provides an Apache-licensed reference implementation associated with the Nature research. Its documentation explicitly says the reference code is not intended for production use. Detection requires compatible settings, and the research implementation does not grant access to Google's private production configurations or turn arbitrary text into a reliably attributable output.

Developers should distinguish the published research, experimental code, consumer verification interfaces, and any separately authorized integration. The public detector's terms prohibit bypassing its interface for automated bulk submissions and using its feedback to attack the watermarking system. Do not build a production service by scraping the portal or assume that public access means a public automation API. [6]

Before adopting watermarking in a product, evaluate detection and false-positive rates on the material your users actually submit, including short, edited, and mixed content. Define when the product abstains, who reviews disputed results, and how people can challenge an incorrect decision. A benchmark score is not a substitute for that operational design.

Common questions about SynthID

The practical conclusion

SynthID can provide useful evidence of AI involvement when a compatible watermark is present. Its value is strongest when the result is narrowly described and combined with provenance records and independent checking. The wrong question is whether one tool can pronounce a file “real.” The useful questions are what signal was found, what the tool covers, which version was checked, and what evidence supports the claim being made.