SynthID Watermarking and Removal Methods are a Joke. And You Are Misunderstanding How it All Works Completely.

Last Updated on August 19, 2026 by Editorial Team Author(s): Vektor Memory Originally published on Towards AI. Custom code generated image Like this: The model would normally pick any of: [‘signature’, ‘mark’, ‘trace’, ‘fingerprint’]watermark nudges it to pick: signature score of the word actually used: 87score of a word that lost: 71 A statistical bias buried in the choice of “somewhere” over “somewhere else,” or “signature” over “mark.” You would never notice it, as you are a human meat popsicle, not a binary code wizard LLM with SynthID and oodles of books from Libgen. Neither would a spellchecker, a copy-paste, or a screenshot. But a machine holding the right key could look at that sentence and tell you, with real confidence, that it came from a specific model. Also, you don't have access to the key to decode. Sorry! This is not science fiction. As of August 2, 2026, Claude does this to every sentence it writes. So does Gemini. The reason is a piece of European law, and the mechanism is a 2024 Nature paper that most people who are affected by it have never read. I want to walk through exactly how this works, why it exists now, what it can and can’t tell anyone, and what happens when people try to strip it out. Along the way I’ll clear up a few things that get misconstrued every time this topic comes up online, including the idea that uploading text to the internet triggers some kind of automatic AI-detection scan. It doesn’t. Nothing does that. Not yet, and not the way people picture it or place it on GitHub to remove it. The paper that started this In October 2024, a team at Google DeepMind led by Sumanth Dathathri and Abigail See published a paper in Nature called “Scalable watermarking for identifying large language model outputs.” The system they described is called SynthID-Text, and it solved a problem that had stalled watermarking research for years: how do you mark AI-generated text without making it worse, without slowing it down, and without needing to store a copy of everything the model ever said. Before SynthID-Text, the field had roughly three options, and all of them had real drawbacks. Keep a growing database of everything the model generated and check new text against it, which raises obvious privacy problems and needs infrastructure that scales with usage forever. Train a separate classifier to spot the statistical “flavor” of AI writing, which is the approach behind most of the AI detection tools you’ve probably already used and distrusted, and for good reason: those tools are known to misfire on non-native English writers and degrade as models improve. Or edit the text after it’s generated, swapping in synonyms or inserting invisible characters, which leaves traces a careful reader or a decent script can find and strip. SynthID-Text took a different approach entirely. Instead of marking the text after it exists, it changes how the text gets chosen in the first place. How a language model actually picks its next word To understand the watermark, you need to understand what happens underneath every response a model gives you. An LLM doesn’t write a sentence the way a person does, deciding on a whole thought and typing it out. It predicts one token at a time. Given everything written so far, it calculates a probability for every possible next token, something like a 40% chance the next word is “the,” a 12% chance it’s “this,” and so on across the entire vocabulary. Then it samples from that distribution and moves to the next position. Normally, that sampling step is close to random, shaped by settings like temperature that control how adventurous or predictable the choices are. SynthID-Text inserts itself right there, at the moment of sampling, and quietly tilts the odds. Here’s the mechanism, as described in the paper’s Methods section. For each token position, a hash function takes the last four tokens of context plus a secret key and produces a random seed. That seed feeds a set of pseudorandom scoring functions, the paper uses 30 of them, called “layers.” Each function assigns a score to every possible next token. Then, instead of sampling once from the model’s distribution, the algorithm samples several candidate tokens and runs them through what the authors call Tournament sampling: a knockout bracket. Candidates get paired up, the higher-scoring one under the first scoring function survives, the survivors get paired again and scored by the second function, and so on through all 30 layers until one token wins and becomes the actual output. The result is a sequence of words that a reader can’t distinguish from an unwatermarked response, but that carries a statistical fingerprint recoverable by anyone holding the key. Detection doesn’t need the model at all. You just take the text, recompute the same seeds and scores using the key, average them, and compare the result to a threshold. Higher than chance, probably watermarked. Around chance, probably not. The paper is careful about a property it calls “non-distortion.” Configured one way, called single-token non-distortionary, the tournament always has exactly two competitors per match, and DeepMind proves mathematically that this leaves the model’s actual output probabilities unchanged on average. The watermark rides on which specific token gets picked among equally likely options, not on making some tokens artificially more likely overall. That’s the whole trick: real bias in individual choices, zero bias in the aggregate. Twenty million responses, and nobody could tell Claims about quality preservation are easy to make and hard to trust, so DeepMind ran an actual test in production. They routed a portion of live Gemini traffic through the watermarked model and an equal portion through the unwatermarked version, then compared the thumbs-up and thumbs-down rates people gave each. Across close to 20 million responses, the difference in thumbs-up rate was 0.01 percent. The difference in thumbs-down rate was 0.02 percent. Both fell well inside the statistical noise. They backed that up with a […]