How does Google SynthID detect AI-generated content?

Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.

1. 1

   On Google's SynthID-Text LLM Watermarking System: Theoretical Analysis and Empirical Validation

   arXiv (Cornell University) (Omidi et al.)Published Mar 3, 2026Checked Oct 8, 2026

   “The system's innovation lies in: 1) a new Tournament sampling algorithm for watermarking embedding, 2) a detection strategy based on the introduced score function (e.g., Bayesian or mean score), and 3) a unified design that supports both distortionary and non-distortionary watermarking methods. This paper presents the first theoretical analysis of SynthID-Text, with a focus on its detection performance and watermark robustness, complemented by empirical validation. For example, we prove that the mean score is inherently vulnerable to increased tournament layers, and design a layer inflation attack to break SynthID-Text. We also prove the Bayesian score offers improved watermark robustness w.r.t. layers and further establish that the optimal Bernoulli distribution for watermark detection is achieved when the parameter is set to 0.5. Together, these theoretical and empirical insights not only deepen our understanding of SynthID-Text, but also open new avenues for analyzing effective watermark removal strategies and designing robust watermarking techniques. Source code is available at https: //github.com/romidi80/Synth-ID-Empirical-Analysis.”

2. 2

   A Real-World Robustness Evaluation of AI-Image Provenance: Comparing C2PA Content Credentials and the SynthID Watermark Across Consumer Editing and Social-Media Pipelines

   Zenodo (CERN European Organization for Nuclear Research) (Sundaramoorthy)Published Sep 13, 2026Checked Oct 8, 2026

   “We take ten AI images (five from ChatGPT/DALL-E and five from Google Gemini) and pass each one through four everyday actions (a Canva export, a screenshot, a WhatsApp transfer, and an Instagram post), first one at a time and then in chains of several actions. At every step, we measure the C2PA metadata and the pixel change with two small open-source Python tools, and we check the SynthID watermark with both companies' own detectors: the Gemini app and OpenAI Verify. The C2PA metadata is removed by the first action every time (survival rate 0 across fifty post-processing checks). The SynthID watermark survives every action and every chain for both companies, when read by that company's own detector. The key result concerns detection: each detector reads only its own company's watermark, so no single public tool reads both, and a "not detected" answer cannot be trusted to mean "not AI." We conclude that metadata-based provenance does not work in real use, that the pixel watermark is robust for both companies, but that provenance still fails as a usable system because detection is split across companies with no shared detector.”

3. 3

   AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation

   arXiv (Cornell University) (Tamim & Khan)Published Jul 17, 2026Checked Oct 8, 2026

   “We focus on meaning-preserving paraphrase as the attack vector, since it is both legally realistic and difficult to dismiss as evidence tampering. The results raise serious evidentiary concerns. Out of 846 valid paraphrase runs across 15 diverse prompts per method, every single initially-detected KGW and Unigram text lost its watermark after paraphrasing -- 100% conditional removal. SynthID fared only slightly better at 98.3%. Even before any attack, false-negative rates were already high: 70% for KGW, 83% for Unigram, 80% for SynthID. The SynthID configuration also flagged 5.4% of paraphrased human-written controls as AI-generated and showed an 18.6% paradox rate, with 80% of its own pristine watermarked output landing in the uncertainty deadband. None of the three methods satisfy more than two of five Daubert factors. We also find that the FRS point-based scoring system, despite working as designed, cannot fully capture forensic uselessness -- a limitation worth noting for future framework design. These configurations, as tested, do not meet the evidentiary bar that courts require.”

4. 4

   On the Empirical Power of Goodness-of-Fit Tests in Watermark Detection.

   Advances in neural information processing systems (He et al.)Published Jan 1, 2025Checked Oct 8, 2026

   “Large language models (LLMs) raise concerns about content authenticity and integrity because they can generate human-like text at scale. Text watermarks, which embed detectable statistical signals into generated text, offer a provable way to verify content origin. Many detection methods rely on pivotal statistics that are i.i.d. under human-written text, making goodness-of-fit (GoF) tests a natural tool for watermark detection. However, GoF tests remain largely underexplored in this setting. In this paper, we systematically evaluate eight GoF tests across three popular watermarking schemes, using three open-source LLMs, two datasets, various generation temperatures, and multiple post-editing methods. We find that general GoF tests can improve both the detection power and robustness of watermark detectors. Notably, we observe that text repetition, common in low-temperature settings, gives GoF tests a unique advantage not exploited by existing methods. Our results highlight that classic GoF tests are a simple yet powerful and underused tool for watermark detection in LLMs.”

5. 5

   Watermarking across Modalities for Content Tracing and Generative AI

   arXiv (Cornell University) (Fernandez)Published Feb 4, 2025Checked Oct 8, 2026

   “The contributions of this thesis include the development of new watermarking techniques for images, audio, and text. We first introduce methods for active moderation of images on social platforms. We then develop specific techniques for AI-generated content. We specifically demonstrate methods to adapt latent generative models to embed watermarks in all generated content, identify watermarked sections in speech, and improve watermarking in large language models with tests that ensure low false positive rates. Furthermore, we explore the use of digital watermarking to detect model misuse, including the detection of watermarks in language models fine-tuned on watermarked text, and introduce training-free watermarks for the weights of large transformers. Through these contributions, the thesis provides effective solutions for the challenges posed by the increasing use of generative AI models and the need for model monitoring and content moderation. It finally examines the challenges and limitations of watermarking techniques and discuss potential future directions for research in this area.”

6. 6

   SoK: Watermarking for AI-Generated Content

   arXiv (Cornell University) (Zhao et al.)Published Nov 27, 2024Checked Oct 8, 2026

   “These schemes embed hidden signals within AI-generated content to enable reliable detection. While watermarking is not a silver bullet for addressing all risks associated with GenAI, it can play a crucial role in enhancing AI safety and trustworthiness by combating misinformation and deception. This paper presents a comprehensive overview of watermarking techniques for GenAI, beginning with the need for watermarking from historical and regulatory perspectives. We formalize the definitions and desired properties of watermarking schemes and examine the key objectives and threat models for existing approaches. Practical evaluation strategies are also explored, providing insights into the development of robust watermarking techniques capable of resisting various attacks. Additionally, we review recent representative works, highlight open challenges, and discuss potential directions for this emerging field. By offering a thorough understanding of watermarking in GenAI, this work aims to guide researchers in advancing watermarking methods and applications, and support policymakers in addressing the broader implications of GenAI.”