AI Text Watermark: How Statistical Watermarking Works

An AI text watermark works inside the model's sampling step, biasing which word gets picked rather than adding anything to the text. A language model doesn't pick one correct next word. At every step it produces a probability distribution over plausible candidates, and sampling picks one of them.

A text watermark sits inside that sampling step. Before a token is chosen, the scheme pseudorandomly splits the vocabulary into a favored sublist and a disfavored one, seeded by prior tokens or a secret key, then nudges sampling toward the favored side.

Nothing gets added to the output. The model writes ordinary prose, just with a faint statistical lean baked into which words it happened to choose.

That idea traces to Kirchenbauer, Geiping, Wen, Katz, Miers, and Goldstein's 2023 paper, cited roughly 984 times and the scheme most later work responds to. It splits each token's candidates into a green sublist and a red sublist, softly biases sampling toward green, and detects the mark with a statistical test on green-token frequency, with no access to the original model needed at detection time.

SynthID Text builds on that same sampling bias with a more elaborate procedure the peer-reviewed Nature paper calls tournament sampling, where candidate tokens compete across sampling rounds before one is picked.

Google reports testing it in a live experiment across the Gemini app and web experience, gathering feedback on a figure widely cited as nearly 20 million responses. It found no detectable drop in output quality.

It's also open-sourced. A production-grade implementation ships in Hugging Face Transformers from v4.46.0, with a reference Bayesian detector that returns one of three verdicts: watermarked, not watermarked, or uncertain.

A watermark detector needs the specific scheme, its configuration, and enough text to produce a meaningful score. No detector is universal.

Short, factual answers give it the least to work with. Google's own documentation says watermark application is less effective there, precisely because there's less room to change wording without hurting accuracy.

The clearest number doesn't come from SynthID Text at all, since Google hasn't published an equivalent figure. It comes from a 2024 stress test of the original green list, red list scheme.

Kirchenbauer and coauthors attacked that scheme three ways:

• Human rewriting
• LLM-generated paraphrasing
• Dilution inside longer mixed documents

It stayed statistically detectable after strong human paraphrasing once a detector could examine roughly 800 tokens, at a false-positive rate of one in 100,000.

Treat that as evidence about the general approach's staying power. It is not a guarantee that transfers word for word to SynthID Text or to Claude's watermark.

SynthID Text is robust to mild paraphrasing, but detector confidence can be greatly reduced by thorough rewriting or translation, a central weakness Google's own documentation already concedes.

Sadasivan and coauthors' widely cited 2023 paper goes further, arguing on theoretical grounds that watermarking and other AI-text detectors aren't reliable against a genuinely motivated paraphraser. Broader surveys of the field single out robustness under adversarial editing as its central unsolved challenge, not a footnote.

Because SynthID Text is open-sourced, outsiders can test it directly rather than take Google's word, and several have:

• A peer-reviewed 2025 study (IEEE TrustCom) found paraphrasing, copy-paste splicing, and back-translation all measurably degraded detection. The same researchers' hybrid defense improved detection F1 by an average of 11.1% over the vanilla scheme.
• A 2026 preprint went after the detection math itself, proving the default mean-score detector becomes more vulnerable as more of SynthID Text's internal sampling layers are used, while the alternative Bayesian scoring method already built into the system holds up better against that specific attack.

None of this is a working bypass anyone can point to with confidence, and none of it makes the watermark bulletproof either. Heavy rewriting and translation reliably weaken the statistical signal, sometimes a lot, but weakened and gone are different claims, and no independent study has shown a paraphrase attack that defeats SynthID Text every time.

Watermarking a model's text output requires the provider's cooperation. There's no way to add it from outside once the text exists.

OpenAI reportedly built an internal ChatGPT text-watermarking system rated around 99.9% effective, according to leaked internal documents reported by the Wall Street Journal, years before Anthropic's Claude rollout. Per that reporting, it held the system back over three concerns:

• Circumvention risk
• False positives
• Disproportionate impact on non-native English writers

Internal survey data reportedly showed roughly 30% of users would use ChatGPT less if it shipped.

There's also a structural limit no policy decision fixes. Once open-weight models ship, whoever runs the model controls decoding, so the original provider can't apply sampling-time watermarking to them at all.

SynthID Text is open-sourced partly for that reason: anyone operating a deployment can switch it on. Whether they do is a property of that deployment, not of the underlying model.