Gemini Watermark: Is Gemini Watermarked, and Where?

Google documents SynthID watermarking for Gemini's image, audio, and video output without qualification, and without any of the hedging that surrounds the text story.

A companion DeepMind paper on the image system alone, published on arXiv in October 2025, states it "has been used to watermark over ten billion images and video frames across Google's services." That's a Google-reported figure no third party has validated, though nobody disputes that the watermarking itself happens.

Google's consumer verification tool, reachable from the Gemini app, is scoped the same way:

• Checks images, video, and audio. Explicitly not text.
• Recognizes content created by Google AI tools only, per Google's own wording.
• Caps you at roughly 10 checks per type every 24 hours.

If you're trying to verify whether a picture or a clip came from a Google AI tool, that's the documented path, though an independent check in November 2025 found it reliable for images and hit-or-miss for audio and video. If you're trying to verify text, there is no equivalent tool at all.

Three Google surfaces address Gemini text and give three different answers. Google DeepMind's SynthID model page states it plainly: "We've expanded SynthID to watermarking and identifying text generated by the Gemini app and web experience." That's an official marketing claim, unqualified.

On August 5, 2026, a Google-affiliated account on the Google AI Developer Forum answered a narrow technical question about whether gemini-2.5-flash-lite and gemini-3.1-flash-lite output carries a machine-readable provenance signal under EU AI Act Article 50(2). The answer was a flat denial: "Generated text from the API is NOT SynthID-watermarked. There is no machine-readable providence [sic] signal... Native text watermarking is not planned at the moment."

Fourteen days later the same account withdrew it: "I need to post an important correction to my previous message: After checking further with the team, it turns out that text generated via the Gemini API IS actually SynthID-watermarked! I apologize for the confusion earlier, the previous statement was incorrect. This also applies to text generated through Google AI Studio and/or antigravity!"

Read what that does rather than what it settles. The correction is a new post, not an edit, so the denial is still live and still the first answer a reader meets. Neither post is marked as the thread's solution. The account's only visible credential is a forum user title reading Google, not a staff or moderator badge. And the correction now claims more than any Google documentation supports, where the denial claimed less: DeepMind's SynthID page still scopes text watermarking to "the Gemini app and web experience" and to consumer products, and Google's developer SynthID page, last updated in April 2025, does not mention the API at all.

A follow-up asking whether API text was always watermarked or whether it was switched on at some point has sat unanswered since August 19.

A third Google surface stays silent where it would matter. Google's own Gemini Apps help page for verifying AI content covers images, video, and audio and says nothing about text at all.

The most charitable reading is that the consumer-facing Gemini app and web chat apply SynthID Text while the developer API doesn't. That would track with how Google scoped its own verification tool, but it's an inference, and no primary source draws that line for current Gemini 3.x models.

Treat a flat "yes, Gemini text is watermarked" or "no, it isn't" as an incomplete answer until it specifies which surface generated the text.

Where SynthID Text does run, Google describes it as a logits processor applied during generation, after ordinary Top-K and Top-P sampling has narrowed the candidate tokens. The underlying Nature paper calls the technique tournament sampling.

That paper, authored by Google DeepMind researchers, reports a live Gemini app and web experiment across nearly 20 million responses that found no detectable drop in output quality from applying the watermark. It describes SynthID Text as productionized specifically for Gemini and Gemini Advanced.

Detection accuracy is commonly cited elsewhere as roughly 85% true positives at a 1% false-positive rate, against about 73% for prior schemes. Neither figure could be reconfirmed as a direct quote from the paper's own text, so both belong in the secondary column rather than the documented one.

The method has also been open-sourced, with a production-grade reference implementation shipping in Hugging Face Transformers since version 4.46.

Google documents the same robustness pattern independent researchers keep finding elsewhere, and it is more candid than most marketing copy. The signal survives cropping, a few changed words, and mild paraphrasing reasonably well. It is less effective on short factual answers, where there is little room to alter token choice without hurting accuracy. And confidence can be greatly reduced by thorough rewriting or translation.

Multiple independent teams have stress-tested SynthID Text since it launched, and the results complicate Google's framing.

• "Watermark under Fire" (EMNLP 2025 Findings, peer-reviewed) found its resilience to paraphrasing and translation attacks was "similar to" a much simpler, older green/red-list watermark, meaning no clear robustness advantage despite the more sophisticated design.
• "SynGuard" (IEEE TrustCom 2025, peer-reviewed) found SynthID Text "susceptible to meaning-preserving attacks, such as paraphrasing, copy-paste modifications, and back-translation," and built a hybrid defense that improved detection accuracy by an average of 11.1% over the vanilla version.
• A 2026 theoretical analysis proved that SynthID Text's mean-score detector becomes less reliable as more tournament-sampling layers are added, while the alternative Bayesian-score detector in the same system holds up better.

A 2026 preprint went further, testing an open-source SynthID Text reimplementation and reporting four results worth holding onto:

• 80% of untouched, genuinely watermarked passages fell into SynthID's own "uncertain" confidence zone.
• 98.3% of texts that were initially detected lost their signal after a single round of automated paraphrasing.
• 5.4% of paraphrased human-written text got flagged as AI-generated.
• SynthID Text ranked lowest of the three watermarking methods the paper tested on its composite forensic-readiness measure.

None of it is first-party Google data at production scale, and the 2026 work is an unreviewed preprint testing an open-source reimplementation rather than Google's actual production keys, which Google has never published. Treat its exact numbers as early and unreplicated, not settled science.

But the pattern is consistent enough across separate independent teams, two of them peer-reviewed, that "SynthID Text is highly robust" shouldn't get repeated as an unqualified fact.

On July 24, 2026, Google signed the EU AI Act's Code of Practice on Transparency of AI-Generated Content. What it committed to there is worth reading closely:

• Adopt and accelerate C2PA content credentials.
• Partner with Apple, ElevenLabs, Kakao, NVIDIA, and OpenAI on interoperable SynthID adoption.
• Nothing modality-specific. The announcement makes no commitment about text or about the Gemini API.

Article 50 itself became applicable on August 2, 2026, and the European Commission concluded the Code "adequately covers" Articles 50(2), (4), and (5). No Google statement found anywhere addresses Article 50 compliance for Gemini text specifically. That gap is a finding, not a search miss.

Google also warned publicly that added regulatory complexity "could contradict Europe's goals for competitiveness." That is not the posture of a company eager to over-promise on the parts of watermarking it has not finished building.

Only for some media, and not for text: the portal is waitlist-gated, no published Google route accepts text, and the in-chat checker returned verdicts about the wrong upload until Google fixed it in July 2026. The standalone SynthID Detector portal launched at Google I/O on May 20, 2025, announced for scanning an image, audio, video or text file for a SynthID mark. Only image detection was live at launch, with video and text promised "in the coming weeks."

• Access has stayed waitlist-gated to journalists, media professionals and researchers, not the general public.
• There is still no API.
• The most recent independent check, by journalist Henk van Ess in November 2025, still found it waitlist-only.

Text is the promise that never landed. More than a year after those "coming weeks," no published Google route accepts text for a SynthID check at all: the in-app flow and the portal both take image, video and audio only. That is the gap behind the verdict table above, and it is why watermarked and verifiable are separate questions for Gemini text no matter which way the app-versus-API argument resolves.

Then there is the bug. Fact-checking outlet Lead Stories found Gemini's in-chat checker returning the verdict for the first image or video uploaded in a session even when asked about a later one, producing both false positives and false negatives across four tested sessions. Google fixed it globally by July 16, 2026.

None of that changes what Google watermarks. It changes what you can establish about a particular file, which is the question most readers actually arrive with, and it is one more reason to read a single check as evidence rather than proof.