Remove Gemini Watermark: What SynthID Text Can Survive

No Google source settles it: the app is documented as watermarked, and the API has been answered both ways. Google DeepMind's own SynthID model page states that SynthID watermarks text generated by the Gemini app and web experience. That's the official line.

A Google-affiliated account on Google's AI Developer Forum wrote the opposite for developers on August 5, 2026, replying to a question about gemini-2.5-flash-lite and gemini-3.1-flash-lite under EU AI Act Article 50(2): "Generated text from the API is NOT SynthID-watermarked. There is no machine-readable providence [sic] signal... Native text watermarking is not planned at the moment." On August 19 the same account retracted that in favour of the opposite claim, without either post being edited or marked as the answer.

Nobody has reconciled the two. The likeliest explanation, that the consumer app carries a watermark while the API does not, is a plausible guess rather than a confirmed fact, since no Google source states it directly for current Gemini 3.x models.

A third Google page points the same direction. The Gemini Apps help page for verifying AI content covers only images, video, and audio, says nothing about text, and states Gemini can currently only recognize content made by Google's own AI tools.

This changes what you're even testing. Before testing anything, confirm which surface generated your text, and don't assume an answer either way.

SynthID Text is a logits processor. It runs during generation, after Top-K and Top-P sampling has already narrowed the field of candidate next tokens, and nudges the choice toward a statistical pattern tied to a watermark configuration.

A detector later checks whether a passage's token choices match that pattern more than chance would predict. There is no visible marker and no character hidden anywhere in the text.

That kills an entire category of removal advice. Stripping invisible Unicode does nothing to a SynthID Text watermark, because there's nothing sitting in the text to strip.

Google's Nature paper calls the technique tournament sampling and reports a live experiment across millions of real Gemini responses that found no detectable drop in output quality from the watermark.

Google also states plainly that detector confidence can be greatly reduced when text is thoroughly rewritten or translated, while describing the scheme as robust to mild paraphrasing. Both statements are documented specifically for the Gemini app and web experience, not the API.

Academic red-teams have gone after SynthID Text itself, not just a related scheme, since Google shipped it, and the findings run from no clear advantage over older schemes to outright vulnerability:

• A 2025 paper on robustness assessment for Google's SynthID ran paraphrasing, copy-paste splicing, and back-translation attacks against the deployed scheme and found it vulnerable to all three.
• A peer-reviewed 2025 paper found its resilience under those same attacks similar to a much older, simpler green-list watermark, with no clear advantage despite being newer.
• A March 2026 paper proved theoretically that the default mean-scoring detector gets more vulnerable as more tournament sampling layers are used, though an alternative Bayesian scoring method built into the same system holds up better against that specific attack.
• A 2026 preprint using an open-source reimplementation found 80 percent of genuinely watermarked text already sitting inside SynthID's own official uncertain zone before any attack, and 98 percent of detected texts losing their signal after a single paraphrasing pass.

All of this tests the open-sourced algorithm or third-party reimplementations, not Google's actual production configuration, which Google has never published. That's an asterisk worth remembering, not a reason to dismiss the findings.

A related but separate scheme adds the only useful reference point for document length. Kirchenbauer and colleagues stress-tested a green-list token watermark against human rewriting, LLM paraphrasing, and dilution in longer documents, and found it stayed detectable after strong human paraphrasing once a detector had about 800 tokens, at a 1e-5 false-positive rate.

Not at the rate the viral post claimed: its own author later put the real evasion rate at 16 percent, not 90. The April 2026 viral post claimed a hobbyist cracked Google's SynthID image watermark using 200 solid black-and-white Gemini-generated images and FFT spectral analysis, claiming 90 percent detection accuracy, released as an open-source project that reached 1.2 million views.

Three days later, a correction thread citing the researcher's own admission put the real evasion rate at 16 percent, describing the method as confusing the decoder, not deleting the watermark.

That correction pointed to a genuinely peer-reviewed attack, UnMarker, which dropped SynthID detection from 100 percent to about 21 percent without knowing the algorithm. It needs roughly a $10,000 A100 GPU.

Keep that pattern in mind before trusting any "I removed the watermark" claim about Gemini text.

No: Google's own SynthID Detector portal was announced for text, image, audio, and video, but only image, video and audio detection is live, and no published route accepts text, so the one modality this page is about is the one the portal cannot check. It launched at Google I/O in May 2025 gated to a waitlist of journalists and researchers, not the public.

The most recent independent check, from November 2025, found it still waitlist-only, with in-app verification for audio and video described as hit-or-miss even for people who had access.

Google's own tooling has also had a real, documented failure. Fact-checking outlet Lead Stories found Gemini's in-chat SynthID checker returning the verdict for the first image or video uploaded in a session even when asked about a later one, producing false positives and false negatives across four tested sessions, a bug Google fixed globally by mid-July 2026.

A checking tool that can be wrong on its own is one more reason to test against a specific, known detector rather than trust a single check either way.