SynthID-Text Explained: How LLM Watermarks Invisibly Tag AI-Generated Content

Starting with an Announcement from Anthropic

Recently, Anthropic announced that it would begin adding watermarks to the output of its models, sparking widespread curiosity across the community. Founded in 2021 by former OpenAI core members Dario and Daniela Amodei, Anthropic was established with the express mission of building "safe AI systems." The company introduced safety alignment approaches such as Constitutional AI and has continuously strengthened safety mechanisms in its Claude series of models. The decision to deploy watermarking is yet another concrete step in its "responsible AI" strategy.

A developer shared their journey of exploration on Reddit: initially, they were puzzled—what does "watermarking" actually mean? Would the model insert random ads in the middle of responses, or embed some kind of visible marker?

Driven by these questions, they dove deep into the relevant technical literature and arrived at a key conclusion: A large language model watermark is not a visible message. It's a subtle statistical pattern introduced during the model's token selection process. To truly understand this mechanism, they built a simplified, educational version of a SynthID-Text-style watermarking system.

While this implementation is not an exact reproduction of Google DeepMind's original SynthID-Text—the author simplified or reimplemented certain components to keep the project accessible—the core ideas are fully preserved. This provides an excellent entry point for understanding content provenance in generative AI.

What Is Language Model Watermarking

Not the Kind of "Watermark" You're Thinking Of

When we hear "watermark," most people picture a semi-transparent logo in the corner of an image or background text on a document. But language model watermarking is something entirely different. It is invisible—when you read watermarked text, you can barely notice anything unusual. The text still reads naturally and fluently.

So where is the watermark hidden? The answer: in the probability distribution the model uses to select words (tokens). In the world of large language models, a token is the smallest unit of text processing. It can be a complete word, a subword fragment, or even a punctuation mark. For example, "unbelievable" might be split into three tokens: "un," "believ," and "able." When generating text, a model doesn't output complete sentences all at once—it predicts one token at a time. For each token, the model computes a probability distribution over all candidate tokens in its vocabulary. For instance, after "The weather today is really," the probability of "nice" might be 0.35, "hot" might be 0.20, and "cold" might be 0.15. Sampling is the process of randomly selecting a token based on this probability distribution—higher-probability tokens are more likely to be chosen, but not guaranteed.

This randomness is precisely the critical gap that watermarking technology exploits. Watermarking cleverly "manipulates" the sampling process so that the resulting token sequence carries a characteristic that is statistically detectable yet imperceptible to humans.

Why We Need AI Text Watermarking

With the explosive growth of AI-generated content, the question of "Was this text written by a human or an AI?" is becoming increasingly important. Whether for academic integrity, misinformation governance, or copyright attribution, a reliable provenance mechanism is needed. Watermarking technology is one technical solution to this challenge—it enables platform operators to determine with high confidence whether a given piece of text was produced by a specific AI model.

Core Principles of SynthID-Text

The Tournament Sampling Mechanism

The core idea of SynthID-Text can be summarized as intervention in the token sampling process. In standard text generation, the model computes a probability distribution for the next token based on context, then samples from it. In watermarked generation, the system introduces a key-based pseudorandom function (the g-function) that scores each candidate token.

A Pseudorandom Function (PRF) is a core concept in cryptography. It takes a key and an input and produces an output that appears random but is entirely deterministic—the same key and input always produce the same output. In SynthID-Text, the g-function takes a secret key held only by the platform operator and the current context (the sequence of previously generated tokens) as inputs, generating a watermark score for each candidate token. Because the key is secret, external attackers cannot predict or reverse-engineer these scores. However, the platform operator can precisely reproduce all scores using the same key, enabling detection. This symmetric key-based design is the foundation of the watermarking system's security.

Specifically, SynthID-Text employs a "Tournament Sampling" strategy. The process borrows from the elimination format in competitive sports: first, N candidate tokens are independently sampled from the model's probability distribution (duplicates allowed), then they are paired up for "matches." In each match, the candidate with the higher watermark function g score wins and advances to the next round, until only one winner remains as the actually output token.

The elegance of this design lies in the following: tokens with higher original probabilities are naturally more likely to be sampled multiple times, giving them more "tournament entries" and making them harder to eliminate by low-probability tokens. At the same time, the watermark preference creates a slight but persistent tilt among candidates with similar probabilities. More tournament rounds strengthen the watermark signal, but also increase the potential impact on text quality, so careful balancing is required. The token that ultimately wins is statistically more likely to be one that scored highly on the watermark function.

The Mathematical Foundation of Watermark Detection

The key insight is that this bias is negligible for any individual token and doesn't affect text quality. But when the text is long enough, these accumulated statistical deviations become apparent. The detection side simply needs to recompute each token's watermark score using the same key, then calculate the average score across the entire text.

If the text was generated by a watermarked model, its average score will be significantly higher than the expected value for random text. Conversely, human-written text or text generated by other models will score close to the random baseline. By setting a reasonable threshold, one can make a judgment with quantifiable confidence.

This is fundamentally a statistical hypothesis testing problem. In the watermark detection scenario, the null hypothesis (H₀) is "this text does not contain a watermark"—meaning each token's watermark score should follow a uniform distribution with an average score approaching the expected value of 0.5. The alternative hypothesis (H₁) is "this text contains a watermark," with an average score significantly above 0.5. During detection, the system computes the average watermark score across all tokens in the text and then calculates a p-value using a z-test or similar method. The smaller the p-value, the less credible the "no watermark" hypothesis becomes. For example, when the p-value is less than 0.001, we can say with 99.9% confidence that the text came from a watermarked model. The longer the text, the more statistical samples are available and the higher the statistical power of the test—which also explains why short-text watermark detection is inherently difficult.

Value and Limitations of the Simplified Implementation

Educational Value

The reason this developer's simplified implementation is valuable is that it strips away the complex engineering details of an industrial-grade system, making the core mechanism immediately clear. For learners who want to understand AI content provenance, such a minimal implementation is far more intuitive than reading papers. You can see firsthand how the watermark is "injected" into each token selection and how it is "read" back out.

Differences from the Original SynthID-Text

The author candidly notes that his version is not an exact reproduction of SynthID-Text. A real production system must consider many additional factors: how to maximize watermark strength while preserving text quality, how to resist targeted attacks (such as synonym substitution or paraphrasing attacks), and how to maintain stable detection rates across texts of varying lengths. These are all challenges that the simplified implementation sidesteps.

Moreover, watermarking technology still faces some fundamental challenges. Shorter texts inherently struggle to carry sufficient statistical signal. Extensive paraphrasing or translation of generated text can destroy the watermark. And if attackers have enough information, they may attempt to remove or forge watermarks.

More specifically, attacks on watermarking systems fall into several categories. First, removal attacks: attackers disrupt the original token sequence through synonym substitution, sentence restructuring, or paraphrasing with another AI model, thereby erasing the watermark signal. Second, forgery attacks: attackers attempt to forge a watermark on human-written text to create false positives. Third, detection evasion attacks: such as mixing in enough human-edited content to dilute the statistical signal. Current research suggests that substituting just 10%-20% of tokens can significantly weaken watermark detection rates. Cross-language translation can almost completely destroy a watermark, since the translated token sequence has no correspondence to the original. Google DeepMind addresses robustness in the SynthID-Text paper through techniques such as multi-layer watermark channels and context window hashing, but this remains an active research frontier.

Implications for the Industry

From Google DeepMind's SynthID-Text to the watermarking scheme Anthropic is about to deploy, we can see that leading AI companies are turning "responsible AI" from a slogan into concrete technical practice. After merging Google Brain and DeepMind in 2023, Google DeepMind launched the SynthID family of technologies, covering watermarking across four modalities: image, audio, video, and text. SynthID-Text was formally published and deployed in the Gemini model in 2024, making it one of the most comprehensive text watermarking industrial solutions in the public literature. The actions of both companies represent an industry trend: AI safety is moving from research labs to production environments, and content provenance is becoming a standard feature of LLM services.

Watermarking won't be a silver bullet for AI content provenance, but it is an important piece in building a trustworthy AI ecosystem.

For everyday users, understanding the nature of watermarking helps dispel misconceptions—it won't pollute your user experience, won't insert ads, and won't leak your conversation content. It is simply a silent, statistical-level "signature."

For developers and researchers, building a watermarking system from scratch is an excellent exercise for understanding the internal workings of generative AI. It forces you to think: How exactly does a model make each choice? And to what extent can we influence and track those choices? The answers to these questions point to the very core of AI interpretability and controllability.