On 11 August 2026, Anthropic said it would start weaving invisible, machine-readable watermarks into everything new Claude models write, everywhere in the world, not only for users covered by EU law. The trigger was Article 50 of the EU AI Act, whose machine-readable marking obligations for generated content had taken effect the day before. Almost two years earlier, Google DeepMind had put the technique that made this plausible on the cover of Nature: SynthID-Text, a watermark that had by then already been running quietly under nearly 20 million real Gemini responses.
This post is about that paper: exactly how SynthID-Text works, why it doesn't seem to make Gemini worse or slower, and then, because a watermark is only useful if it's hard to defeat, what a growing pile of adversarial research says about how far that protection actually reaches.
A note on sources. Everything about SynthID-Text's own measured impact below is DeepMind's own reporting, peer-reviewed and published in Nature, but not independently audited. The attacks and limitations further down come from separate research groups with no stake in SynthID looking good. We've tried to flag which is which throughout.
What Watermarking a Sentence Actually Means
Watermarking a photo is intuitive: hide a signal in the pixels that survives compression and cropping but that a human eye never notices. Watermarking text has to solve the same problem with far less material to work with. A photo has millions of pixels to spread a signal across; a sentence has a few dozen tokens, and every one of them still has to read like normal language when you're done.
The trick that makes this workable at all is that a large language model doesn't pick one predetermined next word. At every position it computes a full probability distribution over the vocabulary and samples from it. Sampling has to draw its randomness from somewhere, so if you control how that randomness is generated, without changing which words end up likely, the randomness itself can carry a signal. Nobody reading the sentence can tell; anyone who knows the rule used to generate that randomness can check for it statistically afterward. That's the core idea behind every scheme discussed below. Where they differ is how they bias the sampling step, what it costs in text quality, and how hard the bias is to detect or remove without the key.
Inside SynthID-Text: Tournament Sampling
DeepMind's mechanism, as described in the Nature paper, works token by token:
- A seed, keyed by context. At each position, a secret watermarking key and a hash of the last four already-generated tokens (the paper's context window, H = 4) combine into a seed. Anyone who has the key can recompute that exact seed later from the text alone, without needing the model that wrote it.
- A coin flip per candidate. That seed feeds a pseudorandom function that assigns every candidate token a "g-value": effectively a deterministic pseudorandom 0 or 1 for that specific (token, context) pair.
- A knockout tournament. Instead of drawing one token from the model's distribution, SynthID-Text draws many candidate tokens independently from that same distribution (DeepMind's default runs 30 rounds) and runs a knockout bracket: in each pairing, the candidate with the higher g-value for that round advances; ties are broken randomly. The token left standing after all rounds is the one actually emitted.
A simplified, two-round version makes the mechanics concrete:
Draws from the model's distribution: "quick" (g=1), "swift" (g=0), "quick" (g=1), "fast" (g=1)
Round 1: "quick"(1) vs "swift"(0) -> "quick" advances
"quick"(1) vs "fast"(1) -> tie, coin-flip picks "quick"
Round 2 (final): "quick" vs "quick" -> "quick" is emitted
Real tournaments run far more rounds over far more candidates, but the pairing-and-knockout logic is exactly this.
Because every candidate was drawn from the model's real distribution to begin with, and the tie-break doesn't favor any particular word, the scheme can be tuned so that, on average, the emitted token still follows the same distribution an unwatermarked model would have used. DeepMind calls this the non-distortionary configuration. There's also a distortionary variant that pushes the bias harder for stronger detectability at some cost to that guarantee, which the paper benchmarks against Kirchenbauer et al.'s earlier "Soft Red List" watermark, discussed further down.
Detection runs the same recipe in reverse: recompute the seed and g-value for every token actually present in a candidate text, using the key, and average them. Unwatermarked text averages out near the coin-flip baseline of 0.5; watermarked text skews measurably higher. DeepMind reports this as a true-positive rate at a fixed 1% false-positive rate. The useful property here is that detection needs only the key and the text, never the model itself, which is also why it holds up consistently across languages in a way that trained AI-text classifiers (the GPTZero-style tools) typically don't.
Does It Actually Hurt the Output?
This is the part DeepMind leaned on Nature's peer review to back up, and it's the strongest evidence in the paper.
They split real Gemini traffic roughly in half between watermarked and unwatermarked responses and tracked the built-in thumbs-up/thumbs-down feedback across close to 20 million responses. The thumbs-up rate for watermarked responses came out 0.01 percentage points higher; thumbs-down was 0.02 points lower. Both differences were statistically insignificant. A separate, controlled study had human raters score 3,000 ELI5-style questions across five dimensions (coherence, relevance, correctness, helpfulness, overall quality) and again found no significant preference either way.
Latency: on a Gemma 7B-IT model, plain sampling ran at 15.527 ms per token; the 30-round tournament version ran at 15.615 ms, a 0.57% increase. Worth being precise here rather than rounding up DeepMind's own case: that's actually slower than the two baselines compared in the same table, Gumbel sampling (0.26%) and Soft Red List (0.28%). The quality-and-detectability trade-off tournament sampling buys isn't entirely free on the latency side. It's a small enough number that it's not a reason to worry about the scheme, but it's not quite the free lunch a one-line "0.57% overhead" headline suggests either.
Where the Signal Gets Thin: Low-Entropy Text
The paper is unusually candid about a structural limit: watermarking works by nudging which token gets picked among several plausible ones, so it needs the model to actually be uncertain between candidates. Ask "What is the capital of France?" and there's exactly one good next token; there's nothing left to bias. The authors state it directly: tournament sampling "performs better when there is more entropy in the LLM distribution, and is less effective when there is less entropy." Code, arithmetic, and short factual answers are exactly the categories where this bites hardest, and it's a limitation shared by every watermarking scheme in this space, not something unique to SynthID-Text. One nuance worth keeping: SynthID-Text's advantage over the older Gumbel-sampling baseline is actually larger at low entropy, and the two converge as entropy rises, so it isn't purely bad news relative to the prior state of the art, just bad news in absolute terms.
The Older Approach It's Compared Against
SynthID-Text isn't the first LLM watermark. Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein's 2023 scheme takes a more direct route: at each step, a pseudorandom function keyed by prior tokens splits the vocabulary into a "green list" and a "red list," and the model's logits for green-list tokens get a fixed boost before sampling. Detection just counts how often the chosen token happened to be on the green list.
It's simpler to implement than a multi-round tournament, and that simplicity is also its weak point. The boost directly distorts the output distribution, most visibly in moderate-entropy prose, which is why several follow-up papers were written specifically to fix that distortion. Because the underlying signal is "was the chosen token on a list" rather than a multi-layer statistical structure, it's also the most-studied target for the attacks below.
How Robust Is Any of This, Really?
This is where the marketing framing and the adversarial literature start to disagree, and it's worth taking seriously rather than treating watermarking as a solved problem.
Paraphrasing breaks it, reliably. Several 2024-2025 studies, independent of DeepMind, found that a single pass through an LLM paraphraser can push detection rates for multiple watermarking schemes under 30%. ETH Zurich's SRI Lab ran this specifically against SynthID-Text and found that naive, off-the-shelf paraphrasers achieved above 90% scrubbing success across the configurations they tested.
There's a proof, not just anecdotes, that this can't be fully fixed. Zhang, Edelman, Francati, Venturi, Ateniese and Barak's ICML 2024 paper, titled "Watermarks in the Sand," shows under fairly general assumptions that "strong" watermarking (meaning no bounded attacker can strip it without visibly degrading quality) is provably impossible, even if the attacker never learns the secret key. That doesn't make watermarking pointless: it means no future scheme in this family will be unbreakable against someone willing to spend compute rewriting the text, while it stays genuinely useful against the much more common case of careless copy-paste reuse.
Watermarks can be stolen and forged onto text that was never watermarked. Jovanović, Staab and Vechev, also at ICML 2024, showed that querying a watermarked model's public API is enough to reverse-engineer an approximation of its green/red pattern, well enough to both scrub the real watermark faster and to spoof it: generating fresh, unwatermarked text that falsely triggers a "this came from our model" detection. They report success rates above 80% for under $50 in API calls against schemes "previously considered safe." SRI Lab's dedicated probing of SynthID-Text found it noticeably harder to spoof than the schemes they compared it against, but not immune: spoofing still succeeded 4-15% of the time depending on how much watermarked text the attacker could collect, and the watermark's presence could be inferred from black-box queries alone, despite that not being the intended design.
To DeepMind's credit, none of this is the paper hiding the ball: it volunteers the low-entropy limitation and names stealing and scrubbing as open problems itself, which is more candor than most corporate research papers offer. The honest summary is that SynthID-Text is real, deployed at Gemini's scale, doesn't appear to cost quality, and still can't survive a determined adversary willing to rewrite the text.
Not the Only Way to Prove Provenance
Text watermarking is one branch of a bigger tree. For images, video and audio, the industry has mostly converged on a different approach: C2PA / Content Credentials, a cryptographically signed metadata manifest recording where content came from and how it was edited, backed by a coalition, Adobe, Microsoft, Google, Intel, Sony, Amazon, OpenAI and thousands more members, that now spans most major camera and creative-software vendors. It's a label attached next to the content rather than a signal woven into it, which is exactly why it's a poor fit for plain text: retyping, re-saving or screenshotting strips a metadata sidecar trivially, whereas a statistical watermark is designed to survive exactly that kind of copy.
OpenAI is the clearest example of a lab choosing differently on purpose. It built a working text watermark, reportedly effective against naive copy-paste, and chose not to ship it in ChatGPT. An internal survey reportedly found close to 30% of users would use the product less if it were added; the company worried about false positives disproportionately flagging non-native English writers; and OpenAI's own assessment was that the watermark was, in its words, easy to get around through paraphrasing or translation. It has instead adopted SynthID for the audio it generates and joined the C2PA steering committee for image provenance, without ever shipping a text watermark for ChatGPT itself, as far as public reporting through 2026 shows.
The Regulation That Just Made This Everyone's Problem
Article 50 of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video, or text to mark that output in a machine-readable format detectable as AI-generated. Its obligations took effect on 2 August 2026, with a grace period to 2 December 2026 for systems already on the market before that date. It's worth being precise about what it does not say: it doesn't name watermarking as the mandated technique. Compliance guidance treats metadata tagging, cryptographic provenance, machine-readable audit logs, and watermarking as equally valid options; a provider can pick whichever fits its content type.
Anthropic's announcement, days after that deadline, chose the statistical-watermark route for text and C2PA-style signed metadata for generated image files, applying both worldwide rather than only where the law technically reaches. Reporting on the announcement didn't confirm the underlying mechanism, so it would be a mistake to assume it's SynthID under the hood. It's a separate, currently undisclosed implementation aimed at the same regulatory target.
Why a Lab Might Want This Anyway
Everything above frames Anthropic's move as a reaction: Article 50 came into force, Anthropic announced its policy days later. The timing supports that story. But it doesn't fully explain one detail: Anthropic said it would watermark everywhere, not only the traffic the law actually reaches. A pure compliance move stops at the border the law draws.
There's a self-interested reason to go further that has nothing to do with any regulator: protecting the data the next model gets trained on. A 2024 Nature paper by Shumailov et al. documented "model collapse": train a model repeatedly on data that's itself increasingly AI-generated, and quality degrades across generations. Rare patterns and long tails of the distribution erode first, and output drifts toward a narrower, blander average. The web every lab crawls for its next training run is filling up with exactly that kind of text, faster than any human-curation effort could filter it out.
A watermark that survives plain copy-paste, even one a determined paraphrase attack defeats, gives a lab a cheap, first-party way to flag "we generated this" in its own crawl pipeline and downweight or exclude it before the next training run, without waiting on anyone else's classifier. Seen that way, watermarking isn't only a compliance cost. It doubles as quality control for whatever model comes next, and satisfying Article 50 is a convenient side effect rather than the whole motivation.
To be clear about what this is: nobody in the reporting or the paper says this out loud. It's a plausible incentive, not a confirmed one. But it would explain the one thing the regulation-only story doesn't: why go beyond what the law asks for.
What This Means If You're Building With LLMs
If your product generates text, summaries, or translations for EU users, Article 50 is something to plan for now, not a future concern. Work out which of the compliant options, watermark, metadata, or provenance log, fits how your content actually gets consumed and edited downstream, because "detectable as AI-generated" has to survive however your users realistically use the output.
And if you're evaluating "AI content detector" tools, whether to police AI-written student work, fake reviews, or spam, keep the research above in view. Trained classifiers are unreliable across languages and easily fooled by a single paraphrase pass. Even a model-native, statistically grounded watermark like SynthID-Text needs the model provider's cooperation and secret key to detect at all, and still can't survive a paraphrase attack most of the time. Watermarking is real, useful engineering, not a compliance checkbox that also happens to catch bad actors. Plan around what it actually is.