No key, no verification.
The detector needs the same tokenizer and complete watermark setup: key, context rule, layer hash or table, and scorer calibration.
01 · Before the watermark
The model turns scores into next-token probabilities.
Given the text so far, the model assigns a raw score called a logit to every possible next token. A token may be a word, part of a word, punctuation, or whitespace.
Softmax turns those logits into probabilities that add to 1. Temperature T controls how concentrated they are. Lower values give more probability to the leading options. Higher values spread probability across more options.
pT(x) = exp(z(x) / T) / Σy exp(z(y) / T)
Here, z(x) is the model’s logit for token x. The denominator adds the exponentiated score for every candidate token, which makes the final probabilities total 100%. SynthID starts with this distribution.
If one token already has nearly all the probability, the watermark has little choice to work with. Several plausible options give it room to change which token is drawn.
Live lab · next-token distribution
Probabilities sum to 100%
Move the temperature. The bars show the probability used to draw one next token; they always add to 100%.
“My favorite tropical fruit is …”
02 · The secret pattern
The key computes a bit pattern for every option.
SynthID combines the private key, recent token context, candidate token, and layer number in a deterministic hash. The result is a pseudorandom g-value. In the paper’s main setting, each g-value is 0 or 1.
rt = Hash(key, recent context) · gℓ(x, rt) = Hash(rt, token x, layer ℓ) mod 2
The same inputs always reproduce the same bits. A different key, context, token, or layer recomputes them; a new bit may still happen to equal the old one. A 1 gives that candidate an advantage during one comparison. A 0 leaves the candidate in the draw but gives no advantage over a competing 1.
The vocabulary has no permanent favored set. The assignments are recomputed as the generated sentence changes, which spreads the signal across many context-dependent choices.
The published experiments use a four-token context window and mostly fair random g-bits, with 0 and 1 equally likely before watermark selection. See the Nature paper and supplement.
Live lab · keyed g-values
Educational hash · 3 layers
Choose a context and key. Each token row shows the three g-values that the sampler will use in its three tournament layers.
Recent context
Secret key
“The light pooled in the orchard …”
1 higher wins a comparison0 lower loses to a 1Ties break randomly
Switch the context or key to recompute every token’s three comparison bits.
03 · Watermarked sampling
The sampler shifts the odds, then draws one token.
In the two-candidate setting used here, an m-layer tournament draws 2m candidates from the model’s sampling distribution and compares them in pairs using keyed g-values. The final surviving candidate is emitted. Duplicate candidates are allowed because every candidate is an independent draw.
The vector equation below is an exact alternative to the bracket. It calculates the probability distribution of the final survivor, p(m), without storing 2m candidates. One token is then sampled from p(m).
- 01 · Input
Model scores
The language model produces one logit for every possible next token.
- 02 · Normalize
Token probabilities
Temperature, ordinary filters, and softmax produce the sampling distribution p(0).
- 03 · Key
Keyed g-values
The key and recent context assign a 0 or 1 to each token at each layer.
- 04 · Shift
Reweighted probabilities
Each layer reweights the tokens. When both bit groups have mass, probability moves toward g = 1.
- 05 · Draw
Sample one token
The sampler still makes a random draw. Higher probability means more likely, never guaranteed.
- 06 · Repeat
Updated context
The emitted token becomes part of the next context. The model recomputes logits, and SynthID recomputes the seed and g-values.
Detection reuses this path: it reads the emitted tokens, rebuilds each context seed and g-value with the same key, drops repeated contexts, and averages the bits. It does not need to recover the model’s original logits.
The tournament view
With three layers, the sampler draws eight candidates. In each pair, a candidate with g = 1 beats a candidate with g = 0. Equal bits use a random tie-break. Four winners become two, then one.
Only candidates drawn from the model’s own distribution enter the bracket. A low-probability token can appear and win, but it enters less often than a high-probability token.
Scale: this lab shows three layers. The paper often evaluates 30. The vectorized form avoids drawing and storing 230 candidates.
Playable tournament · 8 candidates
Run 01
Read left to right. Each winner shows the two compared tokens and their g-values for that layer.
The exact vectorized equivalent · published fruit example
Base distribution
For binary g-values and two-candidate comparisons, one layer can update the full distribution at once.
pt(0)(x) = psample(x | x<t) · Gt,ℓ = Σx pt(ℓ−1)(x)gℓ(x, rt) · pt(ℓ)(x) = pt(ℓ−1)(x)[1 + gℓ(x, rt) − Gt,ℓ]
GℓThe probability mass entering layer ℓ that belongs to tokens whose g-value is 1.
g = 1A g-value of 1 multiplies a token’s current probability by 2 − Gℓ.
g = 0A g-value of 0 multiplies it by 1 − Gℓ. The equation transfers Gℓ(1 − Gℓ) of the total mass toward the g = 1 group.
In the first published fruit layer, g = (1, 0, 0, 1). The marked mass is G = 0.50 + 0.05 = 0.55. Mango moves from 0.50 to 0.50 × 1.45 = 0.725. Lychee moves from 0.30 to 0.30 × 0.45 = 0.135.
After the last layer: the probabilities already total 1, so the sampler draws directly from p(m). It does not choose the largest value automatically. In this example, mango rises from 50.0% to 82.4% for this context and bit pattern, but another token can still be drawn.
Numbers and equation reproduce Appendix E of the paper’s official supplement.
04 · What non-distortion means
The original distribution returns after averaging.
Each visible g-layer can strongly shift one token choice. For the two-candidate sampler, those shifts cancel when the same choice is averaged over every uniformly random seed r. The average chance of emitting token x returns to the model’s original probability p(x).
A fixed seed can still favor some tokens at one step. For a whole response, the paper’s theorem averages over randomized keys and requires repeated contexts to bypass watermarking. Individual watermarked responses can differ from unwatermarked responses.
Er[ Pr(S(p, r) = x) ] = p(x)
S(p, r)The sampler using base distribution p and random seed r.
Pr(… = x)The chance that this sampler emits token x.
Er[…]The average over all uniformly random seeds r.
This statement depends on the paper’s assumptions, including repeated-context handling for sequence-level guarantees. Public implementations bound their stored context history. See Methods: non-distortionary watermarking.
Monte Carlo lab · average over randomized seeds
100 trials
Run the same base distribution with many independent seeds. The cyan winner frequencies approach the violet base probabilities as the trial count grows.
Number of independent randomized trialsOriginal probabilityObserved winners
05 · Reconstructing the signal
The detector rebuilds the bits for the tokens it sees.
The detector tokenizes the finished passage. At each eligible position, it rebuilds the seed from the preceding tokens and secret key, then calculates the g-values for the token that actually appeared. This mean scorer does not rerun the language model or need its logits.
The published generator leaves a repeated context unwatermarked, so the detector drops that position too. Counting it would reuse the same pseudorandom bits as though they were fresh evidence. The published scorer also drops the first incomplete context window; implementation-specific rules may exclude special tokens.
Smean = [1 / (m|T̂|)] Σt∈T̂ Σℓ=1…m gt,ℓ
mThe number of g-layers scored at each token position.
T̂The token positions left after context and repeat masking.
SmeanThe fraction of reconstructed evidence bits equal to 1.
Without the matching watermark, these fair keyed bits average near 0.5. Watermarked sampling favors candidates with g = 1. A matching key therefore reconstructs more 1s on average than the null expectation. A decision still needs enough text and a calibrated threshold.
The paper describes mean, weighted, frequentist, and learned Bayesian scorers. This page uses the transparent mean score only. See the official reference implementation.
Detector microscope · one generated sequence
3 g-values per token
Each tile shows an observed token and its three reconstructed bits. The score is their mean; the marker halfway across the bar is the toy null expectation of 0.5.
Detector configuration
0.000
0 evidence bits
06 · Why length and entropy matter
More usable token choices separate the scores.
For unwatermarked text, or watermarked text checked with the wrong key, the expected g-bit is 0.5. Matching-key text has a higher expected score because the sampler repeatedly favors candidates with g = 1. More usable positions make the average less variable.
Entropy describes how spread out the token probabilities are. A spread-out distribution gives the sampler real alternatives. If one token is nearly certain, both tournament candidates are often the same token, so the watermark cannot change the choice.
For one two-candidate layer with fair binary g-values, the expected selected bit follows this equation:
Cp = Σxp(x)2 · Ewm[g] = 0.5 + 0.25(1 − Cp)
Cp is the chance that two independent candidate draws select the same token. If one token has probability 1, then Cp = 1 and the expected score stays at 0.5. If probability is spread out, Cp falls and the expected matching-key score rises.
How to read the chart: the horizontal axis is the mean g-score. The vertical height counts simulated passages in that score range. Narrower curves vary less; less overlap makes a fixed threshold more useful. A score is evidence for one watermark configuration, not the probability that text is AI-written.
Distribution lab · 96 simulated passages
64 tokens · open distribution
Change passage length or how spread out the token probabilities are. The chart reruns 96 marked passages, 96 unmarked passages, and the marked passages under a wrong key. This lab holds one four-token base distribution fixed; a real model recalculates it from context at every position.
Token uncertainty
07 · From score to decision
A threshold turns the score into a decision.
A score above the threshold counts as evidence for this watermark configuration. Raising the threshold reduces false positives but misses more marked text. Lowering it finds more marked text and flags more unmarked text.
Sensitivity is the share of marked passages correctly found. The false-positive rate is the share of unmarked passages incorrectly flagged. A detector can also abstain in an uncertain middle band.
Base-rate example: suppose 1% of tested passages are marked. With 95% sensitivity and a 1% false-positive rate, the share of positive flags that are truly marked is (0.95 × 0.01) / [(0.95 × 0.01) + (0.01 × 0.99)] ≈ 49%. This prevalence is only an example.
The paper reports true-positive rate at an empirically calibrated 1% false-positive rate. This is different from a universal accuracy score. It also evaluates length-specific selective prediction. See Evaluation of SynthID-Text.
Decision lab · reuse the simulated population
Positive at 0.650
Move the positive threshold and watch passages change columns. The 0.06 abstention band is an illustrative setting for this lab.
08 · Edits and attacks
Edits change token evidence and later contexts.
Replacing one token changes that token’s g-values. It also changes the context used to hash several later positions, so one edit can alter more than one piece of detector evidence.
Small local edits may leave enough matching evidence. Extensive paraphrase, translation, or regeneration can reduce detection power sharply. Direct generation in another language and translation of an already-watermarked passage are different tests.
The paper measured random word deletion and sentence-by-sentence paraphrasing on specific data. This lab isolates token replacement; it does not simulate paraphrasing or translation.
The edit experiment used 3,000 ELI5 samples, 20% or 50% random word deletion, and Gemini Ultra paraphrases. See Supplementary §C.6 and Fig. C3.
Edit lab · deterministic token replacement
0% replaced
Move the slider to replace exact token positions. Underlined tokens changed; the detector then rebuilds every affected sliding-window context before scoring.
Original matching-key score—
After replacement—
09 · A family of approaches
Other methods change different parts of the pipeline.
SynthID changes sampling. Other methods bias logits, align edited sequences, classify finished prose, or sign a file’s history. They answer different questions and require different access.
| Approach | Where it acts | Core idea | Strength | Important limit |
|---|---|---|---|---|
| SynthID-Text, two-candidate | Token sampling | Context-keyed comparisons reshape the winner distribution | Preserves the base distribution after the paper’s stated averaging | Needs the matching private configuration; edits weaken evidence |
| Soft greenlist | Before softmax | Add a keyed bias to selected token logits | Simple detector with adjustable bias strength | Changes the fixed-key token distribution by design |
| Gumbel / exponential-min | Token sampling | Keyed pseudorandom numbers select a token while preserving long-run marginals | Can preserve the base distribution after averaging | A fixed key and context reduce sampling diversity |
| Edit-aware keyed watermark | Sampling and detection | Align the observed sequence with expected keyed evidence after edits | Handles insertions, deletions, and substitutions | Detection costs more and still needs generator coordination |
| Post-hoc AI classifier | Finished text | Learn linguistic patterns correlated with model output | No generator changes required | Domain drift and false positives; not keyed provenance |
| C2PA / Content Credentials | File and publishing pipeline | Cryptographically signed provenance manifest | Auditable origin and edit history when retained | Metadata may be stripped; not a text sampling signal |
Compare Kirchenbauer et al.’s greenlist watermark, Kuditipudi et al.’s distortion-free watermark, and the C2PA Content Credentials specification.
10 · What the paper establishes
A keyed watermark answers a narrow question well.
With the right secret setup, it can provide statistical evidence that text passed through that specific watermarking sampler. It cannot establish who wrote a passage, whether every sentence is factual, or whether unknown text came from “AI” in general.
Evidence is not authorship.
A positive result supports one watermark hypothesis. A negative result may mean no mark, too little text, low entropy, edits, or the wrong configuration.
Rewriting can remove signal.
Cropping and mild edits may preserve evidence; extensive paraphrase, translation, or regeneration can substantially reduce it.
Public processors differ from Gemini.
The public Hugging Face processor uses a different hash. A detector configured or trained for that public setup does not transfer to Gemini text.
The quality result has a defined scope.
About 20 million live Gemini responses showed no statistically significant change in thumbs feedback; a 3,000-prompt human study likewise found no significant preference difference.
One measured overhead.
The reported 30-layer Gemma 7B-IT setup took 15.615 versus 15.527 ms per token, a 0.57% increase on four TPU v5e chips. That number does not apply to every model or device.
About StegScan: the companion text steganography forensic station checks observable Unicode, typography, and structural channels. It cannot recover a private keyed statistical watermark from arbitrary pasted prose. See the text steganography lesson for that different problem.
Technical drawer: deployment details worth knowing
Public code: the reference repository is a research aid. It is separate from Google’s production system, and its hash has no cryptographic security claim.
Learned detection: the Hugging Face Bayesian detector must be trained for each key and configuration using independent marked and unmarked examples.
History: public APIs keep a bounded repeated-context history. The clean sequence theorem assumes that the full required history remains available. Hardware-specific randomness can also affect exact reproducibility.
Further methods: the paper studies larger tournaments, learned layer weights, speculative decoding, multiple languages, mixed passages, stealing, and spoofing. Testing many keys or text windows raises the false-positive rate unless calibration includes those extra tests.
Quality, latency, detector, and limitation claims in this section come from the open Nature article, its supplement, the DeepMind reference repository, and pinned Hugging Face source.
11 · Read the originals
Read the paper, supplement, and code.
The simulations on this page are deterministic educational models built from the published mechanism. They are deliberately small enough to inspect. Use the original paper and code for precise definitions and production decisions.
Paper · Nature 2024Scalable watermarking for identifying large language model outputsDathathri et al. · Version of record and DOI
Paper · Open full textSynthID-Text methods, evaluation, and limitationsPubMed Central · Accessible HTML
SupplementProofs, equations, fruit example, and extended evaluationNature supplementary information · PDF
Code · DeepMindOfficial research reference implementationPinned revision · not production code
Guidance · GoogleResponsible Generative AI Toolkit: SynthID TextConfiguration, use, and safeguards
Overview · DeepMindSynthID across text, image, audio, and videoOfficial product and research overview
Code · Hugging FacePublic SynthID text logits processorTransformers v4.46.0 · pinned implementation
Tutorial · Hugging FaceProduction-oriented public implementation guideWatermark generation and detector training