SynGuard: Hybrid Text Watermarking Framework

• SynGuard is a hybrid text watermarking framework that embeds both lexical and semantic signals to verify the provenance of LLM-generated content.
• It augments the SynthID-Text method by integrating semantic alignment, thereby enhancing robustness against paraphrasing, synonym substitution, copy-paste dilution, and back-translation.
• Empirical evaluations show that SynGuard maintains near-baseline F1 performance in clean settings while significantly improving watermark recoverability under meaning-preserving transformations.

SynGuard is a hybrid text watermarking framework for LLM outputs that combines the semantic alignment mechanism of Semantic Invariant Robust watermarking with the probabilistic watermarking mechanism of SynthID-Text. It is designed for content provenance under meaning-preserving post-processing, particularly paraphrasing, copy-paste dilution, synonym substitution, and back-translation, where lexical-only watermark signals can become difficult to recover. In the formulation reported for SynGuard, watermark evidence is embedded and later recovered at both lexical and semantic levels, with the goal of improving robustness while preserving fluency and maintaining near-SynthID performance in the no-attack setting (Han et al., 27 Aug 2025).

1. Origins, problem setting, and design objective

SynGuard was introduced in the context of robustness assessment for Google DeepMind’s SynthID-Text, a generation-time, sampling-based text watermarking method. The motivating problem is text provenance: determining from text alone whether a sequence was generated by a watermarked LLM, even when the prompt, model, or generation logs are unavailable. The work emphasizes that this is particularly difficult in text because watermark capacity is constrained by sequence length, small lexical perturbations can substantially alter token identity, and meaning-preserving editing is easy to perform (Han et al., 27 Aug 2025).

The framework is built around an empirical finding: SynthID-Text remains strong in benign settings but degrades under realistic post-generation transformations that preserve meaning while altering surface form. The attacks considered are synonym substitution, copy-and-paste dilution, paraphrasing, and re-translation or back-translation. These transformations weaken watermark detectability because SynthID’s detection score is defined over token-level pseudorandom watermark values, so edits that regenerate wording or dilute the marked segment move the statistic toward its null expectation (Han et al., 27 Aug 2025).

SynGuard addresses this by introducing a dual-channel watermark. The lexical component preserves the keyed, pseudorandom watermark signal characteristic of SynthID-Text. The semantic component contributes a watermarking signal that is intended to remain stable under semantic-preserving rewrites. This suggests a design principle broader than the original application: when provenance depends on surface token selection alone, robustness is limited; when provenance incorporates semantic invariants, resistance to realistic tampering can improve. A related line of work in model-internal moderation makes a similar methodological move from surface outputs to richer internal or higher-level signals, although in a different task domain (Jiao et al., 20 Apr 2026).

2. Baseline: SynthID-Text and the attack model

SynGuard is defined relative to SynthID-Text. For a LLM $M$ over vocabulary $V$, given a token sequence

$t = [t_0, t_1, \ldots, t_{T-1}],$

the next token is generated from

$P_M(t_T \mid t_{:T-1}).$

SynthID-Text is described as a generation-time watermarking algorithm based on pseudorandom functions and tournament sampling. For each candidate token $x \in V$, it assigns $m$ independent binary watermark values

$g_l(x,r) \in \{0,1\}, \quad l=1,\dots,m,$

where $r$ is a random seed. Detection averages these token-level watermark signals over a sequence:

$$\text{Score}(t) = \frac{1}{mT} \sum_{i=1}^{T} \sum_{l=1}^{m} g_l(t_i, r_i).$$

If the score is sufficiently high, the text is treated as watermarked (Han et al., 27 Aug 2025).

The threat model assumes an adversary attempting to remove or weaken the watermark while preserving meaning. Four attack classes are central.

Synonym substitution replaces words with contextually appropriate alternatives up to a specified ratio $\epsilon$.

Copy-and-paste dilution embeds a watermarked segment inside substantially longer unwatermarked human-written text, reducing the fraction of marked tokens in the evaluated sample.

Paraphrasing rewrites wording and structure while retaining semantics.

Back-translation translates the text through a pivot language and back into English, often preserving meaning while globally altering lexical choice and syntax (Han et al., 27 Aug 2025).

In the robustness assessment preceding SynGuard, SynthID-Text remained comparatively resilient to synonym substitution but was substantially degraded by copy-and-paste, paraphrasing, and especially back-translation. This empirical pattern provides the direct justification for a semantic-aware hybrid watermark: the strongest failures are precisely the settings where semantic content persists but lexical realization changes (Han et al., 27 Aug 2025).

3. Architecture and watermark embedding rule

SynGuard combines three logit sources during generation: base language-model logits, semantic watermark logits, and SynthID-style pseudorandom watermark logits. The paper lists as inputs the LLM $V$0, prompt and text context, embedding model $V$1, watermark model $V$2, semantic weight $V$3, tournament sampler $V$4, and key $V$5 (Han et al., 27 Aug 2025).

The method computes:

1. base model logits, denoted $V$6;
2. a prefix embedding $V$7;
3. semantic watermark logits $V$8;
4. SynthID watermark logits $V$9.

The combined embedding rule is given, with formatting imperfections in the source, as

$t = [t_0, t_1, \ldots, t_{T-1}],$0

The intended meaning is that the final watermarked logits $t = [t_0, t_1, \ldots, t_{T-1}],$1 are obtained by adding the base logits to a weighted combination of the semantic watermark component and the pseudorandom lexical watermark component. The blending factor $t = [t_0, t_1, \ldots, t_{T-1}],$2 controls the trade-off: larger $t = [t_0, t_1, \ldots, t_{T-1}],$3 increases reliance on semantic robustness, while smaller $t = [t_0, t_1, \ldots, t_{T-1}],$4 places more weight on the keyed lexical watermark (Han et al., 27 Aug 2025).

This architecture yields a two-level watermarking system.

Lexical level: the SynthID-derived $t = [t_0, t_1, \ldots, t_{T-1}],$5-value mechanism provides keyed, pseudorandom token-level evidence. This is useful for anti-forgery and for retaining the original probabilistic watermarking structure.

Semantic level: the SIR-derived semantic signal prefers token choices aligned with the semantic embedding of the preceding context. This signal is intended to be more stable under paraphrasing, synonym replacement, and translation (Han et al., 27 Aug 2025).

A plausible implication is that SynGuard is best understood not as a replacement for SynthID-Text, but as an augmentation of it. The no-attack results remain extremely close to SynthID-Text, while the main gains appear under semantic-preserving tampering. That trade-off recurs in several other safety architectures that seek to preserve baseline utility while improving robustness through richer signals or runtime structure rather than full task redefinition (Das et al., 9 Oct 2025).

4. Detection, extraction, and theoretical analysis

At detection time, SynGuard computes two component scores from a text

$t = [t_0, t_1, \ldots, t_{T-1}],$6

The semantic score is defined as

$t = [t_0, t_1, \ldots, t_{T-1}],$7

with the paper stating that

$t = [t_0, t_1, \ldots, t_{T-1}],$8

Although the formula contains typesetting issues, the intended interpretation is an average semantic watermark preference across token positions (Han et al., 27 Aug 2025).

The SynthID-derived score is

$t = [t_0, t_1, \ldots, t_{T-1}],$9

with

$P_M(t_T \mid t_{:T-1}).$0

Because the semantic score lies in $P_M(t_T \mid t_{:T-1}).$1, it is linearly normalized to $P_M(t_T \mid t_{:T-1}).$2 before fusion. The final composite score is

$P_M(t_T \mid t_{:T-1}).$3

A text is judged watermarked if

$P_M(t_T \mid t_{:T-1}).$4

where $P_M(t_T \mid t_{:T-1}).$5 is the detection threshold. The paper notes that F1 is computed at the best threshold, and also discusses $P_M(t_T \mid t_{:T-1}).$6 as a threshold range in the theoretical discussion (Han et al., 27 Aug 2025).

Two theorems are reported.

Meaning-preserving transformation robustness: if $P_M(t_T \mid t_{:T-1}).$7 is a meaning-preserving transformation of a watermarked text $P_M(t_T \mid t_{:T-1}).$8, then with high probability the score $P_M(t_T \mid t_{:T-1}).$9 remains above threshold. The argument assumes that contextual embeddings remain close under such transformations and that the semantic watermark model is Lipschitz continuous:

$x \in V$0

where $x \in V$1 is the Lipschitz constant. Under this assumption, semantic preference remains similar even when the lexical watermark weakens toward chance (Han et al., 27 Aug 2025).

Low false-positive probability for non-watermarked text: for text not generated by the watermarking algorithm, the probability that the score exceeds threshold is exponentially small in sequence length. The analysis defines

$x \in V$2

and

$x \in V$3

Assuming $x \in V$4 are i.i.d., Hoeffding’s inequality yields

$x \in V$5

This formalizes the hybrid intuition: the semantic term supports robustness under edits, while the keyed pseudorandom term supports security against forgery without the key (Han et al., 27 Aug 2025).

5. Empirical evaluation and reported performance

The experiments use Sheared-LLaMA-1.3B as the backbone model, the C4 corpus as the data source, and MarkLLM as the evaluation toolkit. Each experiment uses 200 watermarked and 200 unwatermarked samples of fixed length $x \in V$6 tokens. The paper reports TPR, FPR, F1 at the best threshold, ROC-AUC, and PPL for text quality (Han et al., 27 Aug 2025).

In the no-attack comparison, the reported results are:

Algorithm	TPR	FPR	F1	Running Time (s/it)
SynthID-Text	1.0	0.0	1.0	6.09
SIR	0.98	0.015	0.9825	12.50
SynGuard	0.995	0.0	0.9975	12.93

These figures show that SynGuard remains extremely close to SynthID-Text in clean conditions while incurring runtime close to SIR rather than SynthID-Text (Han et al., 27 Aug 2025).

Under attack, the paper highlights four summary settings.

Synonym substitution at $x \in V$7:

• SynthID F1: 0.884
• SynGuard F1: 0.965

Copy-and-paste at ratio 10:

• SynthID F1: 0.821
• SynGuard F1: 0.891

Paraphrasing with Dipper-10-5:

• SynthID F1: 0.842
• SynGuard F1: 0.923

Back-translation through Chinese:

• SynthID F1: 0.711
• SynGuard F1: 0.777 (Han et al., 27 Aug 2025)

The strongest gain in the summary table is copy-and-paste, where the absolute improvement is 0.103 F1. Synonym substitution and paraphrasing each improve by 0.081 F1, while Chinese back-translation improves by 0.066 F1. The abstract reports that SynGuard improves watermark recovery by an average of 11.1% in F1 score relative to SynthID-Text. The detailed table in the paper supports consistent gains, but the exact arithmetic producing 11.1% is not explicitly shown; the source summary notes that this may reflect a relative rather than simple absolute aggregation (Han et al., 27 Aug 2025).

The back-translation experiments are especially notable because they reveal substantial dependence on translation system quality. With NLLB-200-distilled-600M, SynGuard’s F1 ranged from 0.777 to 0.848 depending on pivot language. With googletrans, the same attack family yielded much higher F1, up to 0.942 for Japanese. This suggests that robustness under translation is mediated not only by the watermark but also by the structure-preserving properties of the translation pipeline (Han et al., 27 Aug 2025).

6. Hyperparameters, trade-offs, and broader significance

A central hyperparameter is the semantic blending factor

$x \in V$8

The paper studies $x \in V$9 and reports the following no-attack comparison:

Semantic Weight $m$0	TPR	FPR	F1
0.0	1.0	0.0	1.0
0.1	0.97	0.0	0.985
0.3	0.99	0.01	0.990
0.5	0.99	0.005	0.992
0.7	1.0	0.01	0.995
1.0	0.98	0.015	0.983

On this basis, $m$1 is selected as the default operating point. The interpretation given in the source is that too little semantic signal leaves the method vulnerable to semantic attacks, while too much semantic signal moves the system toward pure SIR behavior and slightly degrades no-attack accuracy (Han et al., 27 Aug 2025).

The framework also has clear limitations. SynGuard is slower than SynthID-Text, with 12.93 s/it versus 6.09 s/it in the no-attack table. It incurs a small no-attack performance trade-off, with F1 decreasing from 1.0 for SynthID-Text to 0.9975. Hard attacks remain difficult: under Chinese back-translation with NLLB, F1 is still only 0.777. The paper also notes typesetting problems in some formulas, making the released code important for precise reproduction (Han et al., 27 Aug 2025).

In a broader research landscape, SynGuard belongs to a family of systems that improve robustness or safety by augmenting a strong baseline with an additional structured signal rather than replacing the baseline outright. This pattern appears in several adjacent domains. Internal-state moderation methods such as SIREN augment frozen backbones with lightweight readouts over richer latent representations rather than relying only on final-layer generative classification (Jiao et al., 20 Apr 2026). Prompt-injection defenses such as ESLD likewise exploit latent-space signals inside existing guard models to improve both latency and detection quality without retraining the host guard (Narendra, 18 May 2026). Sentence-level streaming systems such as SentGuard make an analogous systems-level choice by changing the unit of moderation rather than merely training a larger guard (Yu et al., 1 Jun 2026). These parallels do not make SynGuard a guardrail framework in the moderation sense; rather, they indicate that its core contribution fits a broader methodological trend toward hybridization, latent signal preservation, and robustness-aware inference design.

SynGuard’s distinctive contribution within watermarking is therefore specific and technically narrow: it shows that a hybrid lexical-semantic watermark can preserve nearly the clean-setting strength of SynthID-Text while improving resilience to meaning-preserving tampering. Its significance lies less in replacing existing provenance systems than in identifying semantic invariance as a practical axis for strengthening text watermark recovery under realistic editing transformations (Han et al., 27 Aug 2025).