SynthID-Text: Industrial Watermarking

• SynthID-Text is a production-ready generative watermarking system that embeds detectable pseudorandom signals via a secret-conditioned tournament sampling procedure without altering the LLM architecture.
• Its detection framework uses both mean score and Bayesian score methods, providing theoretical guarantees on detectability and performance variations with changes in tournament layer depth.
• Robustness evaluations reveal strong benign detectability while also exposing vulnerabilities to layer inflation attacks and meaning-preserving transformations like paraphrasing and back-translation.

SynthID-Text is a generative watermarking system for LLM outputs that embeds a detectable signal during decoding without changing the LLM architecture. It is described as the first production-ready, industrial-scale text watermark for LLMs, already deployed in Google systems such as Gemini, and its defining mechanism is a secret-seeded Tournament Sampling procedure coupled with detector score functions over hidden pseudorandom token-level signals (Omidi et al., 3 Mar 2026). In the literature summarized here, SynthID-Text is treated as a distortion-free, non-deterministic, generation-time watermarking system whose practical significance derives from its deployment orientation, while its main technical questions concern detectability, detector design, robustness under composition and downstream editing, and compatibility with production inference stacks (Omidi et al., 3 Mar 2026, Sander et al., 12 May 2026).

1. Definition and system model

SynthID-Text operates in the standard next-token generation setting. At generation step $t$, it derives a secret-conditioned seed

$r_t = h(x_{t-H},\dots,x_{t-1},k),$

where $h$ is a hash function, $H$ is the context window used for seeding, and $k$ is the secret key (Omidi et al., 3 Mar 2026). Using this seed, it computes layer-specific pseudorandom watermark values $g_\ell(x_t,r_t)$ for candidate next tokens. These $g$-values are intended to resemble IID draws from a base distribution such as Bernoulli or Uniform, and watermark embedding occurs through the sampling rule rather than by modifying the model architecture (Omidi et al., 3 Mar 2026).

The system is presented as differing from earlier text watermarking approaches such as green-list/red-list biasing or Gumbel-style methods in three respects: a new Tournament Sampling embedding algorithm, a detection strategy organized around a score function—especially the mean score and Bayesian score—and a unified design supporting both non-distortionary and distortionary watermarking (Omidi et al., 3 Mar 2026). The theoretical analysis in the main paper focuses primarily on the non-distortionary variant, which is described there as the practical and currently deployed setting (Omidi et al., 3 Mar 2026).

In subsequent comparative work, SynthID-Text is repeatedly positioned as one of the strongest practical baselines for distortion-free watermarking. TextSeal describes it as a distortion-free, non-deterministic generation-time watermark deployed in Gemini, and treats it as one of the two best practical baselines alongside Gumbel-max (Sander et al., 12 May 2026). SynGuard, by contrast, models SynthID-Text as a probabilistic token-level watermark based on keyed pseudorandom $g$-values and tournament sampling, and takes that lexical dependence to be the source of both its benign-setting strength and its brittleness under meaning-preserving transformations (Han et al., 27 Aug 2025).

2. Tournament Sampling and watermark embedding

The core architectural novelty of SynthID-Text is its tournament-based embedding procedure. At token position $t$, the generator samples

$m' = 2^m$

candidate tokens from the base LLM distribution $r_t = h(x_{t-H},\dots,x_{t-1},k),$0, allowing repeats, and places them into an $r_t = h(x_{t-H},\dots,x_{t-1},k),$1-layer knockout tournament (Omidi et al., 3 Mar 2026). At each layer $r_t = h(x_{t-H},\dots,x_{t-1},k),$2, every surviving token $r_t = h(x_{t-H},\dots,x_{t-1},k),$3 receives a layer-specific pseudorandom score $r_t = h(x_{t-H},\dots,x_{t-1},k),$4. Candidates are paired, the token with larger $r_t = h(x_{t-H},\dots,x_{t-1},k),$5 wins, ties are broken uniformly at random, and the winners advance until a single token remains and becomes the generated token $r_t = h(x_{t-H},\dots,x_{t-1},k),$6 (Omidi et al., 3 Mar 2026).

This mechanism means that the watermark is not injected through explicit logit boosts for a designated token subset. Instead, it emerges from repeated pairwise elimination under secret-conditioned layer signals. The core notation used throughout the analysis is:

• seed: $r_t = h(x_{t-H},\dots,x_{t-1},k),$7,
• layer score: $r_t = h(x_{t-H},\dots,x_{t-1},k),$8,
• $r_t = h(x_{t-H},\dots,x_{t-1},k),$9 tournament layers over $h$0 sampled candidates (Omidi et al., 3 Mar 2026).

A central analytic quantity is the layer collision probability

$h$1

the probability that two IID draws from a discrete distribution $h$2 are equal (Omidi et al., 3 Mar 2026). Layer-specific collision probabilities $h$3 determine the extent to which tournament selection shifts the $h$4-value distribution upward. If $h$5 is the CDF of the unwatermarked base $h$6-distribution, then the watermarked single-layer CDF is

$h$7

For continuous $h$8,

$h$9

and for discrete $H$0,

$H$1

These formulas formalize the intuition that tournament winners are statistically enriched for larger $H$2-values (Omidi et al., 3 Mar 2026).

The analysis concentrates on two base $H$3-distributions used in SynthID-Text:

• $H$4,
• $H$5 (Omidi et al., 3 Mar 2026).

TextSeal summarizes SynthID-Text at a higher level as watermarking via “multi-layered tournament sampling with binary random functions,” and attributes to its iterative procedure $H$6 sequential rounds of top-$H$7 reweightings and a multinomial sampling step (Sander et al., 12 May 2026). SynGuard similarly abstracts the mechanism as sampling candidates from $H$8, evaluating each candidate with $H$9 independent pseudorandom binary functions $k$0, and preferring candidates with statistically high aggregate $k$1-scores while preserving fluency (Han et al., 27 Aug 2025). This suggests that later analyses often work with a simplified operational abstraction of the original tournament process even when they do not reproduce its full mathematical detail.

3. Detection framework: mean score and Bayesian score

Detection in SynthID-Text is formulated as deciding whether a text $k$2 is watermarked. Given the secret key, the detector recomputes the token-level pseudorandom $k$3-values and applies a score function (Omidi et al., 3 Mar 2026).

The simplest detector is the mean score,

$k$4

For both Bernoulli$k$5 and Uniform$k$6, the unwatermarked expected mean score is $k$7, while watermarked text tends to score above $k$8 (Omidi et al., 3 Mar 2026).

The more structured detector is the Bayesian score, which treats watermark detection as a binary hypothesis test with hypotheses $k$9 and $g_\ell(x_t,r_t)$0. Its posterior log-odds are

$g_\ell(x_t,r_t)$1

and the corresponding score is

$g_\ell(x_t,r_t)$2

Equivalently, if

$g_\ell(x_t,r_t)$3

then

$g_\ell(x_t,r_t)$4

The likelihood factorization used in the analysis is

$g_\ell(x_t,r_t)$5

and

$g_\ell(x_t,r_t)$6

where $g_\ell(x_t,r_t)$7 is the number of unique tokens at layer $g_\ell(x_t,r_t)$8, timestep $g_\ell(x_t,r_t)$9 (Omidi et al., 3 Mar 2026).

The evaluation metric used throughout the main theoretical paper is TPR at fixed FPR, typically with $g$0. Formally,

$g$1

and a threshold $g$2 is chosen such that $g$3 (Omidi et al., 3 Mar 2026).

Detector	Definition	Reported property
Mean score	Average of all $g$4 over tokens and layers	Simpler, but vulnerable as layers increase
Bayesian score	Posterior score from likelihood ratio $g$5	More robust with respect to added layers

TextSeal places substantial emphasis on the distinction between detector families. It states that SynthID-Text proposes both a frequentist Z-test and a Bayesian detector, but uses a frequentist Z-test in its own comparisons because it regards the Bayesian detector as lacking controlled false-positive guarantees, being distribution-dependent, and being incompatible with localized multi-window testing (Sander et al., 12 May 2026). By contrast, the theoretical analysis of SynthID-Text identifies the Bayesian score as the more robust detector within the original framework (Omidi et al., 3 Mar 2026). The tension here is methodological rather than contradictory: one line of work emphasizes likelihood-based robustness inside the SynthID design, while another emphasizes frequentist calibration and localization for cross-system comparison.

4. Theoretical analysis of detectability and layer dependence

A major contribution of the formal analysis is the use of Lyapunov’s CLT to model the mean score as approximately Gaussian under standard independence assumptions and moderate text length: $g$6 (Omidi et al., 3 Mar 2026). This approximation enables threshold and TPR formulas for both Bernoulli and Uniform $g$7-distributions.

For unwatermarked text, thresholds achieving $g$8 are

$g$9

and

$g$0

For approximately Gaussian mean score, the resulting TPR is

$g$1

(Omidi et al., 3 Mar 2026).

The central theorem for mean-score detection is that TPR as a function of the number of layers $g$2 is unimodal: it increases initially, then decreases, and in the limit converges back to the false positive rate (Omidi et al., 3 Mar 2026). The paper states two corollaries:

1. TPR is unimodal in $g$3.
2. The peak occurs at $g$4, and as $g$5,

$g$6

The proof intuition given is that collision probabilities $g$7 increase with layer depth, so the shift in expected watermark signal eventually saturates, while additional layers continue contributing variance. Once the mean separation no longer improves, the score distributions overlap more strongly and detectability deteriorates (Omidi et al., 3 Mar 2026). The paper refers to the resulting failure mode as a lack of self-robustness: repeatedly applying the watermarking mechanism to itself can worsen detection (Omidi et al., 3 Mar 2026).

The Bayesian score behaves differently. Defining

$g$8

the analysis treats

$g$9

as approximately Gaussian, so the likelihood ratio $t$0 is approximately log-normal (Omidi et al., 3 Mar 2026). Under either Bernoulli$t$1 or Uniform$t$2, the paper’s main theorem is that TPR under the Bayesian score is monotonically non-decreasing in the number of layers $t$3, with saturation once collision probabilities reach $t$4 for all tokens at a layer (Omidi et al., 3 Mar 2026). The asymptotic behavior is summarized as

$t$5

$t$6

The same paper also generalizes the Bernoulli analysis from $t$7 to $t$8 and proves that

$t$9

so $m' = 2^m$0 is optimal among Bernoulli choices for mean-score detection at fixed FPR (Omidi et al., 3 Mar 2026). In that sense, the default parameter choice used in SynthID-Text is not only conventional but theoretically justified within the analyzed detection framework.

5. Robustness, attacks, and downstream transformations

The most specific attack introduced against SynthID-Text is the layer inflation attack, which exploits the unimodal dependence of mean-score TPR on the number of tournament layers (Omidi et al., 3 Mar 2026). The threat model assumes black-box access to the watermarked generator. The attacker does not need the watermark key and does not alter the internal embedding mechanism. Instead, the attacker composes the deployed watermarked system with an additional external tournament:

1. query the original LLM + SynthID-Text system on the same prompt $m' = 2^m$1 times,
2. run an additional $m' = 2^m$2-layer tournament over the returned winner tokens,
3. output the final winner token (Omidi et al., 3 Mar 2026).

This effectively increases the layer count seen by the mean-score detector. Because mean-score detectability eventually declines with $m' = 2^m$3, the attack reduces the detector’s ability to classify truly watermarked text as watermarked (Omidi et al., 3 Mar 2026). Empirically, on 1,000 known-watermarked ELI5 prompts that were all initially correctly detected, adding 5 additional layers produced post-attack TPRs of $m' = 2^m$4 for GPT-2B, $m' = 2^m$5 for Gemma-7B, and $m' = 2^m$6 for Mistral-7B. Mean scores dropped from an average of $m' = 2^m$7, above the threshold $m' = 2^m$8 calibrated for $m' = 2^m$9, to $r_t = h(x_{t-H},\dots,x_{t-1},k),$00, below threshold (Omidi et al., 3 Mar 2026).

A different robustness picture emerges in work focused on downstream editing. SynGuard argues that SynthID-Text is fundamentally brittle under meaning-preserving attacks because its watermark signal is largely lexical or token-level rather than semantic (Han et al., 27 Aug 2025). On unchanged text, SynthID-Text is reported as nearly perfect, with TPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$01, FPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$02 or $r_t = h(x_{t-H},\dots,x_{t-1},k),$03, and F1 $r_t = h(x_{t-H},\dots,x_{t-1},k),$04 or $r_t = h(x_{t-H},\dots,x_{t-1},k),$05, depending on the table (Han et al., 27 Aug 2025). Under attack, however, the reported degradation is substantial.

For synonym substitution, SynthID-Text remains relatively robust: at substitution ratio $r_t = h(x_{t-H},\dots,x_{t-1},k),$06, TPR is $r_t = h(x_{t-H},\dots,x_{t-1},k),$07, FPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$08, and F1 $r_t = h(x_{t-H},\dots,x_{t-1},k),$09; at $r_t = h(x_{t-H},\dots,x_{t-1},k),$10, TPR is $r_t = h(x_{t-H},\dots,x_{t-1},k),$11, FPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$12, and F1 $r_t = h(x_{t-H},\dots,x_{t-1},k),$13 (Han et al., 27 Aug 2025). For paraphrasing with Dipper, the strongest reported setting lex=10, order=5 yields TPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$14, FPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$15, and F1 $r_t = h(x_{t-H},\dots,x_{t-1},k),$16 (Han et al., 27 Aug 2025). For back-translation, the most severe reported result is with Chinese as pivot language, where TPR is $r_t = h(x_{t-H},\dots,x_{t-1},k),$17, FPR $r_t = h(x_{t-H},\dots,x_{t-1},k),$18, and F1 $r_t = h(x_{t-H},\dots,x_{t-1},k),$19 (Han et al., 27 Aug 2025). Copy-and-paste dilution is reported as particularly pathological because TPR remains high while FPR becomes very large; at ratio $r_t = h(x_{t-H},\dots,x_{t-1},k),$20, AUC is reported as 0.62, and at ratio $r_t = h(x_{t-H},\dots,x_{t-1},k),$21 or higher the AUC drops to around or below 0.5 (Han et al., 27 Aug 2025).

These results support a distinction between two robustness notions. One concerns detector robustness to stacked or repeated application of the watermarking mechanism, where the mean score is vulnerable and the Bayesian score is stronger (Omidi et al., 3 Mar 2026). The other concerns robustness to post-generation transformations that preserve meaning while altering surface realization, where SynthID-style token-level evidence can be weakened by paraphrasing, copy-paste dilution, and back-translation (Han et al., 27 Aug 2025). This suggests that robustness for production watermarking must be specified with respect to the adversary class rather than treated as a single property.

6. Empirical validation, deployment considerations, and comparative context

The empirical validation in the formal analysis paper is designed to test theoretical predictions rather than introduce a new benchmark. It follows SynthID-Text’s public implementation and uses the ELI5 dataset, 1,000 texts, 100 generated tokens per text, default $r_t = h(x_{t-H},\dots,x_{t-1},k),$22, default tournament layers $r_t = h(x_{t-H},\dots,x_{t-1},k),$23, temperature $r_t = h(x_{t-H},\dots,x_{t-1},k),$24, and the models Gemma-7B, GPT-2B, and Mistral-7B (Omidi et al., 3 Mar 2026). The main observed pattern matches the theory closely. For the mean score, TPR first rises and then falls as the number of layers increases. The clearest example is Gemma-7B, where TPR rises from $r_t = h(x_{t-H},\dots,x_{t-1},k),$25 to $r_t = h(x_{t-H},\dots,x_{t-1},k),$26 as $r_t = h(x_{t-H},\dots,x_{t-1},k),$27 increases from $r_t = h(x_{t-H},\dots,x_{t-1},k),$28 to $r_t = h(x_{t-H},\dots,x_{t-1},k),$29, then falls to $r_t = h(x_{t-H},\dots,x_{t-1},k),$30 at $r_t = h(x_{t-H},\dots,x_{t-1},k),$31 layers (Omidi et al., 3 Mar 2026). For the Bayesian score, TPR rises monotonically and then saturates, consistent with the theoretical corollaries (Omidi et al., 3 Mar 2026).

The CLT assumption underlying the mean-score theory is also checked empirically. On 1,000 test samples and 30 layers, the paper applies the Anderson–Darling normality test to mean-score distributions and reports that the data passes the normality test across the tested models (Omidi et al., 3 Mar 2026). The same paper notes, however, that CLT-based approximations may be poor for short texts, and that short-sequence detectability remains weak across watermarking methods; it cites SynthID-Text’s maximum TPR around $r_t = h(x_{t-H},\dots,x_{t-1},k),$32 at $r_t = h(x_{t-H},\dots,x_{t-1},k),$33 for 50-token texts from the original Google work (Omidi et al., 3 Mar 2026).

Comparative deployment-oriented work places SynthID-Text in a broader systems context. TextSeal presents SynthID-Text as “the state-of-the-art generation-time, distortion free and non deterministic watermark” and a direct practical baseline (Sander et al., 12 May 2026). In its main comparison setup—Qwen 3.5-27B, 1k ELI5 prompts, 400 tokens, temperature $r_t = h(x_{t-H},\dots,x_{t-1},k),$34, top-$r_t = h(x_{t-H},\dots,x_{t-1},k),$35, and SynthID depth 10 by default—TextSeal claims to “strictly dominate” SynthID on the diversity–detectability frontier, to support localized detection in mixed documents, and to incur lower sampling overhead (Sander et al., 12 May 2026). It also states that SynthID’s iterative tournament sampling costs about 0.60–0.63 ms/token, whereas TextSeal’s sampling cost is about 0.43–0.46 ms/token (Sander et al., 12 May 2026).

That comparison must be interpreted with care. TextSeal does not use SynthID’s Bayesian detector; it implements a frequentist Z-test instead, specifically because it wants threshold-independent comparison, valid FPR control, and compatibility with localized multi-window testing (Sander et al., 12 May 2026). The paper therefore compares deployment suitability under its chosen statistical requirements rather than reproducing the original intended SynthID detector (Sander et al., 12 May 2026). This is relevant because the formal analysis of SynthID identifies the Bayesian score, not the mean score or a simple Z-test, as the detector that remains robust as layers increase (Omidi et al., 3 Mar 2026).

Two practical implications follow from the combined literature. First, SynthID-Text’s reliability depends strongly on the detector family and on how tournament depth is handled in deployment (Omidi et al., 3 Mar 2026). Second, even a production-ready distortion-free watermark with strong benign detectability can remain vulnerable to localized mixing, paraphrasing, and translation when the signal is tied primarily to token-level realizations (Han et al., 27 Aug 2025, Sander et al., 12 May 2026). A plausible implication is that future watermark designs will increasingly be evaluated not only by full-document TPR@FPR in benign settings, but also by self-robustness under composition, calibrated detection under localization, and resilience to meaning-preserving transformations.

7. Position within the watermarking literature

Within the recent literature, SynthID-Text occupies a distinctive position as a production-oriented generative watermark whose watermark is embedded during decoding rather than through architectural changes. Theoretical work on the system emphasizes that it should not be conflated with the later mathematical results about it. The original SynthID design contributes the generative watermarking framework, tournament-based token sampling, support for both distortionary and non-distortionary modes, $r_t = h(x_{t-H},\dots,x_{t-1},k),$36-value functions and collision probabilities, mean-score and Bayesian-score detector families, and the single-layer watermarked $r_t = h(x_{t-H},\dots,x_{t-1},k),$37-distribution formulas. The later analysis contributes the first CLT-based detectability theory, threshold and TPR formulas for Bernoulli and Uniform $r_t = h(x_{t-H},\dots,x_{t-1},k),$38-distributions, the theorem that mean-score TPR is unimodal in layer count and converges back to FPR, the theorem that Bayesian-score TPR is monotone non-decreasing in layers and saturates, the proof that $r_t = h(x_{t-H},\dots,x_{t-1},k),$39 is optimal among Bernoulli choices for mean-score detection, and the layer inflation attack (Omidi et al., 3 Mar 2026).

Comparative systems papers position SynthID-Text as both a benchmark and a design point to move beyond. TextSeal treats it as a leading distortion-free practical watermark but argues for stronger statistical guarantees, localization, and lower overhead (Sander et al., 12 May 2026). SynGuard treats it as a strong lexical probabilistic watermark whose benign-setting detectability is excellent but whose provenance signal is brittle under paraphrasing, copy-paste dilution, and back-translation, and therefore augments it with a semantic watermark channel (Han et al., 27 Aug 2025).

Taken together, these works define SynthID-Text as both a deployed system and a research object. Its tournament-sampling formulation and score-based detection established a practical watermarking architecture for LLM outputs (Omidi et al., 3 Mar 2026). Subsequent analysis showed that its performance profile depends critically on whether detection collapses the layer signal to a mean statistic or preserves the full likelihood structure (Omidi et al., 3 Mar 2026). Later comparative and robustness studies further suggest that production-grade provenance systems will be judged not only by detectability under benign generation, but also by false-positive control, localization in mixed documents, robustness to semantic-preserving rewrites, and resistance to adversarial composition (Sander et al., 12 May 2026, Han et al., 27 Aug 2025).