---
title: 'SynthID-Text: Industrial Watermarking'
url: https://www.emergentmind.com/topics/synthid-text
type: topic
---

# SynthID-Text: Industrial Watermarking

SynthID-Text is a generative watermarking system for large language model outputs that embeds a detectable signal during decoding without changing the LLM architecture. It is described as the first production-ready, industrial-scale text watermark for LLMs, already deployed in Google systems such as Gemini, and its defining mechanism is a secret-seeded **Tournament Sampling** procedure coupled with detector score functions over hidden pseudorandom token-level signals [2603.03410]. In the literature summarized here, SynthID-Text is treated as a distortion-free, non-deterministic, generation-time watermarking system whose practical significance derives from its deployment orientation, while its main technical questions concern detectability, detector design, robustness under composition and downstream editing, and compatibility with production inference stacks [2603.03410] [2605.12456].

## 1. Definition and system model

SynthID-Text operates in the standard next-token generation setting. At generation step \(t\), it derives a secret-conditioned seed
\[
r_t = h(x_{t-H},\dots,x_{t-1},k),
\]
where \(h\) is a hash function, \(H\) is the context window used for seeding, and \(k\) is the secret key [2603.03410]. Using this seed, it computes layer-specific pseudorandom watermark values \(g_\ell(x_t,r_t)\) for candidate next tokens. These \(g\)-values are intended to resemble IID draws from a base distribution such as Bernoulli or Uniform, and watermark embedding occurs through the sampling rule rather than by modifying the model architecture [2603.03410].

The system is presented as differing from earlier text watermarking approaches such as green-list/red-list biasing or Gumbel-style methods in three respects: a new **Tournament Sampling** embedding algorithm, a detection strategy organized around a **score function**—especially the **mean score** and **Bayesian score**—and a unified design supporting both **non-distortionary** and **distortionary** watermarking [2603.03410]. The theoretical analysis in the main paper focuses primarily on the non-distortionary variant, which is described there as the practical and currently deployed setting [2603.03410].

In subsequent comparative work, SynthID-Text is repeatedly positioned as one of the strongest practical baselines for distortion-free watermarking. TextSeal describes it as a distortion-free, non-deterministic generation-time watermark deployed in Gemini, and treats it as one of the two best practical baselines alongside Gumbel-max [2605.12456]. SynGuard, by contrast, models SynthID-Text as a probabilistic token-level watermark based on keyed pseudorandom \(g\)-values and tournament sampling, and takes that lexical dependence to be the source of both its benign-setting strength and its brittleness under meaning-preserving transformations [2508.20228].

## 2. Tournament Sampling and watermark embedding

The core architectural novelty of SynthID-Text is its tournament-based embedding procedure. At token position \(t\), the generator samples
\[
m' = 2^m
\]
candidate tokens from the base language model distribution \(p_{LM}(\cdot \mid x_{<t})\), allowing repeats, and places them into an \(m\)-layer knockout tournament [2603.03410]. At each layer \(\ell \in \{1,\dots,m\}\), every surviving token \(\bar x\) receives a layer-specific pseudorandom score \(g_\ell(\bar x,r_t)\). Candidates are paired, the token with larger \(g_\ell(\cdot,r_t)\) wins, ties are broken uniformly at random, and the winners advance until a single token remains and becomes the generated token \(x_t\) [2603.03410].

This mechanism means that the watermark is not injected through explicit logit boosts for a designated token subset. Instead, it emerges from repeated pairwise elimination under secret-conditioned layer signals. The core notation used throughout the analysis is:
- seed: \(r_t = h(x_{t-H},\dots,x_{t-1},k)\),
- layer score: \(g_{t,\ell} = g_\ell(x_t,r_t)\),
- \(m\) tournament layers over \(2^m\) sampled candidates [2603.03410].

A central analytic quantity is the layer collision probability
\[
C_p = \sum_{i=1}^N p_i^2,
\]
the probability that two IID draws from a discrete distribution \(p=(p_1,\dots,p_N)\) are equal [2603.03410]. Layer-specific collision probabilities \(C_{t,\ell}\) determine the extent to which tournament selection shifts the \(g\)-value distribution upward. If \(F_g\) is the CDF of the unwatermarked base \(g\)-distribution, then the watermarked single-layer CDF is
\[
F_{gw}(g_{t,\ell}) = C_{t,\ell} F_g(g_{t,\ell}) + (1-C_{t,\ell})F_g(g_{t,\ell})^2.
\]
For continuous \(g\),
\[
f_{gw}(g_{t,\ell}) = f_g(g_{t,\ell})\left[C_{t,\ell}+2(1-C_{t,\ell})F_g(g_{t,\ell})\right],
\]
and for discrete \(g\),
\[
f_{gw}(g_{t,\ell}) = f_g(g_{t,\ell})\left[C_{t,\ell}+(1-C_{t,\ell})(2F_g(g_{t,\ell})-f_g(g_{t,\ell}))\right].
\]
These formulas formalize the intuition that tournament winners are statistically enriched for larger \(g\)-values [2603.03410].

The analysis concentrates on two base \(g\)-distributions used in SynthID-Text:
- \(g_{t,\ell}\sim \mathrm{Bernoulli}(0.5)\),
- \(g_{t,\ell}\sim \mathrm{Uniform}(0,1)\) [2603.03410].

TextSeal summarizes SynthID-Text at a higher level as watermarking via “multi-layered tournament sampling with binary random functions,” and attributes to its iterative procedure \(d\) sequential rounds of top-\(p\) reweightings and a multinomial sampling step [2605.12456]. SynGuard similarly abstracts the mechanism as sampling candidates from \(p_{LM}\), evaluating each candidate with \(m\) independent pseudorandom binary functions \(g_l(x,r)\in\{0,1\}\), and preferring candidates with statistically high aggregate \(g\)-scores while preserving fluency [2508.20228]. This suggests that later analyses often work with a simplified operational abstraction of the original tournament process even when they do not reproduce its full mathematical detail.

## 3. Detection framework: mean score and Bayesian score

Detection in SynthID-Text is formulated as deciding whether a text \(x=(x_1,\dots,x_T)\) is watermarked. Given the secret key, the detector recomputes the token-level pseudorandom \(g\)-values and applies a score function [2603.03410].

The simplest detector is the **mean score**,
\[
\text{MS}(x)=\frac{1}{Tm}\sum_{t=1}^T\sum_{\ell=1}^m g_\ell(x_t,r_t).
\]
For both Bernoulli\((0.5)\) and Uniform\((0,1)\), the unwatermarked expected mean score is \(0.5\), while watermarked text tends to score above \(0.5\) [2603.03410].

The more structured detector is the **Bayesian score**, which treats watermark detection as a binary hypothesis test with hypotheses \(w\) and \(\neg w\). Its posterior log-odds are
\[
\log \frac{P(w\mid g)}{P(\neg w\mid g)} = \log \frac{P(g\mid w)}{P(g\mid \neg w)}+\log\frac{P(w)}{1-P(w)},
\]
and the corresponding score is
\[
\text{BS}(x)=\sigma\!\left(\log P(g\mid w)-\log P(g\mid \neg w)+\log P(w)-\log(1-P(w))\right).
\]
Equivalently, if
\[
X=\frac{P(g\mid w)}{P(g\mid \neg w)},\qquad \alpha=\frac{P(w)}{P(\neg w)},
\]
then
\[
\text{BS}(x)=\sigma(\log(\alpha X))=\frac{\alpha X}{\alpha X+1}.
\]
The likelihood factorization used in the analysis is
\[
P(g\mid \neg w)=\prod_{t=1}^T\prod_{\ell=1}^m f_g(g_{t,\ell}),
\]
and
\[
P(g\mid w)=\prod_{t=1}^T\prod_{\ell=1}^m \sum_{c=1}^{2}P(g_{t,\ell}\mid \psi_{t,\ell}=c)\,P(\psi_{t,\ell}=c\mid g_{t,<\ell}),
\]
where \(\psi_{t,\ell}\) is the number of unique tokens at layer \(\ell\), timestep \(t\) [2603.03410].

The evaluation metric used throughout the main theoretical paper is **TPR at fixed FPR**, typically with \(\mathrm{FPR}=1\%\). Formally,
\[
\mathbb{E}[\mathrm{TPR}(\tau)] = p_w(x\ge \tau)=1-CDF_w(\tau), \qquad
\mathbb{E}[\mathrm{FPR}(\tau)] = p_{\neg w}(x\ge \tau)=1-CDF_{\neg w}(\tau),
\]
and a threshold \(\tau(\epsilon)\) is chosen such that \(\mathrm{FPR}=\epsilon\) [2603.03410].

| Detector | Definition | Reported property |
|---|---|---|
| Mean score | Average of all \(g_\ell(x_t,r_t)\) over tokens and layers | Simpler, but vulnerable as layers increase |
| Bayesian score | Posterior score from likelihood ratio \(P(g\mid w)/P(g\mid \neg w)\) | More robust with respect to added layers |

TextSeal places substantial emphasis on the distinction between detector families. It states that SynthID-Text proposes both a frequentist Z-test and a Bayesian detector, but uses a frequentist Z-test in its own comparisons because it regards the Bayesian detector as lacking controlled false-positive guarantees, being distribution-dependent, and being incompatible with localized multi-window testing [2605.12456]. By contrast, the theoretical analysis of SynthID-Text identifies the Bayesian score as the more robust detector within the original framework [2603.03410]. The tension here is methodological rather than contradictory: one line of work emphasizes likelihood-based robustness inside the SynthID design, while another emphasizes frequentist calibration and localization for cross-system comparison.

## 4. Theoretical analysis of detectability and layer dependence

A major contribution of the formal analysis is the use of Lyapunov’s CLT to model the mean score as approximately Gaussian under standard independence assumptions and moderate text length:
\[
\text{MS}(x)\sim \mathrm{Normal}\!\left(\mathbb{E}[\text{MS}(x)],\mathrm{Var}[\text{MS}(x)]\right)
\]
[2603.03410]. This approximation enables threshold and TPR formulas for both Bernoulli and Uniform \(g\)-distributions.

For unwatermarked text, thresholds achieving \(\mathrm{FPR}=\epsilon\) are
\[
\tau(\epsilon)=\frac{1}{2}+\frac{\Phi^{-1}(1-\epsilon)}{2\sqrt{mT}}
\qquad \text{for Bernoulli}(0.5),
\]
and
\[
\tau(\epsilon)=\frac{1}{2}+\frac{\Phi^{-1}(1-\epsilon)}{\sqrt{12mT}}
\qquad \text{for Uniform}(0,1).
\]
For approximately Gaussian mean score, the resulting TPR is
\[
\mathbb{E}[\mathrm{TPR}(\tau(\epsilon))\mid \mathrm{FPR}=\epsilon] =
1-\Phi\!\left(
\frac{\tau(\epsilon)-\mathbb{E}[\mathrm{MS}(x)\mid w]}
{\sqrt{\mathrm{Var}[\mathrm{MS}(x)\mid w]}}
\right)
\]
[2603.03410].

The central theorem for mean-score detection is that **TPR as a function of the number of layers \(m\) is unimodal**: it increases initially, then decreases, and in the limit converges back to the false positive rate [2603.03410]. The paper states two corollaries:
1. TPR is unimodal in \(m\).
2. The peak occurs at \(m=M\), and as \(m\to\infty\),
\[
\lim_{m\to\infty}\mathbb{E}[\mathrm{TPR}(\tau(\epsilon))\mid \mathrm{FPR}=\epsilon]=\epsilon.
\]

The proof intuition given is that collision probabilities \(C_{t,\ell}\) increase with layer depth, so the shift in expected watermark signal eventually saturates, while additional layers continue contributing variance. Once the mean separation no longer improves, the score distributions overlap more strongly and detectability deteriorates [2603.03410]. The paper refers to the resulting failure mode as a lack of **self-robustness**: repeatedly applying the watermarking mechanism to itself can worsen detection [2603.03410].

The Bayesian score behaves differently. Defining
\[
X_{t,\ell}=\log\left(\frac{f_{gw}(g_{t,\ell})}{f_g(g_{t,\ell})}\right),
\]
the analysis treats
\[
\log X=\sum_{t,\ell}\log\left(\frac{f_{gw}(g_{t,\ell})}{f_g(g_{t,\ell})}\right)
\]
as approximately Gaussian, so the likelihood ratio \(X=P(g\mid w)/P(g\mid \neg w)\) is approximately log-normal [2603.03410]. Under either Bernoulli\((0.5)\) or Uniform\((0,1)\), the paper’s main theorem is that **TPR under the Bayesian score is monotonically non-decreasing in the number of layers \(m\)**, with saturation once collision probabilities reach \(1\) for all tokens at a layer [2603.03410]. The asymptotic behavior is summarized as
\[
\mathbb{E}[\mathrm{BS}(x)\mid \neg w]=-\Theta(m),\qquad
\sqrt{\mathrm{Var}[\mathrm{BS}(x)\mid \neg w]}=\Theta(\sqrt m),
\]
\[
\mathbb{E}[\mathrm{BS}(x)\mid w]=\Theta(m),\qquad
\sqrt{\mathrm{Var}[\mathrm{BS}(x)\mid w]}=\Theta(\sqrt m).
\]

The same paper also generalizes the Bernoulli analysis from \(p=0.5\) to \(g\sim\mathrm{Bernoulli}(p)\) and proves that
\[
p^\star=\arg\max_{p\in(0,1)}\sqrt{p(1-p)}=\frac12,
\]
so \(\mathrm{Bernoulli}(0.5)\) is optimal among Bernoulli choices for mean-score detection at fixed FPR [2603.03410]. In that sense, the default parameter choice used in SynthID-Text is not only conventional but theoretically justified within the analyzed detection framework.

## 5. Robustness, attacks, and downstream transformations

The most specific attack introduced against SynthID-Text is the **layer inflation attack**, which exploits the unimodal dependence of mean-score TPR on the number of tournament layers [2603.03410]. The threat model assumes black-box access to the watermarked generator. The attacker does not need the watermark key and does not alter the internal embedding mechanism. Instead, the attacker composes the deployed watermarked system with an additional external tournament:
1. query the original LLM + SynthID-Text system on the same prompt \(2^N\) times,
2. run an additional \(N\)-layer tournament over the returned winner tokens,
3. output the final winner token [2603.03410].

This effectively increases the layer count seen by the mean-score detector. Because mean-score detectability eventually declines with \(m\), the attack reduces the detector’s ability to classify truly watermarked text as watermarked [2603.03410]. Empirically, on 1,000 known-watermarked ELI5 prompts that were all initially correctly detected, adding **5 additional layers** produced post-attack TPRs of \(0.05\) for GPT-2B, \(0.00\) for Gemma-7B, and \(0.01\) for Mistral-7B. Mean scores dropped from an average of \(0.548\), above the threshold \(0.515\) calibrated for \(\mathrm{FPR}=1\%\), to \(0.486\), below threshold [2603.03410].

A different robustness picture emerges in work focused on downstream editing. SynGuard argues that SynthID-Text is fundamentally brittle under meaning-preserving attacks because its watermark signal is largely lexical or token-level rather than semantic [2508.20228]. On unchanged text, SynthID-Text is reported as nearly perfect, with TPR \(=1.0\), FPR \(=0.0\) or \(0.005\), and F1 \(=1.0\) or \(0.9975\), depending on the table [2508.20228]. Under attack, however, the reported degradation is substantial.

For synonym substitution, SynthID-Text remains relatively robust: at substitution ratio \(\epsilon=0.3\), TPR is \(0.98\), FPR \(0.005\), and F1 \(0.987\); at \(\epsilon=0.7\), TPR is \(0.82\), FPR \(0.035\), and F1 \(0.884\) [2508.20228]. For paraphrasing with Dipper, the strongest reported setting `lex=10, order=5` yields TPR \(0.895\), FPR \(0.23\), and F1 \(0.842\) [2508.20228]. For back-translation, the most severe reported result is with Chinese as pivot language, where TPR is \(0.675\), FPR \(0.225\), and F1 \(0.711\) [2508.20228]. Copy-and-paste dilution is reported as particularly pathological because TPR remains high while FPR becomes very large; at ratio \(10\), AUC is reported as **0.62**, and at ratio \(20\) or higher the AUC drops to around or below **0.5** [2508.20228].

These results support a distinction between two robustness notions. One concerns **detector robustness to stacked or repeated application of the watermarking mechanism**, where the mean score is vulnerable and the Bayesian score is stronger [2603.03410]. The other concerns **robustness to post-generation transformations that preserve meaning while altering surface realization**, where SynthID-style token-level evidence can be weakened by paraphrasing, copy-paste dilution, and back-translation [2508.20228]. This suggests that robustness for production watermarking must be specified with respect to the adversary class rather than treated as a single property.

## 6. Empirical validation, deployment considerations, and comparative context

The empirical validation in the formal analysis paper is designed to test theoretical predictions rather than introduce a new benchmark. It follows SynthID-Text’s public implementation and uses the **ELI5** dataset, **1,000 texts**, **100 generated tokens per text**, default \(\mathrm{FPR}=1\%\), default tournament layers \(m=30\), temperature \(=1.0\), and the models **Gemma-7B**, **GPT-2B**, and **Mistral-7B** [2603.03410]. The main observed pattern matches the theory closely. For the **mean score**, TPR first rises and then falls as the number of layers increases. The clearest example is Gemma-7B, where TPR rises from \(0.04\) to \(0.88\) as \(m\) increases from \(1\) to \(28\), then falls to \(0.01\) at \(100\) layers [2603.03410]. For the **Bayesian score**, TPR rises monotonically and then saturates, consistent with the theoretical corollaries [2603.03410].

The CLT assumption underlying the mean-score theory is also checked empirically. On 1,000 test samples and 30 layers, the paper applies the **Anderson–Darling normality test** to mean-score distributions and reports that the data passes the normality test across the tested models [2603.03410]. The same paper notes, however, that CLT-based approximations may be poor for short texts, and that short-sequence detectability remains weak across watermarking methods; it cites SynthID-Text’s maximum TPR around \(0.3\) at \(\mathrm{FPR}=1\%\) for 50-token texts from the original Google work [2603.03410].

Comparative deployment-oriented work places SynthID-Text in a broader systems context. TextSeal presents SynthID-Text as “the state-of-the-art generation-time, distortion free and non deterministic watermark” and a direct practical baseline [2605.12456]. In its main comparison setup—**Qwen 3.5-27B**, **1k ELI5 prompts**, **400 tokens**, **temperature \(0.8\)**, **top-\(p=0.9\)**, and **SynthID depth 10 by default**—TextSeal claims to “strictly dominate” SynthID on the diversity–detectability frontier, to support localized detection in mixed documents, and to incur lower sampling overhead [2605.12456]. It also states that SynthID’s iterative tournament sampling costs about **0.60–0.63 ms/token**, whereas TextSeal’s sampling cost is about **0.43–0.46 ms/token** [2605.12456].

That comparison must be interpreted with care. TextSeal does not use SynthID’s Bayesian detector; it implements a **frequentist Z-test** instead, specifically because it wants threshold-independent comparison, valid FPR control, and compatibility with localized multi-window testing [2605.12456]. The paper therefore compares deployment suitability under its chosen statistical requirements rather than reproducing the original intended SynthID detector [2605.12456]. This is relevant because the formal analysis of SynthID identifies the Bayesian score, not the mean score or a simple Z-test, as the detector that remains robust as layers increase [2603.03410].

Two practical implications follow from the combined literature. First, SynthID-Text’s reliability depends strongly on the detector family and on how tournament depth is handled in deployment [2603.03410]. Second, even a production-ready distortion-free watermark with strong benign detectability can remain vulnerable to localized mixing, paraphrasing, and translation when the signal is tied primarily to token-level realizations [2508.20228] [2605.12456]. A plausible implication is that future watermark designs will increasingly be evaluated not only by full-document TPR@FPR in benign settings, but also by self-robustness under composition, calibrated detection under localization, and resilience to meaning-preserving transformations.

## 7. Position within the watermarking literature

Within the recent literature, SynthID-Text occupies a distinctive position as a production-oriented generative watermark whose watermark is embedded during decoding rather than through architectural changes. Theoretical work on the system emphasizes that it should not be conflated with the later mathematical results about it. The original SynthID design contributes the generative watermarking framework, tournament-based token sampling, support for both distortionary and non-distortionary modes, \(g\)-value functions and collision probabilities, mean-score and Bayesian-score detector families, and the single-layer watermarked \(g\)-distribution formulas. The later analysis contributes the first CLT-based detectability theory, threshold and TPR formulas for Bernoulli and Uniform \(g\)-distributions, the theorem that mean-score TPR is unimodal in layer count and converges back to FPR, the theorem that Bayesian-score TPR is monotone non-decreasing in layers and saturates, the proof that \(\mathrm{Bernoulli}(0.5)\) is optimal among Bernoulli choices for mean-score detection, and the layer inflation attack [2603.03410].

Comparative systems papers position SynthID-Text as both a benchmark and a design point to move beyond. TextSeal treats it as a leading distortion-free practical watermark but argues for stronger statistical guarantees, localization, and lower overhead [2605.12456]. SynGuard treats it as a strong lexical probabilistic watermark whose benign-setting detectability is excellent but whose provenance signal is brittle under paraphrasing, copy-paste dilution, and back-translation, and therefore augments it with a semantic watermark channel [2508.20228].

Taken together, these works define SynthID-Text as both a deployed system and a research object. Its tournament-sampling formulation and score-based detection established a practical watermarking architecture for LLM outputs [2603.03410]. Subsequent analysis showed that its performance profile depends critically on whether detection collapses the layer signal to a mean statistic or preserves the full likelihood structure [2603.03410]. Later comparative and robustness studies further suggest that production-grade provenance systems will be judged not only by detectability under benign generation, but also by false-positive control, localization in mixed documents, robustness to semantic-preserving rewrites, and resistance to adversarial composition [2605.12456] [2508.20228].

Source: https://www.emergentmind.com/topics/synthid-text