SynthID-Text Is Live in Gemini and Claude. There Is Still No Detection API.

Two of the three largest language model providers now watermark the text they generate. Google has been doing it in Gemini since 2024. Anthropic switched it on for Claude on 14 August 2026. Both use the same underlying method, SynthID-Text, published in Nature by Google DeepMind.

If you want to check whether a given paragraph carries either watermark, you cannot. Not through an API, not through a portal, not with an open source tool. The mark is there, it is machine-readable in principle, and the only machines that can read it belong to the two companies that put it there.

That gap matters more than it did a year ago, because the EU AI Act now has a marking deadline with a date on it, and a number of people have started buying tools that claim to close the gap and do not.

What SynthID-Text Actually Does

It is worth being precise, because most of what is written about AI text watermarking is wrong in the same specific way.

SynthID-Text does not add anything to the text. There are no zero-width characters, no unusual Unicode, no invisible markers, no telltale punctuation, and no extra tokens. Anthropic says this in as many words, and it is true of the method generally. If you have ever seen advice to strip invisible characters to defeat an AI watermark, that advice is aimed at a thing that does not exist here.

What it does instead is change how the model picks words.

When a language model generates text, it produces a probability distribution over the next token and samples from it. SynthID-Text intervenes at that sampling step. A sliding window of the last few tokens, typically four, is hashed together with a secret watermarking key to produce a seed. That seed drives a set of pseudorandom scoring functions, the g-functions. The algorithm draws candidate tokens and runs them through a series of tournament layers, where each layer scores the competing candidates with a g-function and the winner advances. The token that wins the tournament is the one that gets emitted.

The result is that across a long enough passage, the emitted tokens correlate with the g-values in a way that random human word choice would not. Detection is then a statistical test: recompute the g-values over the text and ask whether the mean is higher than chance would allow. The published detectors come in three flavours, a plain mean score, a weighted mean, and a Bayesian detector trained on watermarked and unwatermarked samples, which is the strongest of the three.

Two properties follow from this design and explain almost everything else.

First, detection does not require the model. You do not need to run Gemini to check Gemini text. This is what makes the scheme cheap enough to deploy, and it is a genuine advance over post hoc classifiers.

Second, detection does require the key. The g-functions are seeded by it. Without the watermarking key, the g-values you compute are unrelated to the ones used at generation, and the test returns noise. This is not an implementation gap that someone will close. It is the security property that stops anyone from forging Google's watermark onto text Google did not write.

The whole detection problem sits in that second property.

Who Watermarks Text Today

The picture as of August 2026, restricted to things confirmed by the providers themselves:

Google Gemini. Watermarked since the Nature paper described the first at-scale deployment, covering Gemini and Gemini Advanced. Google staff confirmed on the official developer forum that text generated through the Gemini API, Google AI Studio and Antigravity is watermarked too. That answer was given after an initial incorrect answer to the contrary, which is a fair signal of how thinly this is documented.

Anthropic Claude. Live globally from 14 August 2026, on Claude models released on or after 2 August 2026, with older models to follow. Anthropic describes it as a version of the SynthID-Text approach and traces the idea back to Scott Aaronson's 2022 proposal. Anthropic also attaches signed C2PA credentials to generated image files, which is a separate mechanism.

OpenAI. No text watermark. OpenAI built one, reported by the Wall Street Journal in 2024 to be highly accurate, and shelved it. The stated concerns were that it held up poorly against translation and global rewriting, and that it might disproportionately flag non-native English writers. OpenAI does attach C2PA Content Credentials to generated images.

Everyone else. Open weight models carry no watermark unless whoever runs them adds one, and nothing stops them removing it. This is the structural hole the Nature paper itself names: watermarking only works where providers cooperate, and open models cannot be made to cooperate.

The alignment of the two live deployments on 2 August 2026 is not a coincidence. That is the date Article 50 of the EU AI Act became applicable.

The Tools That Exist, and What Each One Is Good For

This is the part worth getting right, because the search results for this topic are heavily polluted.

google-deepmind/synthid-text on GitHub. The reference implementation from the Nature paper, Apache 2.0. It watermarks and detects, and it includes the Bayesian detector training code. It supports Gemma and GPT-2 through mixin classes. The README is explicit that this is for research reproducibility, that the mixins are not designed for production, and that the hashing function offers no cryptographic security guarantees. Useful, honest, and not a detector for anyone else's text.

Hugging Face Transformers. The production-grade path Google points at. SynthIDTextWatermarkingConfig and SynthIDTextWatermarkLogitsProcessor let you generate watermarked text from a model you control by passing a list of keys and an n-gram length. If you hold the keys, you can detect. This is the only route by which a normal engineering team gets working end-to-end text watermarking today, and it only covers text your own system generated.

MarkLLM. An academic toolkit from THU-BPM that implements many watermarking algorithms behind one interface, including KGW, Unigram, EXP and SynthID-Text with its mean, weighted mean and Bayesian detectors. If you are evaluating schemes rather than shipping one, this is where to start.

SynthID Detector portal. Google's upload-and-check tool, opened to early testers at I/O in May 2026 through a waitlist for journalists, researchers and media professionals. Google's own support documentation for verification describes images, video and audio. Text is not in the supported list, and the developer forum thread on API watermarking states plainly that the portal does not accept it.

Google's Content Detection API. Previewed in 2026 on the Gemini Enterprise platform to named partners including Shutterstock, Snap, Canva and Fox Sports. It is images only, JPEG, PNG and WebP. No text, no general availability date, no published pricing.

Anthropic's detection API. Announced as coming, with no timeline and no implementation details. When it ships it will presumably answer for Claude text and nothing else.

C2PA Content Credentials. Not a watermark at all, and complementary rather than competing. It is cryptographically signed provenance metadata: who made this, with what tool, when, and was an AI system involved, recorded in a digitalSourceType field. Version 2.3 added manifests for plain text documents, which is new and relevant. The weakness is the mirror image of watermarking's: metadata is trivially stripped by copy and paste, which is exactly how text travels.

And then there is what is not a tool.

A large number of sites rank for "SynthID detection API" and describe a product you enable in Google Cloud Console, with per-request pricing and sub-second text latency. No such product appears in Google Cloud's documentation. At least one of those sites is content marketing for a watermark removal service. Separately, sites offering to check text for SynthID are running statistical AI detectors, which do not read the watermark and cannot, because they do not have the key. They score writing for predictability and rhythm. That is a different thing wearing the same word.

How Well Does It Work

The honest answer is that it works well on long, unedited, high-entropy text and degrades quickly outside those conditions. The numbers are public and they are not flattering.

Length. Detection is a statistical test, so evidence accumulates with tokens. A theoretical analysis of SynthID-Text published in 2026 puts detection at roughly 0.3 true positive rate at a 1 percent false positive rate on 50-token texts, and runs its own experiments on 100 to 400 token sequences. A tweet, a product description or a support reply is not enough text.

Entropy. The watermark lives in the model's freedom to choose. Where there is one right answer, there is no room to encode anything. Anthropic states this directly: the mark is sparser on factual passages, and on code where syntax and arithmetic must be exact. Ask a model to correct your grammar and the watermark can only live in the handful of corrections, which may be too few to register.

Paraphrasing. This is the weak point. A robustness assessment found SynthID's true positive rate falling from 0.998 on clean text to 0.498 under moderate paraphrasing. ETH Zurich's SRI Lab reported over 90 percent scrubbing success with standard paraphrasing, rising to near 100 percent when assisted by watermark stealing, and noted that tournament sampling, a security feature, makes token boosting more sensitive to rewrites and therefore less robust than simpler schemes. A 2026 evaluation against forensic standards measured 98.3 percent removal under meaning-preserving paraphrase while semantic similarity stayed around 0.83.

False positives. The same forensic evaluation measured a 5.4 percent false positive rate on clean human text, with 93.6 percent verdict instability under small changes to the detection threshold, and found a standard typing-test sentence crossing the threshold. It concluded that none of the three schemes it tested, KGW, Unigram and SynthID-Text, satisfies more than two of the five Daubert factors for expert evidence.

Spoofing. SynthID-Text holds up better here than the alternatives. The SRI Lab work reports a 4 percent spoofing success rate at default parameters against 80 percent or more for red-green schemes, though success rose to 15 percent as attacker queries went from 30,000 to 90,000. The same work also showed that the presence of the watermark is itself detectable from black-box queries, so keeping deployment secret is not an option.

Put together: a positive result on a long passage is meaningful evidence. A negative result means almost nothing, because it is equally consistent with human writing, with an unwatermarked model, with a short sample, or with a paraphrase. Anyone building a workflow on this needs to internalise that asymmetry before they build the UI.

What the Law Is Asking For

Three regimes now demand something in this area, and none of them quite matches what is deployed.

EU AI Act, Article 50(2). Providers of AI systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as artificially generated. The marking must be effective, interoperable, robust and reliable as far as technically feasible. Article 50 became applicable on 2 August 2026, and the marking and labelling requirements land on 2 December 2026, with the grace period for systems already on the market before 2 August 2026 expiring on that date. The Code of Practice points at a layered approach combining metadata, watermarking and logging. It does not name C2PA, though it describes its properties closely enough that observers have noted C2PA is currently the only deployed technology that fits. We covered the wider Article 50 picture in our EU AI Act transparency guide.

Note the word interoperable. A watermark only its author can read is a strange fit for that requirement, and this tension is unresolved.

China. The Labelling Measures for AI-Generated Synthetic Content took effect on 1 September 2025 and are the most concrete of the three. They require both an explicit label, visible to the user, and an implicit label in the file metadata. Text is in scope. Platforms must provide labelling functions, and users publishing AI-generated content must declare it.

California. The AI Transparency Act, SB 942 as amended by AB 853, became operative on 2 August 2026 for providers with more than a million monthly users. It requires a free detection tool, a visible manifest disclosure and an embedded latent disclosure carrying provider name, system name and version, timestamp and a unique identifier. Read the scope carefully: the latent disclosure obligation runs to image, video and audio. Text is not in it. From 1 January 2027, large online platforms must surface provenance data and must not knowingly strip it.

The pattern across all three is the same. The law asks for marks that can be detected, and the deployed text marks can only be detected by their authors. Either detection opens up, or the text obligations get satisfied by C2PA-style metadata that survives a copy and paste roughly never.

What This Means If You Build Software

Most of this is not a compliance project. It is a handful of engineering decisions that are cheap now and expensive to retrofit.

Do not buy a detector as a verdict. If a supplier claims to detect SynthID in arbitrary text, they cannot, and you should ask them for the key. If you already run AI detection on user submissions, treat the score as triage that routes to a human, never as a finding. The evidence against consequential use is strong: a Stanford study found detectors misclassifying more than half of TOEFL essays by non-native English writers as AI-generated, and a growing list of universities has disabled these tools after they flagged human work at 100 percent confidence. Building a policy on top of that is a liability, not a control.

Stop stripping provenance metadata. This is the single most common self-inflicted wound. Image pipelines routinely re-encode, resize and normalise assets, and most of them discard C2PA manifests and XMP along the way. Under Article 50(2) that is you removing the marking the law wants preserved, and from January 2027 in California it is a platform obligation. Audit the pipeline, preserve the manifest or re-sign after transformation. Now that C2PA 2.3 supports plain text documents, the same discipline is about to apply to text assets.

Keep your own provenance record. This is the part that actually works. Whatever the watermark does, your system knows which model generated what, when, with which prompt, and who reviewed it. Store it as a field on the record. It is the evidence for the Article 50 human-review exemption, it is what you hand a regulator or a customer, and it does not depend on anyone shipping an API.

If you self-host, you can have the whole loop. A team running its own model on Hugging Face Transformers can watermark generation and detect it, because it holds the keys. If you generate content at volume and need to recognise your own output later, this is available today and nobody is selling it to you.

Ask vendors the right question. Not "do you watermark", which is now usually yes and tells you nothing. Ask whether the mark is detectable by you or only by them, what happens to it under editing and translation, whether C2PA metadata is attached and to which formats, and what they will contractually say about Article 50(2) after 2 December 2026.

Where This Goes

The technology is real and the Nature result is a genuine piece of engineering: a watermark that costs half a percent of latency, survives an assessment across roughly 20 million live Gemini responses without measurably changing user satisfaction, and detects without touching the model. That is not nothing.

The deployment is also, for now, closed. Two providers watermark text, neither lets anyone else read the mark, the third built one and shelved it, and open models sit outside the system entirely. The gap between what the marking rules ask for and what a person outside those companies can actually verify is the interesting problem, and it is not a technical one.

Our advice to clients is to spend nothing on detection and something on provenance. Detection you cannot run and cannot trust is not a control. A clean record of what your own systems generated, and an asset pipeline that stops destroying the metadata already attached, is work you control, and it is what the 2 December 2026 deadline actually touches. For where this sits among everything else landing between now and 2028, see our 2026 EU digital compliance guide.

We build AI features into products for companies operating in Europe, which means provenance fields, asset pipelines that preserve credentials and audit trails are part of normal delivery rather than a separate exercise. If you want a look at where AI-generated content enters your product and what happens to its provenance on the way out, write to office@c9group.dev.

We are engineers, not lawyers. Whether a specific obligation attaches to you as provider or deployer belongs with your counsel. We make sure the system matches the answer.