- SynthID is Google DeepMind's AI watermark. It embeds an invisible, machine-readable signal into content at the moment of generation, not as a post-processing step.
- It works differently per medium: pixels for image and video, an inaudible signal for audio, and a shift in word-choice probabilities for text.
- It ships by default across Imagen, Veo, Lyria, and Gemini image output, and Google reports having watermarked more than 10 billion pieces of content.
- You check for it with Google's SynthID Detector portal, which returns a likelihood, not a yes/no certainty.
- It is an in-band statistical signal, not a cryptographic seal. It resists ordinary handling but can be weakened, and a missing mark proves nothing. That is why it pairs with, rather than replaces, C2PA Content Credentials.
Almost every image, clip, track, or paragraph produced by a Google model now leaves the building with an invisible tag inside it. That tag is SynthID, built by Google DeepMind, and it has quietly become one of the largest deployments of AI watermarking in the world. If you want to understand how the industry plans to label synthetic media, SynthID is the reference implementation to understand first, including the point where it stops being enough.
What SynthID is
SynthID is a watermarking system for AI-generated content. The important word is generation: instead of stamping a mark onto a finished file the way you would add a logo, SynthID is woven into the model's output as it is being produced. The result is a signal that is invisible to a person, embedded throughout the content rather than sitting in a corner, and readable by a matching detector that knows what to look for. Google applies it by default across its generative models, and in most consumer products you cannot turn it off.
How SynthID works, by modality
There is no single SynthID. It is a family of techniques, one per medium, tuned to hide a recoverable pattern where that medium can carry it:
- Images and video. The watermark lives in the pixels, as tiny adjustments spread across the frame in a pattern the eye cannot see but a detector can. Because it is distributed rather than localized, cropping or resizing does not simply cut it out.
- Audio. The mark is embedded in the sound itself as an inaudible signal. Google states it is designed to survive common changes like MP3 compression, added noise, and speed changes.
- Text. This is the subtle one. As the model picks each next word, SynthID nudges the selection probabilities so that, across enough text, a statistical signature emerges. The wording stays natural and the meaning is unchanged; the pattern only becomes visible to a detector doing the math. The text method was published in Nature in 2024 and released as open source.
Which Google models use it
SynthID is not a single-product feature; it is infrastructure that rides along with Google's generative stack. Content from Imagen (images), Veo (video), Lyria (music), and the image output of Gemini is watermarked by default. Google has reported watermarking more than 10 billion pieces of content with SynthID, which gives a sense of the scale: this is not a pilot, it is the default state of a very large fraction of freshly generated media.
How you check for a SynthID watermark
Detection is the other half of the system. Google runs a public verification portal, the SynthID Detector, where you can upload an image, audio clip, video, or block of text and have it scanned for the watermark. Under the hood it is a matched filter: the detector knows the signature it embedded and measures how strongly that signature is present, then reports a likelihood. Two things follow from that design. First, the answer is a probability, not a certainty. Second, it can only find its own mark, which leads directly to the limits below.
SynthID and C2PA are not the same thing
It is easy to lump every "AI labeling" effort together, but SynthID and C2PA solve different halves of the problem, and Google participates in both. SynthID is an in-band signal: it lives inside the pixels or the audio, so it travels with the content even when metadata is stripped, but it is probabilistic and can be worn down. C2PA Content Credentials are out-of-band: a cryptographically signed manifest attached to the file that records origin and edit history, which is tamper-evident but can be removed wholesale if a platform discards metadata. One survives a screenshot and degrades under editing; the other survives editing and can be stripped by a careless re-save. The durable design is to layer them, which is the core argument of our watermarking versus Content Credentials comparison.
Where SynthID still breaks
SynthID is genuinely strong engineering, and it is far more hardened than the toy carrier in our lab. But it inherits the structural limit of everything that hides a signal inside media, and it is worth being precise about what that means rather than either overselling or dismissing it.
- It is statistical, not cryptographic. A matched-filter detector returns a confidence, and confidence can be pushed down. Google is candid that the text watermark weakens under heavy paraphrasing or translation, and independent voices have argued that for watermarking to be trustworthy at all it must be durable enough to be "watertight", a bar no in-band method fully clears.
- Editing degrades it silently. Aggressive transformation, re-generation, or adversarial removal can attenuate the mark, and when it fades, nothing in the file announces that it happened. There is measurable public search demand for "SynthID remover" tools, which tells you the fragility is being probed in the wild, not just in papers.
- A missing mark proves nothing. SynthID only tags output from participating Google models. A real photograph, a hand illustration, or an image from a different AI tool carries no SynthID signal, so its absence is not evidence of authenticity. The watermark answers "did a Google model make this," never "is this real."
None of that makes SynthID a failure. It makes it one layer. At population scale, as a default-on signal across billions of assets, it does real work. As the only thing standing between a viewer and a decision that matters, an in-band watermark is the wrong single point of trust.
See an in-band watermark break for yourself
The fastest way to understand SynthID's one weakness is to watch the same class of signal fail under your own hand. In the interactive lab, a hidden watermark reads as fully present, then drops toward chance after a single ordinary edit, with no warning in the file. That is the mechanism, shown on a carrier we control. Then read the white paper for why the durable answer layers a signed, tamper-evident record on top of the in-band mark. Watermarking tells you something was probably AI-made. Provenance lets you prove how it was made.
Frequently asked questions
What is SynthID?
SynthID is Google DeepMind's watermarking technology for AI-generated content. It embeds an invisible, machine-readable signal into images, video, audio, and text at the moment a Google model generates them. It ships by default across Google's generative models and usually cannot be switched off by the user.
How does SynthID work?
It is built into generation, not added afterward. For images and video it alters pixels in an invisible pattern; for audio it embeds an inaudible signal; for text it shifts the model's word-choice probabilities without changing meaning. A matched-filter detector then looks for that known pattern and reports how likely the content is to carry a SynthID mark.
Can SynthID be removed?
It is designed to survive compression, cropping, and mild noise, and it is far harder to strip than a visible logo. But it is an in-band statistical signal, so aggressive editing, heavy paraphrasing of text, or regeneration can weaken it, and there is active demand for removal tools. It resists ordinary handling; it is not indestructible.
Does a missing SynthID watermark mean an image is real?
No. SynthID only marks content from participating Google models, so a real photo, a human drawing, or an image from a non-Google AI tool carries no mark at all. Its absence proves nothing about authenticity. That gap is exactly what signed C2PA Content Credentials are designed to close.