SynthID is a family of watermarking systems built by Google DeepMind that hides a machine-readable signal inside AI-generated images, video, audio and text. The mark is meant to be invisible to a person looking at a picture or reading a sentence, yet recoverable by a matching detector after the file has been cropped, compressed, filtered or screenshotted. It exists because the older way of recording where a file came from, metadata attached alongside the content, vanishes the moment someone takes a screenshot or a platform strips the file on upload.

The distinction Google draws around the technology is worth stating early. In the SynthID-Image paper published in October 2025, the DeepMind team argues that establishing provenance is materially different from detecting AI-generated content. A classifier that guesses whether an image looks synthetic is unreliable and, even when correct, says nothing about which system produced it. A watermark placed at the point of generation answers the origin question directly, for content produced by participating systems only.

How the image watermark is applied and read

SynthID-Image is a post-hoc, model-independent scheme. The watermark is not woven into the generative process; it is applied afterwards by a trained encoder network that adds a learned perturbation to the finished image, and read by a corresponding decoder. DeepMind chose that architecture for deployment reasons. One encoder can mark output from every current and future Google model, and the decoder can be retrained without touching any generative model. The cost is that post-hoc marking is inherently lossy, so quality tuning becomes the binding constraint.

Two things come out of the decoder. The first is a detection logit, a score indicating whether a mark is present. The second is a multi-bit payload, the hidden message that distinguishes one deployment or customer from another. SynthID-O, the external variant available to partners, encodes 136-bit payloads inside 512 by 512 pixel images. DeepMind deliberately separated detection from payload recovery, so a file can register as watermarked even when the payload is too damaged to read.

Deciding what counts as a positive is its own problem at internet scale. Rather than assume a statistical distribution over the bits, the system uses conformal p-values computed against held-out calibration sets of watermarked and unwatermarked samples, which lets both false positive and false negative rates be controlled through a variable abstention rate. Operating points are set at very low false positive rates, well under 1%, because a system scanning billions of files generates enormous absolute error volumes at 1%.

Robustness is benchmarked against 30 transformations grouped into six categories: colour changes, noise, overlays, quality loss such as compression, spatial edits such as cropping and rotation, and combinations of the above. Calibrated to a 0.1% false positive rate, SynthID-O recorded 99.72% true positive rate across worst-case transformations in aggregate, against 83.37% for the next best method tested. The weakest category for every scheme was combined transformations at maximum strength, where SynthID-O held 98.06% and the strongest rival fell to 55.96%.

Versioning follows from the architecture. The encoder fixes the version, because content already released into the world has to remain detectable, while the decoder can be updated continuously to answer new attacks. Some content is deliberately not marked at all: near-uniform images, logos with flat colour and other corner cases where an invisible watermark cannot be applied without visible artefacts.

Text, audio and video

Text works on an entirely different mechanism. SynthID-Text, described in a Nature paper published on October 23, 2024 by Sumanth Dathathri, Abigail See and colleagues, biases the model's token sampling using a scheme called tournament sampling. Candidate tokens are scored by several pseudorandom watermarking functions and compete in successive rounds, with the winner emitted. Detection later looks for the statistical fingerprint those tournaments leave behind.

The quality evidence came from production. Across close to 20 million live Gemini responses, watermarked and unwatermarked outputs showed no significant difference in user thumbs-up and thumbs-down rates in the non-distortionary configuration. DeepMind open-sourced the implementation under Apache 2.0 in October 2024 and it shipped in Hugging Face Transformers. Audio marking embeds the signal in the waveform itself rather than in a metadata field, which is how Gemini 3.5 Live Translate marks synthesised speech. Video is handled frame by frame alongside a separate audio track, which is why Gemini's verification tool can report a watermark in the audio between ten and twenty seconds while finding none in the visuals.

Origin and evolution

DeepMind announced SynthID on August 29, 2023 as a beta for a limited set of Vertex AI customers using Imagen, five weeks after several large technology companies pledged provenance work at the White House. At Google I/O in May 2024 the system was extended to text and video, and the Nature paper followed that October.

Scale arrived next. At I/O in May 2025 Google launched SynthID Detector, a verification portal, and said more than 10 billion pieces of content had been marked. By May 19, 2026 the figure was over 100 billion images and videos plus 60,000 years of audio, verification inside the Gemini app had been used 50 million times, and detection was extending to Search and Chrome. The same announcement named OpenAI, Kakao and ElevenLabs as adopters, alongside NVIDIA, which applies the mark to output from its Cosmos world foundation models, and previewed an AI Content Detection API on Google Cloud with Shutterstock, Snap, Canva and Fox Sports among trusted testers.

Why the advertising industry has a stake

The commercial relevance is regulatory. Article 50(2) of the EU AI Act obliges providers of generative systems to mark synthetic output in machine-readable form, and the Code of Practice the European Commission finalised on July 20, 2026 requires at least two marking layers for audio, images and video, plus watermarking of free-form text longer than 200 tokens. Those obligations became applicable on August 2, 2026 with penalties reaching 15 million euros or 3% of worldwide turnover. Google signed the Code on July 24, 2026, citing SynthID partnerships as its route to the interoperable detection requirement due on February 2, 2027.

For advertisers the mark is already applied whether or not they ask for it. Google embeds SynthID and C2PA markup automatically in any image or video generated inside its advertising tools, independent of the visible AI label setting introduced across five products on July 9, 2026. Documentation for that rollout placed the disclosure duty on advertisersrather than on AdSense publishers. On the content side, YouTube treats SynthID and C2PA signals as automatic triggers for AI labels, and labels derived from them cannot be adjusted by the uploader.

That matters because disclosure carries a measurable cost. An NYU Stern figure cited in the IAB's August 2026 framework found AI labelling cut click-through rates by 31.5%, while separate IAB research recorded a 37-point gapbetween advertiser assumptions and actual consumer sentiment on AI-generated advertising.

Limits, criticism and open disputes

A negative result proves nothing. Detection covers only content from participating systems, so an unmarked image may equally be a photograph, an open-weights generation or a marked file that was successfully scrubbed.

Text is the weaker modality. Research published in August 2025 found SynthID-Text degrades substantially under meaning-preserving attacks including paraphrasing, copy-paste edits and back-translation. The Nature authors said as much themselves. The EU Code of Practice concedes the point too, requiring text watermarking above 200 tokens while acknowledging lower reliability at shorter lengths.

Images have been attacked directly. An independent project published in March 2026 by Alosh Denny used Fourier analysis across roughly 123,000 Gemini-generated images to identify fixed carrier frequencies at constant phase, then built a spectral bypass reporting a 91% drop in phase coherence at 43 decibels PSNR, quality loss invisible to the eye. The same statistical structure permits forgery, stamping the mark onto content that was never AI-generated. Google has not published a response, and the claims rest on the author's own measurements rather than independent replication.

Access is the quieter criticism. There is no public decoder, no released weights and no local detection path. SynthID Detector runs behind a waitlist prioritising journalists and researchers, verification runs on Google's servers, and the external SynthID-O variant is available only through partnerships. Checking an image means handing it to the company that made the watermark. DeepMind's own paper concedes that SynthID alone will not solve misinformation, impersonation or copyright tracking, and that watermarking has to sit inside a wider ecosystem including C2PA.

Disambiguation

SynthID and C2PA Content Credentials are complementary rather than competing. C2PA attaches a cryptographically signed manifest recording how a file was created and edited, carrying rich detail but stripped by a screenshot or re-encode. SynthID carries almost no information but survives those transformations. The EU Code effectively requires both.

SynthID and AI content detectors differ in kind. Detectors such as classifier-based text checkers infer synthetic origin from statistical patterns and produce false positives on human work. SynthID reads a mark that was deliberately placed.

SynthID and SynthID Detector: the first is the watermarking technology, the second is the verification portal launched in May 2025.

SynthID and visible watermarks: overlaid logos or badges are perceptible and removable with ordinary editing tools. Marking a Google Vids clip or a YouTube avatar video may involve both, applied separately.

Recent developments

Interoperability is the current direction. OpenAI began applying SynthID alongside C2PA to images from ChatGPT, Codex and its API in May 2026. Anthropic took a different route in August 2026, embedding its own text watermarksplus C2PA file provenance rather than adopting SynthID. Detection interoperability across schemes remains unbuilt, with the Code of Practice deadline for it falling on February 2, 2027.

Timeline

  • August 29, 2023: DeepMind announces SynthID in beta for Vertex AI customers using Imagen
  • May 2024: SynthID extended to text and video at Google I/O
  • October 23, 2024: SynthID-Text published in Nature; implementation open-sourced under Apache 2.0
  • May 20, 2025: SynthID Detector portal announced at Google I/O; over 10 billion items marked
  • October 10, 2025: SynthID-Image paper published, documenting architecture, threat models and benchmarks
  • December 18, 2025: SynthID video verification added to the Gemini app
  • March 2026: Independent spectral reverse-engineering of the image watermark published
  • May 19, 2026: Over 100 billion images and videos marked; OpenAI, Kakao and ElevenLabs named as adopters; detection extended to Search
  • July 24, 2026: Google signs the EU Code of Practice on Transparency of AI-Generated Content
  • August 2, 2026: EU AI Act Article 50 transparency obligations become applicable
  • February 2, 2027: Deadline for signatories to deliver watermark-detection interoperability

Summary

Who: Google DeepMind developed and operates SynthID, with Sven Gowal and Pushmeet Kohli leading the image work and Sumanth Dathathri and Abigail See leading the text scheme. Adopters outside Google include OpenAI, NVIDIA, Kakao and ElevenLabs. Advertisers, agencies and publishers encounter the mark as deployers subject to EU labelling duties.

What: A set of watermarking systems embedding imperceptible, machine-readable signals into AI-generated images, video, audio and text, paired with detectors that recover the signal and, in the image case, a multi-bit payload identifying its source.

When: Announced in beta on August 29, 2023, extended to text and video in May 2024, published in Nature in October 2024, given a public verification portal in May 2025 and a Gemini app verification tool in December 2025. Over 100 billion images and videos had been marked by May 2026.

Where: Applied across Google's generative models including Gemini, Imagen, Veo and Lyria, and inside advertising tools, Google Vids and YouTube creation features. Verification runs through the Gemini app, Google Search, Chrome, the SynthID Detector portal and a Google Cloud detection API. Regulatory pressure originates in the European Union.

Why: Metadata-based provenance is trivially stripped, so an in-content signal is the only marking layer that survives screenshots and re-encoding. EU AI Act Article 50(2) turned machine-readable marking from a voluntary commitment into a legal obligation with penalties of up to 3% of worldwide turnover, making watermarking infrastructure a compliance question rather than a research one.