How Google SynthID Works: Invisible Watermarks for Text, Images, Audio and Video

A newsroom receives a polished product image, a 30-second clip and a paragraph said to come from Gemini. The reviewer has one question: can Google’s systems provide evidence that any of those assets were made or edited with supported Google AI? SynthID is designed to supply that evidence by embedding an imperceptible signal during generation and checking for the matching signal later.

The name covers several modality-specific systems. Text carries a statistical pattern in token choices. Images and video carry signals in visual content, while audio carries an inaudible signal in a time-frequency representation. The common idea is embed then detect; the technical carrier is different for each medium. SynthID therefore cannot identify arbitrary AI content that was never watermarked with a compatible system.

It is tempting to describe every SynthID mark as a hidden code. That shortcut is inaccurate. The signal must live in something the medium naturally contains: generated word choices for text, pixels for images and video, and time-frequency structure for audio. Ordinary file metadata is separate and can coexist with SynthID, but it is not the embedded watermark itself.

The quality safeguard comes first: the language model still supplies its ordinary next-token distribution after decoding controls such as temperature, top-k and top-p. The watermark configuration works inside that distribution. It changes an individual sampling path, but it does not invent a vocabulary outside the model’s plausible continuation set.

For the unfinished sentence “The sky looked …”, imagine the model assigns vast 40%, endless 30%, blue 20% and grey 9%. An unrelated token such as toaster has less than 1% probability, with any remaining probability distributed across other tokens. These are teaching numbers—not published Gemini probabilities. They show the crucial boundary: high-probability tokens enter the candidate draw more often, so semantic fit remains controlled by the language model.

Detection is a separate process. The checker receives a finished passage and the matching watermark configuration. It tokenizes the text, reconstructs the recent context at each eligible position and recomputes the keyed g-values for the token that actually appears. Nothing is decoded from a hidden string, and the underlying language model is not required for the published detector.

Imagine a 600-word creative explanation with hundreds of eligible positions. Some observed tokens align with the keyed values more often than ordinary text would be expected to; others are neutral. The detector combines all of those small observations. Eight highlighted positions or a meter in the diagram are purely illustrative—not a Google score threshold, confidence percentage or minimum passage length.

For images, Google describes two deep-learning models trained together: one embeds an imperceptible signal into pixels and another identifies it. Training balances detectability with visual fidelity. Video builds on media watermarking across generated frames, and current verification can inspect both visual and audio tracks. The signal is designed to remain detectable after common operations such as resizing, cropping, filters, frame-rate changes and lossy compression—but Google does not describe it as indestructible.

SynthID’s official audio explanation converts the waveform into a two-dimensional spectrogram showing how frequencies change over time, then embeds an inaudible pattern. The detector can localize likely marked parts of a track. Google says the design tolerates common changes such as added noise, MP3 compression and speed changes; repeated or extreme transformation can still lead to a miss.

Detectability depends on three things: whether a compatible watermark was applied during generation, how much eligible evidence the content contains and what happened afterward. Robust means designed to survive specified edits—not permanent, universal or impossible to remove.

Watermark evidence is asymmetric. A detected compatible signal supports a limited inference about a supported generator or edit. A missing signal often leaves several explanations open: no compatible watermark was applied, the evidence was too weak, the asset was transformed, the wrong detector was used or another AI system created it.