AI watermarks aren't that invisible, and they hurt output
According to Google, its SynthID text watermark is invisible, and that's true if you look at any one piece of text by itself. But request the same email 20 times and you'll receive one subject line, not six.
Google tags Gemini text with SynthID, a watermark baked in while the model generates. It says the mark is invisible to people. The code is open source in Hugging Face Transformers, so I ran it on Gemma 4 26B on my own Mac with my own key and asked two things: what does it change in a single text, and what does it change across many?
How it works
- Like any normal model, it suggests a few options for the next token.
- It takes a secret key together with the four tokens that come right before each candidate. That combination gives it thirty scores, each one either 0 or 1.
- These candidates then play a knockout tournament using those scores. Working out the average across every key you could pick, the tournament leaves the model's word odds exactly as they were. No single word betrays anything.
- A detector that has the key runs the scoring over every token once more. Unmarked text lands at 0 on average. Anything above 3 gets flagged.
With the watermark, ends at 6.4Without it, ends at 1.1
What it changes in one text
I rebuilt each draft one sentence at a time to pull out the watermark. I kept the text before it identical, used the same random draws, and turned the key off.
With the watermark
Subject: Project Update: Warehouse Software Rollout Schedule Adjustment
Dear Brightline Logistics Team,
I am writing to provide you with a critical update regarding the upcoming warehouse software rollout. Following our most recent round of hardware validation and systems integration testing, we have identified a technical discrepancy that requires us to adjust our implementation timeline.
During the final stress testing phase, 2 of the 14 handheld scanners failed to maintain a stable connection with the new software interface under high-volume simulated workloads. While the remaining 12 units performed flawlessly, we cannot proceed with the full rollout until we have addressed the connectivity issues with these specific units. We want to ensure that your warehouse team has a seamless, frustration-free transition, and deploying with sub-optimal hardware would pose an unnecessary risk to your daily operations.
Without it, same random draws
Subject: Project Update: Revised Rollout Schedule for Warehouse Software Implementation
Dear Brightline Logistics Team,
I am writing to provide a formal update regarding the upcoming warehouse software rollout.
During the final testing phase for our mobile hardware inventory, two of the fourteen handheld scanners failed to meet our required connectivity and synchronization benchmarks. While 12 of the devices performed exceptionally well, the failure of these two units prevents us from proceeding with the original go-live date. Ensuring 100% hardware reliability is essential to preventing operational downtime once the system goes live on the warehouse floor.
Most of the changes just swap one phrase for another that means the same thing. "Critical update" becomes "formal update." A few go further. The watermarked email includes a sentence about systems integration testing that the other version never mentions.
Is that the watermark working, or just luck? Across all 12 drafts, turning the key off keeps 53% of the words. With the key off and the dice changed, it keeps 51%. So flipping the key moves things about as much as a new roll would. It does not pick worse words. It just picks them instead of the dice.
Nothing I measured shifts per text. Reading ease, length and AI words stay the same with or without the key, and both detectors still flag every version as AI. Google's own test, on around 20 million Gemini answers, also found no change in quality.
| Across 12 drafts | With watermark | Without, same draws | Without, new draws |
|---|---|---|---|
| Watermark score, mean | 5.2 | 0.3 | -0.1 |
| Flagged (score above 3) | 11 of 12 | 0 of 12 | 0 of 12 |
| Reading ease (Flesch) | 46 | 45 | 45 |
| Words | 376 | 370 | 358 |
| AI words and dashes per 100 words | 0.6 | 0.6 | 0.4 |
| Fakespot: reads as human | 0 of 12 | 1 of 12 | 0 of 12 |
| Desklib: reads as human | 0 of 12 | 0 of 12 | 0 of 12 |
What it changes across texts
The dice are what make two answers to the same request differ, and a fixed key does much of their work. Each token's scores depend only on the key and the four tokens before it. The same request starts from the same spot, so the same candidates win the same matches, and the drafts follow the same path until the dice knock one off it.
I asked for each of three texts 20 times, rolling new dice every time. I ran one without a watermark, one with key K, and one with a second key, K2.
| Subject line | No watermark | Key K | Key K2 |
|---|---|---|---|
| Project Update: Revised Timeline for Warehouse Software Rollout | 6 | 20 | |
| Project Update: Warehouse Software Rollout Schedule Adjustment | 4 | 20 | |
| Project Update: Revised Rollout Schedule for Warehouse Software Implementation | 5 | ||
| Project Update: Revised Implementation Timeline for Warehouse Software Rollout | 2 | ||
| Project Update: Revised Warehouse Software Rollout Schedule | 2 | ||
| Project Update: Warehouse Software Rollout Schedule Revision | 1 |
The 20 emails without a watermark spread across 6 subject lines. With key K, all 20 picked the same one. Key K2 also converged on a single subject line, though a different one.
This uniformity extends beyond subject lines. Two watermarked drafts of the same brief share 22% of their four-word phrases, compared with 6% for unwatermarked ones. A simple word classifier separates watermarked drafts from plain ones 98% of the time, once it has seen other drafts of the same brief.
| 60 drafts each | No watermark | Key K | Key K2 |
|---|---|---|---|
| Watermark score, read with key K | 0.5 | 5.9 | 0.7 |
| Watermark score, read with key K2 | 0.0 | 0.0 | 5.1 |
| Reading ease (Flesch) | 39 | 41 | 40 |
| Words | 376 | 375 | 378 |
| AI words and dashes per 100 words | 0.8 | 0.8 | 0.9 |
| Fakespot: reads as human | 2 of 60 | 1 of 60 | 0 of 60 |
| Most common opening, email / product / essay | 6 / 5 / 1 | 20 / 19 / 15 | 20 / 20 / 3 |
| Most common first 8 words, email / product / essay | 6 / 3 / 7 | 20 / 19 / 20 | 20 / 20 / 19 |
| 4-word phrases two drafts of one brief share | 6% | 22% | 21% |
| Distinct 4-word phrases | 70% | 42% | 44% |
The watermark hides in a single piece of writing but shows up when you look at many together. One draft blends in. Twenty emails from one request all share a subject line, and essays from a single prompt open with the same eight words, even when their titles are different.
We still don't know whether a single watermarked text on an unfamiliar topic gives it away. The classifier was trained on two briefs and tested on a third. It scored watermarked drafts only slightly above chance, with an AUC of 0.61 for key K and 0.75 for K2, where 0.5 means random guessing. Three briefs simply aren't enough to separate a real pattern from noise.
Why that hurts output
A model that gives a slightly different answer each time lets you pick. You click regenerate, ask again, and keep whichever version you like. Without a watermark, 20 requests produced 6 subject lines. A fixed key produced 1. That single line was one the model wrote on its own, appearing 4 times out of 20, so it is not a bad line. The other five are gone. If one of those five was the one you wanted, the watermark removed it. Each answer reads fine, but the output is still worse because there is less to choose from.
It also grows more repetitive as more people use it. If one key serves everyone, everyone who sends the same prompt gets the same text. Twenty essays from a single prompt opened with the same eight words. Placed next to each other they look copied, and that is the pattern a reader can spot without any detector.
Limits
- The key is mine, not Google's. Gemini keeps its keys private, so this only tests the published algorithm (30 tournament layers, 5-token context) on Gemma 4 26B at temperature 1, top-k 64, top-p 0.95. How Gemini is configured and whether it changes anything per request are not public.
- One model and one key per column. The style test covers three briefs, the rest twelve drafts.
- Only identical requests were repeated. Similar but different requests were not tested.
- The detectors are classifiers, not people. No human was asked to spot the watermark.
References
- Dathathri, S. et al. Scalable watermarking for identifying large language model outputs. Nature 634 (2024).
- Hugging Face. Introducing SynthID Text, the open-source implementation used here.
- Google AI for Developers. SynthID: tools for watermarking and detecting LLM-generated text.