SynthID-Text: the watermark that is not a character

A statistical watermark applied while the model is choosing words. Instead of an ordinary random number deciding between equally good next words, a keyed function decides, and the pattern of those decisions is the signature. Anthropic applies it to Claude models launched on or after 2 August 2026, and Google applies it to text from the Gemini app and web experience. The method is published: tournament sampling, from Dathathri et al. in Nature, October 2024.

How it works

A language model produces, at every step, a probability for each token it could emit next, and normally picks one using an ordinary random number. SynthID-Text replaces that random number with a keyed function of the watermarking key and the last few tokens, then runs a knockout tournament: it draws 2^m candidate tokens, splits them into pairs, and in each pair keeps whichever scores higher under a keyed scoring function g. Repeat over m layers and one survivor is emitted. Because the scoring depends on the key, the sequence of winners carries a signal. In the non-distortionary configuration the expected output distribution, averaged over the key, is identical to the model's own, which is why the prose reads exactly as it otherwise would. Detection reverses the arithmetic: given the tokenised text, the key and the seed function, a detector computes the expected g-scores for the observed tokens and compares them against what unwatermarked text would produce. It needs no access to the model. The signal accumulates with length, so it is a statistical test rather than a lookup: the Nature paper reports about 80 percent true positives at a 1 percent false-positive rate on roughly 200 tokens, and about 95 percent at 400. It also rides on entropy. Where the model had genuine freedom to choose, the tournament can express the key; where it did not, as in a factual sentence or a line of code, there is nothing to bias and the watermark is sparse.

What it is legitimately for

It exists so that AI-generated text can be identified as such, which is a stated aim of the EU Code of Practice on Transparency of AI-Generated Content that both vendors signed. Whatever you think of that goal, the mechanism is documented rather than secret.

What it breaks

• Nothing. That is the design: averaged over the key, the output distribution equals the model's own, so the text reads exactly as it would have.
• It does mean a passage you wrote with Claude or Gemini can be tested against a detector holding the key, without anyone needing access to the model.

How to find it yourself

You cannot find it by looking. Detection needs the tokenised text, the watermarking key and the seed function. Google lets you paste a passage into Gemini and ask whether it carries a SynthID watermark; Anthropic has announced a detection API but has not published it yet.

What Clipboard Sanitizer does

Nothing. We want to be blunt about this: Clipboard Sanitizer cannot remove a SynthID watermark, and neither can any other character cleaner, because there is no character to clean. Anthropic's own words are "Nothing is added to the text and there are no hidden characters." Anyone selling you a SynthID remover is selling you nothing.