SynthID watermarking and removal methods are a joke. And you are misunderstanding how it all works completely.

SynthID watermarking and removal methods are a joke. And you are misunderstanding how it all works completely.

Somewhere in this sentence you just read, if a large language model had written it, there would be custom code generated in the image

Custom code generated image

Like this:

The model would normally pick any of: [‘signature’, ‘mark’, ‘trace’, ‘fingerprint’]
watermark nudges it to pick: signature score of the word actually used: 87 > score of a word that lost: 71

A statistical bias buried in the choice of “somewhere” over “somewhere else,” or “signature” over “mark.”

You would never notice it, as you are a human meat popsicle, not a binary code wizard LLM with SynthID and oodles of books from Libgen.

Neither would a spellchecker, a copy-paste, or a screenshot. But a machine holding the right key could look at that sentence and tell you, with real confidence, that it came from a specific model.

Also, you don't have access to the key to decode. Sorry!

This is not science fiction. As of August 2, 2026, Claude does this to every sentence it writes. So does Gemini. The reason is a piece of European law, and the mechanism is a 2024 Nature paper that most people who are affected by it have never read.

I want to walk through exactly how this works, why it exists now, what it can and can’t tell anyone, and what happens when people try to strip it out.

Along the way I’ll clear up a few things that get misconstrued every time this topic comes up online, including the idea that uploading text to the internet triggers some kind of automatic AI-detection scan. It doesn’t.

Nothing does that. Not yet, and not the way people picture it or place it on GitHub to remove it.

The paper that started this
In October 2024, a team at Google DeepMind led by Sumanth Dathathri and Abigail See published a paper in Nature called “Scalable watermarking for identifying large language model outputs.” The system they described is called SynthID-Text, and it solved a problem that had stalled watermarking research for years: how do you mark AI-generated text without making it worse, without slowing it down, and without needing to store a copy of everything the model ever said.

Before SynthID-Text, the field had roughly three options, and all of them had real drawbacks. Keep a growing database of everything the model generated and check new text against it, which raises obvious privacy problems and needs infrastructure that scales with usage forever.

Train a separate classifier to spot the statistical “flavor” of AI writing, which is the approach behind most of the AI detection tools you’ve probably already used and distrusted, and for good reason: those tools are known to misfire on non-native English writers and degrade as models improve. Or edit the text after it’s generated, swapping in synonyms or inserting invisible characters, which leaves traces a careful reader or a decent script can find and strip.

SynthID-Text took a different approach entirely. Instead of marking the text after it exists, it changes how the text gets chosen in the first place.

How a language model actually picks its next word
To understand the watermark, you need to understand what happens underneath every response a model gives you. An LLM doesn’t write a sentence the way a person does, deciding on a whole thought and typing it out. It predicts one token at a time.

Given everything written so far, it calculates a probability for every possible next token, something like a 40% chance the next word is “the,” a 12% chance it’s “this,” and so on across the entire vocabulary. Then it samples from that distribution and moves to the next position.

Normally, that sampling step is close to random, shaped by settings like temperature that control how adventurous or predictable the choices are. SynthID-Text inserts itself right there, at the moment of sampling, and quietly tilts the odds.

Here’s the mechanism, as described in the paper’s Methods section. For each token position, a hash function takes the last four tokens of context plus a secret key and produces a random seed.

That seed feeds a set of pseudorandom scoring functions, the paper uses 30 of them, called “layers.” Each function assigns a score to every possible next token. Then, instead of sampling once from the model’s distribution, the algorithm samples several candidate tokens and runs them through what the authors call Tournament sampling: a knockout bracket.

Candidates get paired up, the higher-scoring one under the first scoring function survives, the survivors get paired again and scored by the second function, and so on through all 30 layers until one token wins and becomes the actual output.

The result is a sequence of words that a reader can’t distinguish from an unwatermarked response, but that carries a statistical fingerprint recoverable by anyone holding the key. Detection doesn’t need the model at all. You just take the text, recompute the same seeds and scores using the key, average them, and compare the result to a threshold. Higher than chance, probably watermarked. Around chance, probably not.

The paper is careful about a property it calls “non-distortion.” Configured one way, called single-token non-distortionary, the tournament always has exactly two competitors per match, and DeepMind proves mathematically that this leaves the model’s actual output probabilities unchanged on average.

The watermark rides on which specific token gets picked among equally likely options, not on making some tokens artificially more likely overall. That’s the whole trick: real bias in individual choices, zero bias in the aggregate.

Twenty million responses, and nobody could tell
Claims about quality preservation are easy to make and hard to trust, so DeepMind ran an actual test in production. They routed a portion of live Gemini traffic through the watermarked model and an equal portion through the unwatermarked version, then compared the thumbs-up and thumbs-down rates people gave each.

Across close to 20 million responses, the difference in thumbs-up rate was 0.01 percent. The difference in thumbs-down rate was 0.02 percent. Both fell well inside the statistical noise.

They backed that up with a smaller, controlled study: human raters comparing watermarked and unwatermarked Gemma 7B answers to 3,000 questions, scored on grammar, relevance, correctness, helpfulness, and overall quality. No significant difference on any of the five.

This is the part that made SynthID-Text different from earlier watermarking research, and the part that made it viable to actually ship. A watermark nobody notices and nothing measures is a watermark companies can turn on without a quality tradeoff. That’s exactly what happened next, eighteen months later, and not because anyone wanted to.

The regulation that made this mandatory
In August 2026, Anthropic switched on watermarking across every Claude model launched on or after August 2, and did it globally, not just for European users. Their help center article is blunt about why: “We’re implementing watermarking to comply with the EU AI Act.”

The specific hook is Article 50 of the Act, which became enforceable that same day and requires providers of generative AI systems to embed machine-readable marks in their output so platforms, regulators, and downstream users can identify AI-generated content.

The penalties are not symbolic. Non-compliance can trigger fines up to 15 million euros or 3 percent of a company’s global annual revenue, whichever number is bigger. Anthropic signed the EU’s Code of Practice on Transparency of AI-Generated Content alongside roughly 190 other signatories.

Anthropic’s technical implementation is built directly on SynthID-Text, the same tournament-sampling mechanism from the Nature paper, adapted for their own models and keys. It covers claude.ai, the API, Claude Code, Claude Cowork, Claude Tag, and access through AWS, Google Cloud, and Microsoft Foundry. Google’s Gemini already carries the original SynthID-Text mark.

OpenAI has discussed watermarking and sits on the C2PA steering committee, but as of this writing has moved slower on deploying text watermarking at the same scale.

Grok as of this article being created, is still undecided. The reality is the majority of the LLMs will have SynthID added already.

Why apply it worldwide instead of only to European users? Anthropic’s own answer, from their FAQ, is refreshingly honest: “We’re applying watermarking globally at launch because we don’t yet have a durable way to scope it by region.”

What the mark can tell you, and the two things it absolutely cannot
This is where most of the online confusion sits:

A watermark hit means the text may have passed through that specific model at some point. That’s the entire claim.

Anthropic states this directly: “A watermark only helps test whether Claude might have produced or processed the content.”

Might have processed, not definitely wrote from scratch. If you paste a paragraph you wrote yourself into Claude and ask it to fix the grammar, the output can carry the watermark even though the ideas and structure are entirely yours. The mark tracks which model touched the text, not who’s responsible for the thinking in it.

It cannot identify you. Anthropic is explicit on this point too: “There’s nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats with Claude.”

The seed comes from the recent token context and a model-level secret key, full stop. No account ID, no session, no IP address folds into that hash. If a company wanted to trace a specific generation back to a specific user, that would require correlating server logs on their own end, entirely separate from anything the watermark itself does.

And there’s no scanning happening anywhere on the internet right now. Nothing crawls the web looking for watermarked text and slaps a flag on it.

Detection is a deliberate, active computation that only the key holder can run meaningfully. Right now, that means Anthropic, internally. They’ve said a public detection API is coming, but as of this writing it isn’t broadly available. Third-party “AI detector” tools you’ve probably encountered don’t have Anthropic’s or Google’s key, so they can’t check for the actual watermark at all.

They fall back on statistical pattern-matching instead, catching things like a model’s fondness for certain phrasing, and Anthropic’s own FAQ calls this out explicitly as “fundamentally different from checking for a watermark,” with meaningfully worse reliability.

Why editing works and copying doesn’t
The watermark’s signal lives in individual token choices, spread across nearly the whole length of a passage rather than concentrated in one spot. That single fact explains almost every question people ask about defeating it.

Copy and paste does nothing, because there’s nothing separate to strip. The watermark isn’t a file property or a piece of metadata bolted onto the text.

It’s the words themselves. Copy the characters into VS Code, a Word doc, a plain text file, rename the file, change the extension, none of it touches the underlying token sequence. Anthropic confirms this directly: the mark “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.”

Heavy rewriting genuinely does degrade it, because it replaces the token sequence with a new one chosen by whatever model or person did the rewriting.

This is where a project like guillaumemeyer/watermarks-remover comes in, and it’s unusually honest about its own limits.

The tool splits into two tiers. Layer A strips invisible Unicode characters, zero-width spaces, bidirectional text markers, tag characters, the leftover tricks from older edit-based watermarking schemes.

That layer is deterministic and testable: the characters are either there or they’re gone. Layer B is the part meant to attack statistical watermarks like SynthID-Text, and it works by having a different model paraphrase the text heavily enough to scramble the original token choices.

The project’s own README is candid about what that costs. Removal means rewording, not restructuring, they write, because shuffling paragraphs or lightly touching up phrasing barely moves the signal.

You have to rewrite a meaningful fraction of the sentences, and every one of those rewrites replaces the original model’s word choices with the rewriting model’s. Tone flattens. Precision drops. The result can’t exceed the ceiling of whatever model did the rewrite.

They even pose the obvious follow-up question themselves: if you’re going to hand the text to a cheaper model to reword anyway, why did you pay for the expensive model in the first place?

There’s a deeper honesty in that README too, one that most tools in this space skip. They flatly state that “until vendors ship public detectors and keys, no tool can honestly certify this fails the official check.”

Their own verification only runs against open research schemes they can replicate, not against Anthropic’s or Google’s actual production key. That’s the same one-key limitation we already covered: without the secret, nobody outside the company can confirm a removal actually worked.

Screenshots break it completely, and this one is worth understanding because it’s the cleanest case. A screenshot converts text into an image, pixels with no tokens and no sampling history, so the watermark simply doesn’t exist in that data anymore.

It’s not hidden in the image. It never made the trip. If you then feed that screenshot to an open-source model to transcribe it, you get an entirely new generation process, with new token choices, no watermarking key applied at all if the model is genuinely unwatermarked.

There’s no statistical trace of the original left to find, because the original text was never processed as text in that pipeline, only as a picture. The real cost isn’t watermark survival, which is total, it’s OCR accuracy: code especially is full of characters that get misread, an “l” for a “1,” bracket mismatches, whitespace that Python actually depends on. You’re trading a clean removal for a proofreading job.

Why any of this matters if you actually build software
If you’re shipping a product that touches AI-generated text or code, three things are worth sitting with.

The watermark is a compliance signal for the company that deployed it, not a forensic tool for you. If you’re trying to prove your own team’s code wasn’t lifted wholesale from an AI tool without review, SynthID-class watermarking isn’t built to answer that, because you don’t hold the key and the detection API isn’t public yet.

Detection reliability scales with text length and with how much genuine uncertainty existed in the original generation. A single deterministic line of code, where there’s really only one correct way to write it, gives the sampling algorithm almost no room to bias anything, so there’s very little watermark signal to find there in the first place.

A long, free-flowing paragraph of prose gives it plenty of room. This is exactly why Anthropic’s own guidance notes the mark should have “negligible effect” on actual code, while still touching comments and docstrings, which are closer to natural language.

And detection will always be probabilistic, never certain, on either side of the question. A hit means “likely passed through this model.” A miss means “no signal found,” not “definitely human.”

Anyone building a policy, whether it’s an academic integrity system or an internal content review process, around a hard yes or no from a watermark check is building on a foundation the researchers who created the technology never claimed it could support.

*The other kind of provenance, yes we built something! Surprise, surprise…
*
Everything above is about proving something came from a specific AI model. There’s a completely different problem sitting right next to it that gets confused with the first one constantly: proving something came from you, and existed at a specific point in time.

That’s what Provenance, the open-source tool we built at Vektor Memory, actually does.

The two problems look similar from a distance, both about establishing origin, both producing something you’d call evidence. Underneath, they don’t share a single mechanism.

SynthID-Text works during generation and needs a secret key to verify. Provenance works after you’ve already written something, on files that already exist, and verification needs no secret at all, only public math anyone can rerun.

It starts by hashing every file in your project into a Merkle tree, the same cryptographic structure git and Bitcoin both use internally, and binds the resulting root hash to your current git commit. Because it’s a Merkle tree rather than one flat hash of everything, you can prove a single file belonged to that snapshot, prov manifest prove src/index.js, without revealing or even touching the rest of the codebase.

The timing half is where it actually gets interesting. A hash alone proves what your code looked like, but says nothing about when.

So Provenance anchors that manifest with two independent timestamp authorities at once: RFC 3161, a conventional third-party timestamping service that confirms quickly, and OpenTimestamps, which anchors the same hash into a Bitcoin block, slower to confirm but with no company or authority you have to trust at all, since the proof lives on a public blockchain nobody controls.

Using both means a single point of failure, one authority going offline or getting compromised, can’t quietly invalidate your evidence.

Verification later is just re-hashing your files, rebuilding the Merkle root, and checking it against both anchors independently. Deterministic, and either it matches or it doesn’t. No key required, unlike SynthID’s detection step, which only the model owner can run with confidence.

The README is upfront about the limit here too, and it’s worth repeating because it’s the same honesty the watermark-remover project showed about its own tool: “This is evidence and stated policy, not a technical access-control or anti-piracy mechanism.

It won’t stop a determined bad actor from copying your code, it gives you strong, verifiable evidence of what your code looked like and when.” That’s the whole category, honestly stated. Cryptographic timestamping proves possession and priority. It was never going to stop theft, only make theft harder to lie about afterward.

So if you’re weighing which of these two technologies actually solves your problem, the question that matters is which claim you need to make. “This text came from a watermarked AI model” needs SynthID-class watermarking, and needs the model owner’s cooperation to verify.

“I had this exact code at this exact time” needs Merkle-tree hashing and independent timestamp anchoring, and needs nobody’s permission to verify, ever. They’re not competing approaches to the same job. They’re answers to two different questions that happen to both get called “provenance.”

The permanence caveat
Making Provenance more permanent comes down to one principle: the tool should never claim more certainty than it can actually back up. That means teaching prov verify to check that the git commit it's bound to still exists in history, not just that a hash matches, so a rebase or force-push can't quietly orphan the evidence.

It means supporting a small list of backup timestamp authorities instead of relying on one, so a single service going offline doesn't take the whole proof down with it, and clearly separating "confirmed" from "still pending" on the Bitcoin anchor so nobody mistakes an unfinished proof for a finished one.

And it means locking a version number into the manifest format itself, so a future update to the tool can't silently misread evidence that an older version created. None of this changes what Provenance proves. It just makes sure the tool tells you the truth about how solid that proof actually is, every time you check it.

What's the difference? C2PA, SynthID, & Provenance?
All three sit under the umbrella of “content provenance,” but they’re solving genuinely different slices of it, and the differences matter more than the similarity here.

The one real similarity across all three

Each one is trying to answer some version of “where did this come from, and can I prove it without just trusting someone’s word.” And each one is honest, in its own documentation, about not being an access-control or anti-piracy mechanism.

Provenance’s README says this explicitly. Anthropic says a SynthID hit is “a signal, not proof.” C2PA’s own spec describes itself as a durable manifest, not a lock. None of the three claims to stop theft or misuse. They all just try to make lying about origin harder.

Past that, they diverge fast.

C2PA is the closest cousin, and it’s genuinely closest to Provenance’s approach

C2PA (the standard behind Content Credentials, backed by Adobe, Microsoft, and others, with OpenAI on the steering committee) embeds a cryptographically signed manifest directly into a file, usually an image, video, or PDF.

That manifest can record who created it, what tools touched it, and a chain of edits. It’s file-based metadata with a digital signature, checkable with tools like c2patool, the exact tool the watermarks-remover README references for stripping it.

This is structurally close to what Provenance does: both produce a verifiable, cryptographically signed record tied to a piece of content, both are checkable without needing a secret key held by one company, both are explicitly not about stopping misuse.

The real difference is scope and durability. C2PA lives inside the file as metadata, which means it can be stripped by re-exporting, screenshotting, or just deleting the metadata block, the same operation the watermarks-remover tool performs on PNGs and PDFs.

Provenance’s evidence lives outside the shipped file entirely, in a separate Merkle tree anchored to two independent timestamp services, so stripping the code of any trace of it doesn’t touch the evidence, because the evidence was never inside the code to begin with. C2PA proves “this file claims this origin.” Provenance proves “this exact file set existed at this exact time,” and keeps proving it even after every trace is scrubbed from the shipped artifact.

SynthID is the outlier, mechanically unrelated to the other two.

SynthID doesn’t touch files or metadata at all. It biases token-by-token sampling during generation, inside the model, so the “evidence” is a statistical pattern smeared across the actual words or pixels, invisible and unremovable by any editing that doesn’t rewrite the content itself.

Detection needs the generator’s secret key. Nobody else can verify it, ever, without that key. C2PA and Provenance both invert that: their proofs are public, checkable by anyone, no permission needed. SynthID’s proof is private by design, gatekept by whoever ran the model.

Where the three actually stand relative to each other

C2PA and Provenance are both cryptographic, file-external-or-embedded, publicly verifiable systems, close cousins in mechanism even though they anchor different things (a signed claim versus a hashed-and-timestamped snapshot).

SynthID is a different category entirely: a statistical fingerprint baked into content at the moment of creation, verifiable only by the party holding the key. If you’re choosing between them for a real use case, the honest framing is that C2PA and Provenance both answer “can anyone check this claim independently,” while SynthID answers “did this specific company’s model touch this,” and only that company can ever confirm it.

The Future: Blade Runner AI slop verification

To conclude, nothing is perfect in these systems—the writing, detection, or removal; we are all just little piggies in the big sloppy game of rolling around in the slop soup mess that we created to determine if AI is really slop.

We are not going back to typewriters, so enjoy your paradox; you deserve to know if your slop is real slop or just human-generated squishy slop.

Be the slop; verify the authenticity of your slop.

Good luck in the future!

(Satire is the best form of medicine…)

Sources and further reading: Dathathri et al., “Scalable watermarking for identifying large language model outputs,” Nature, 2024. Anthropic, “How Claude marks AI-generated content.” BleepingComputer, “How Anthropic plans to watermark Claude’s AI-generated text.” google-deepmind/synthid-text on GitHub. guillaumemeyer/watermarks-remover. Vektor-Memory/Provenance.