Decoding AI watermarks: how SynthID marks an image and Claude marks a sentence

One hides a signal in the pixels so it survives a screenshot. The other hides a pattern in the word choices so it survives a copy-paste. Neither is visible, and both are built to be read back later.

As AI-generated images and text become indistinguishable from the human-made kind, one question keeps coming back: can you tell, after the fact, whether a machine produced this? Watermarking is the current best answer — not a stamp in the corner, but an invisible signal woven into the content at the moment it is generated. Two systems show how differently the same idea plays out across pixels and words: Google DeepMind's SynthID for images, and the SynthID-Text-style watermark that Anthropic switched on for newer Claude models in 2026.

01Why a watermark, and not just metadata

The obvious way to label an AI image is to write "made by AI" into the file's metadata. That is roughly what the C2PA Content Credentials standard does: it attaches cryptographically signed provenance data to the file.⁹ It is useful, and major providers including OpenAI have adopted it for their image tools.¹⁰ But metadata is fragile: take a screenshot, re-encode the file, or upload it to a platform that strips EXIF, and the label is simply gone. The pixels look identical; the provenance does not survive.

A watermark takes the opposite approach. Instead of bolting a label onto the outside of the file, it changes the content itself in a way that is imperceptible to a person but recoverable by a detector. Done well, the mark rides along with the content through the exact transformations that destroy metadata. That robustness is the whole point — and it is why the two systems below live inside the content rather than beside it.

02SynthID for images: a signal in the pixels

Google DeepMind introduced SynthID in August 2023, initially for images from its Imagen model on Google Cloud's Vertex AI.¹ Rather than editing the finished picture, SynthID embeds its watermark during generation, folding a structured, imperceptible signal into the statistical distribution of the image's pixels. The result is a picture that looks unchanged to the human eye but carries a pattern a trained detector can recognise.²

Two design choices make it durable. First, the watermark is spread across the whole image rather than concentrated in one region, so cropping away part of the frame still leaves plenty of signal behind. Second, it is designed to sit in components of the image that survive common edits. DeepMind reports the mark remains detectable through JPEG compression, resizing, moderate cropping, colour adjustments, and many filters.²

Detection runs the process in reverse: a companion model inspects a suspect image and returns a confidence verdict — roughly "watermark detected," "suspected," or "not detected" — without needing the original file or access to the generator.² Since the 2023 launch, SynthID has expanded well beyond images: audio (via Lyria) in late 2023, then text and video (Gemini and Veo) in 2024, and by 2026 Google reports it has watermarked billions of pieces of content across its products.³

03Why it survives a screenshot

This is the property people find surprising. Screenshot an AI-generated image, and the new file has no shared metadata with the original — different container, different bytes, no EXIF. Yet the SynthID watermark is often still there, because a screenshot copies the pixels, and the watermark lives in the pixels. The detector, run against those copied pixels, still finds the pattern.²

That said, robustness is not invincibility. Every transformation erodes the signal a little, and stacking enough of them — heavy compression, aggressive cropping, a hard re-render, or a deliberate removal attack — can push detection below its confidence threshold. DeepMind is explicit that SynthID is not a guarantee against a determined adversary; it raises the cost and effort of laundering AI content, rather than making it impossible.²

Metadata says "this file was made by AI." A watermark says "these pixels were made by AI" — and the pixels are what a screenshot copies.

04From pixels to words: the harder problem

Text is a much less forgiving medium to watermark. An image has millions of pixels, each nudged by a fraction too small to see, giving enormous redundancy to hide a signal in. A paragraph has maybe a few hundred tokens, and every one of them is meaningful — you cannot perturb a word by 1% the way you can a pixel. Change a word and a reader notices; change too few and there is no signal to detect.

The foundational academic idea came from Kirchenbauer and colleagues in 2023. At each step of generation, a pseudo-random function seeded by the preceding tokens splits the vocabulary into a "green" list and a "red" list, and the model is nudged to prefer green tokens. To detect the watermark, you replay the same split over a suspect text and count how many of its tokens fall on the green list: far more greens than chance would predict is the statistical fingerprint of a watermarked model.⁵ Because the signal is carried by which words were chosen, it lives in the text itself — so it survives copy-paste, reformatting, and translation between file types, none of which change the words.

05SynthID-Text and tournament sampling

Google DeepMind productised this idea as SynthID-Text, published in Nature in 2024, using a sampling algorithm the authors call tournament sampling.⁴ The mechanism is elegant. For each new token, a hash of the preceding tokens (plus a secret watermark key) seeds several small scoring functions — g-functions — that assign each candidate token a random score. The model samples a pool of plausible next-token candidates from its normal probability distribution, then runs them through a bracket of pairwise contests: in each round, the token with the higher g-score advances, until one winner remains and becomes the output.⁴

The clever part is that the tournament is stacked with high-probability tokens to begin with, because those show up more often in the candidate pool. So the winner is still a word the model would plausibly have said — the text reads naturally — but the sequence of winners carries a detectable statistical bias toward high-g tokens. SynthID-Text can be tuned along a spectrum from non-distortionary (preserving output quality, at some cost to detectability) to distortionary (stronger signal, slightly altered distribution). DeepMind reported deploying it in Gemini and, in a live study over millions of responses, found no measurable drop in quality that users noticed.⁴

06Claude's watermark: changing the source of randomness

In 2026, Anthropic began watermarking the text and file output of its newer Claude models — reporting first covered Claude Fable 5.1 and Mythos 5.1 — using an approach built on the SynthID-Text method.⁶⁷ Anthropic's own description is precise about what it does and does not do. When Claude generates text, it constantly makes random choices among several plausible next words. The watermark changes the source of that randomness: instead of drawing from an unbiased random seed, Claude derives the randomness from a secret watermark key combined with the preceding words.⁶

Crucially, nothing is inserted into the output. Anthropic is explicit that there are no hidden characters, no extra tokens, and no visible additions — a watermarked response is indistinguishable, to a reader, from an unwatermarked one.⁶ The signal is entirely in which of the plausible words got picked. Anyone holding the key can replay the choices and check whether the observed sequence of words is consistent with what Claude would have produced under that key — a statistical test, not a lookup. Anthropic has said it plans to offer a detection capability, initially in private preview for organisations with regulatory obligations.⁷

The reason this exists now is largely regulatory. Under the EU AI Act's transparency rules, providers of generative systems must mark their synthetic output in a machine-readable way so it can be detected as AI-generated.⁸ Rather than build one pipeline for Europe and another for everyone else, Anthropic applied the watermark globally.⁷

07What survives copy-paste — and what defeats it

Because the mark is in the word choices, copy-pasting a watermarked answer preserves it perfectly: the words are the signal, and paste does not change the words. Light editing — fixing a typo, cutting a sentence, swapping a word here and there — degrades the signal only a little, and detection typically still holds.⁷ This is exactly the robustness the green-list idea predicts: you would have to change a large fraction of the tokens to erase the statistical bias.

What defeats it is equally clear-eyed. Anthropic and independent reporting agree on the failure modes:

1. A full rewrite or heavy paraphrase. Replace essentially every word — by hand, or by running the text through a different model — and you replace the word choices that carried the signal. The watermark does not survive that.⁷
2. Very short outputs. The detector is statistical, so it needs enough tokens to separate a real bias from chance. On a sentence or two, confidence is low; watermark detection performs poorly on small samples.⁷
3. Mixing and translation. Interleaving watermarked and human text, or translating into another language, dilutes or scrambles the token-level pattern.

None of this makes the watermark useless. It is designed to catch casual, unmodified reuse — the copy-paste-and-submit case — not to survive an adversary determined to launder the text. As with images, the goal is to raise the effort required, not to build something unbreakable.

08Where OcxlyDev lands

Watermarking is not a lie detector for AI, and treating a "not detected" result as proof of human authorship is a mistake — the absence of a mark only means this particular watermark was not found. What these systems do well is establish provenance for unmodified content at scale, cheaply and invisibly, which is genuinely useful for platforms, newsrooms, and compliance teams trying to keep synthetic media labelled.

Our take: pair a robust watermark (SynthID, or a SynthID-Text-style scheme) with signed provenance metadata (C2PA) so the two cover each other's weak spots — metadata gives you strong, verifiable claims when it survives, and the watermark gives you a fallback when it does not. And be honest with users about the limits: a watermark that survives a screenshot or a copy-paste is a real advance, but it is a speed bump for the determined, not a wall. Building on that understanding beats trusting a single green checkmark.