Findings · 2026-08-26 · By VSNARY | Emmanuel Orta
AI text watermarks only work if the model's provider opted in
Watermarking is real and the mechanism is sound. But it covers one vendor's models, you cannot run the detector, and paraphrasing removes most of the signal.
The explanation going around is accurate about the mechanism and wrong about the conclusion, and the omission matters more than the error.
The mechanism, which is real
When a model picks the next word, several would fit. A watermark uses a secret key to tilt those odds toward a particular subset. Any single choice looks normal. Across enough text, the preference becomes a statistical signature that the key holder can test for.
Google's SynthID-Text is the production example — the only watermarking scheme deployed in a real consumer product, running across Gemini. It uses tournament sampling rather than a simple two-list split, but for detection purposes it belongs to the same family.
Three things usually left out
It only covers models whose provider adopted it. Detection works for services using the same scheme. A model whose provider has not opted in produces text with no signal to find. In practice this is Gemini, and not the other major assistants.
You cannot run the detector. The key belongs to the provider. Researchers evaluating SynthID have noted that detection scores are not exposed through the API — results come back as binary classifications with no confidence value. Whatever it can prove, it cannot prove it to you.
It weakens on short, factual text. The signal degrades on outputs that are very short or highly factual. A service page, a business description, an FAQ answer — short and factual.
On “you would have to rewrite it completely”
The published robustness work says otherwise. Independent assessments find SynthID-Text vulnerable to meaning-preserving attacks — paraphrasing, copy-paste editing, back-translation — which significantly degrade detectability. One evaluation found that for adversaries using nothing more than off-the-shelf paraphrasers, it is easier to scrub than several other schemes.
Running text through a second model removes most of the signal. That is a paragraph of effort, not a rewrite.
So what does this mean if you publish content
The fear this feeds — that search engines will detect and penalise AI-written pages via watermark — does not follow from how the technology works. A vendor can detect text from its own models when it holds the key. It has no watermark signal for text from anyone else's, and the signal it does have is removable and weakest on exactly the kind of copy local businesses publish.
That is not an argument for generating slop. Thin, unhelpful pages fail for the ordinary reasons they always have. It is an argument against building strategy on a detection capability that does not exist in the form people imagine.
The inversion worth thinking about
A watermark is provenance somebody else controls. They hold the key, they run the detector, they decide what it means, and they can change or retire the scheme without telling you.
The durable version points the other way: provenance you assert. A dated, hashed record of what your page said and when it said it — something you can produce on demand and anyone can verify independently. Instead of proving a machine wrote something, you prove you published it first.
That is a claim you own. A watermark never is.
Every figure above came out of this scanner.
Point it at your own domain and see the same measurements, free.