Findings · 2026-08-26 · By VSNARY | Emmanuel Orta · 0 views

AI text watermarks only work if the model's provider opted in

Watermarking is real and the mechanism is sound. But it covers one vendor's models, you cannot run the detector, and paraphrasing removes most of the signal.

The explanation going around is accurate about the mechanism and wrong about the conclusion, and the omission matters more than the error.

The mechanism, which is real #

When a model picks the next word, several would fit. A watermark uses a secret key to tilt those odds toward a particular subset. Any single choice looks normal. Across enough text, the preference becomes a statistical signature that the key holder can test for.

Google's SynthID-Text is the production example — the only watermarking scheme deployed in a real consumer product, running across Gemini. It uses tournament sampling rather than a simple two-list split, but for detection purposes it belongs to the same family.

Three different questions, one word #

“Can AI text be detected” is three questions with three different answers, and almost every version of this argument slides between them. Did a specific model generate this? — answerable by the key holder, for its own models, while the scheme is live. Was this written by any AI? — not answerable by a watermark at all, since an unwatermarked model leaves nothing behind. Should this page rank? — a different question entirely, answered by whether the page is useful, and no watermark is an input to it.

The claim people fear is the second one. The technology answers the first.

Three things usually left out #

It only covers models whose provider adopted it. Detection works for services using the same scheme. A model whose provider has not opted in produces text with no signal to find. In practice this is Gemini, and not the other major assistants.

You cannot run the detector. The key belongs to the provider. Researchers evaluating SynthID have noted that detection scores are not exposed through the API — results come back as binary classifications with no confidence value. Whatever it can prove, it cannot prove it to you.

It weakens on short, factual text. The signal degrades on outputs that are very short or highly factual. A service page, a business description, an FAQ answer — short and factual.

On “you would have to rewrite it completely” #

The published robustness work says otherwise. Independent assessments find SynthID-Text vulnerable to meaning-preserving attacks — paraphrasing, copy-paste editing, back-translation — which significantly degrade detectability. One evaluation found that for adversaries using nothing more than off-the-shelf paraphrasers, it is easier to scrub than several other schemes.

Running text through a second model removes most of the signal. That is a paragraph of effort, not a rewrite.

So what does this mean if you publish content #

The fear this feeds — that search engines will detect and penalise AI-written pages via watermark — does not follow from how the technology works. A vendor can detect text from its own models when it holds the key. It has no watermark signal for text from anyone else's, and the signal it does have is removable and weakest on exactly the kind of copy local businesses publish.

That is not an argument for generating slop. Thin, unhelpful pages fail for the ordinary reasons they always have, and the things that are actually measurable about a page — whether a crawler can fetch it, whether what comes back is parseable, whether there is enough text to quote — are none of them about who typed it. It is an argument against building strategy on a detection capability that does not exist in the form people imagine.

What a text watermark can and cannot establish #

A vendor can detect text from its own models while it holds the key. It has no signal at all for anyone else’s.

The inversion worth thinking about #

A watermark is provenance somebody else controls. They hold the key, they run the detector, they decide what it means, and they can change or retire the scheme without telling you.

The durable version points the other way: provenance you assert. A dated, hashed record of what your page said and when it said it — something you can produce on demand and anyone can verify independently. Instead of proving a machine wrote something, you prove you published it first.

What the other direction looks like in practice #

This is not hypothetical here. Every report this scanner produces is hashed and anchored to the Bitcoin blockchain with OpenTimestamps. The verification path runs through public infrastructure and does not require us to be online, or to still exist.

Note what that does and does not prove, because the distinction is the same one the watermark argument keeps losing. It proves a record existed in exactly that form at that time and has not been altered since. It does not prove the measurement was correct, and it does not prove anyone else saw it. Two of those are worth claiming and the third is not, so only two are claimed. The same page also carries the month our own proofs sat pending without anyone noticing, which is the sort of thing a provenance claim you control has to be able to admit.

That is a claim you own. A watermark never is.

Questions this post answers

Can Google detect AI-written text with SynthID?

Only text generated by a model that embedded the watermark. Text from a provider that did not opt in carries nothing to detect, and research shows the signal can be weakened by paraphrase.

Should I worry about a watermark penalty?

There is no evidence of one. Publish text that says something a reader can use; a watermark says who generated the words, not whether they were worth reading.

Related findings

Comments

Comments are read before they appear. Nothing is published automatically, and no account is needed.

Writing about this? Facts, live figures and marks — every number on that page is dated and traceable to a scan.

All findings · The dataset · How the dataset works