Can you remove SynthID from text?
SynthID is the best-documented text watermark there is, which makes it the only one where removal can be discussed precisely. What degrades it, what cannot touch it, and what you can verify.
Removing the watermark · 4 min read
SynthID-Text is the only production text watermark whose mechanism has been published. That makes it the one case where the question "can this be removed?" has a technical answer rather than a marketing answer.
The short version: the mechanism is public, the weakness is documented by Google itself, and the detection key is not public — so removal is discussable but not verifiable by you.
What SynthID actually is
It is not a character hidden in your text. Nothing is inserted, nothing is appended, and no amount of inspecting the codepoints will reveal it.
SynthID biases which token the model picks at each generation step. A pseudorandom function seeded by a secret key scores the candidate tokens, and sampling tilts toward higher-scoring ones. Each individual choice looks unremarkable. Across several hundred tokens the accumulated tilt becomes a measurable statistical pattern.
Detection re-computes the expected scores with the same key and asks whether the text scores higher than chance.
This has a consequence people consistently get wrong: the signal is distributed across the whole passage, not stored in one place. There is no marker to find and delete.
What cannot remove it
Stripping invisible characters. Zero-width characters, Unicode tag characters and variation selectors are real and worth removing for other reasons, but they are not where SynthID lives. Deleting them changes nothing about a token-selection pattern.
Normalising punctuation. Em dashes to hyphens, curly quotes to straight ones. Removes genuine stylistic tells. Does not touch the watermark.
Reformatting, re-spacing, changing case. None of it alters which words were chosen.
Running it through another "watermark remover" that only does the above. Most of them only do the above.
What Google documented as degrading it
The Nature paper that introduced SynthID-Text is unusually candid about the limits. The signal weakens under:
- paraphrasing
- heavy editing
- translation
- short passages, which never accumulate enough signal to detect in the first place
That last one matters more than it sounds. Below roughly a few hundred tokens there is not enough statistical evidence for a confident call, watermark present or not. A short passage is effectively undetectable by construction.
The reason paraphrasing works is direct: the signal is carried by specific token choices among near-equivalent alternatives. Replace those tokens and the evidence goes with them. This is not a flaw in one implementation — it is inherent to how sampling-based watermarks function, which is why the same limitation appears in Anthropic's documentation for Claude's mark.
What you can and cannot verify
Google open-sourced the SynthID-Text implementation, so the algorithm is inspectable. But the key Gemini uses in production is Google's. Detection requires it.
So:
- Nobody outside Google can test whether a given passage carries Gemini's SynthID mark.
- Nobody outside Google can confirm that removal worked.
- A "SynthID detector" offered by a third party is not reading the watermark. It is running a generic AI-detector heuristic — perplexity and burstiness — which guesses about writing style and produces false positives on non-native English writers and technical prose.
If a tool gives you a SynthID percentage, ask which key it used. There is only one answer that would make the number real, and no third party has it.
What this service does
Two layers, and we keep them separate because only one of them is provable.
Exact: every zero-width character, Unicode tag character, variation selector, exotic space and typographic punctuation mark, removed by direct codepoint matching. Re-scan and the count is zero. This is real, verifiable, and unrelated to SynthID.
Unverifiable: a rewrite pass that changes word choices throughout the text. Paraphrasing is the mechanism Google's own paper names as degrading the signal. Whether any particular rewrite degrades it enough is not something we, or you, can currently measure.
We will not tell you the second layer defeats SynthID. We will tell you it is a paraphrase, that paraphrase is on Google's list, and that the result cannot be checked without Google's key.
Practical notes
Gemini output carries it. Text from Gemini is the main place you will encounter SynthID in the wild.
Length is the biggest single factor. A three-sentence answer was never reliably detectable. A four-thousand-word document is.
Mixed sources dilute it. Text where model output is interleaved with your own writing carries a weaker signal than a clean generation, because your sentences contribute nothing to the pattern.
Scan your text for the character layer, which is exact and free. On the statistical layer we will keep saying what is known and what is not.
Related: what SynthID-Text is · removing Gemini's watermark · Claude vs ChatGPT vs Gemini · how detectors work