Invisible Watermarks: How SynthID Works and Where It Stops

Ask what it means for a piece of AI content to be "watermarked" and you'll get three different correct answers, because three unrelated mechanisms share that one word. There's the visible badge a platform stamps on a post after a creator flips a toggle. There's a signed manifest that travels alongside a file as a separate record of where it came from. And there's an actual pattern, embedded in the pixels or the waveform or the words themselves, readable only by something built to look for it. SynthID is the third kind, and it's the one most people have heard named without ever being told precisely what it does. That precision matters, because the gap between what SynthID actually proves and what people assume it proves is exactly where it stops being useful and starts being treated like a lie detector it was never built to be.

Three mechanisms, one overloaded word

A visible AI content label is a UI decision — a platform-side or creator-side toggle that renders a badge on a post, and whether it's on says nothing about what's actually inside the file (see what an AI content label covers). A signed manifest is a separate structure, cryptographically bound to a file, that records assertions about origin and edit history and can be inspected independently of the pixels. A statistical watermark is neither of those — it doesn't sit beside the content or announce itself on screen. It's folded into the content itself, at generation time, by the model that made it. Versely's own reference on watermarks makes the general case that a watermark can be visible or invisible and that where an invisible signal exists, it's usually not something a generation parameter lets you toggle — SynthID is the concrete example of exactly that: an invisible signal with no on/off switch in anyone's hands but the provider's.

What SynthID actually embeds, modality by modality

DeepMind's own technical page is specific about the mechanism for each type of content it covers, and the specifics differ enough between modalities that treating "SynthID" as one uniform thing is itself a source of confusion.

For images and video, the description is direct: "The watermark doesn't change the image or video quality. It's added the moment content is created, and designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression." That's a durability claim aimed specifically at the kinds of transformation ordinary distribution puts a file through — a re-encode for upload, a crop to fit a different aspect ratio, a filter pass — rather than at surviving deliberate, sophisticated removal.

For audio, the same durability logic applies to a different signal: an inaudible pattern in the waveform that DeepMind describes as unaffected by "adding noise, MP3 compression, or changing the speed of the track." Nothing about how it sounds changes, and nothing about the audio codec pipeline it typically passes through breaks it.

Text is the case that surprises people, because there's no pixel grid or waveform to hide a pattern in — just a sequence of word choices. The mechanism DeepMind describes leans on how a language model already works: "Each word is assigned a probability score, based on how likely it is to be generated next." SynthID doesn't add anything foreign to that process; it "adjusts these probability scores to generate a watermark," nudging which of several plausible next words actually gets picked, over and over, in a pattern a detector can recognize statistically across the passage. It's a fundamentally different kind of signal from the image or audio case — not a mark added to a fixed artifact after the fact, but a bias built into the choices that produced the artifact in the first place. That also makes it inherently a signal that needs enough text to be legible: a single short phrase carries far fewer biased word-choices than a full paragraph, the same way a single pixel can't carry a meaningful image watermark.

Where it stops: four boundaries worth being precise about

It's the provider's decision, not a setting you control. Whether a given model embeds SynthID at all depends on which provider built it, and where the signal exists it isn't exposed as a generation parameter to switch on or off — a pattern Versely's watermark reference makes as a general rule, and SynthID is a specific instance of it. Picking a model is the only lever you actually have.

Each modality carries its own, separate mark. A SynthID signal embedded in a generated image says nothing about whether the text prompt that produced it was itself watermarked, and an image edited afterward in a tool from a different provider inherits whatever that second tool does or doesn't do — nothing propagates automatically across a mixed pipeline just because one step in it happened to be Google's.

The signal isn't something a person can check by looking. It's built to be recognized by a detector, not an eye, which means "is this watermarked" isn't answerable by inspection the way a corner logo is. That also means its absence is not evidence of anything — a file with no detectable signal might have come from a provider that never embeds one, and a file that does carry one gives you no information about who prompted it or what they intended.

None of it is a disclosure decision. A detectable in-content signal, a platform's visible AI label, and an actual legal obligation to disclose synthetic content are three independent things that happen to frequently apply to the same piece of content at once. Synthetic media disclosure obligations exist regardless of whether a provider's watermark is present underneath, and a present watermark doesn't discharge that obligation on its own — treating an embedded signal as a compliance checkbox is a mistake worth avoiding on purpose.

How this differs from the manifest layer

It's worth being clear that a statistical watermark and a signed provenance manifest solve genuinely different problems, because they get reached for interchangeably. The C2PA specification defines a separate, cryptographically signed structure — a manifest built from assertions, a claim, and a claim signature — that records who vouched for what, at each step of an edit chain, independent of the pixels themselves. A SynthID signal proves none of that. It doesn't identify a signer, it doesn't record an edit history, and it doesn't get less true if a later editing tool never touches it. What it proves, at most, is that a specific piece of content passed through a specific provider's generation step at some point — useful, durable, and a completely different claim from "this identity signed this specific chain of assertions."

A Versely walkthrough: the one lever you actually have

Versely doesn't add, remove, or expose a toggle for any embedded watermark — that layer is entirely a property of which model actually generated the content, decided by the provider before the file ever reaches Versely's pipeline. The practical version of that: Versely's model catalog carries several models from Google's Veo, Imagen, Nano Banana, and Gemini Omni families as live, active options, and choosing one of those is the only decision available if a provider-embedded signal on the output specifically matters to you. A prompt as plain as "generate this scene with Veo 3.1" routes through generate_videos with models: ["VEO 3.1"], and whatever DeepMind's own generation pipeline does at that step happens the same way it would through any other Google-side surface — Versely isn't adding a separate marking pass of its own, and it isn't stripping one out either.

What Versely doesn't currently do — worth stating plainly rather than implying otherwise — is attach or expose a C2PA manifest as a customer-facing feature, so a signed, checkable edit-history record isn't something this pipeline produces today. If a project actually needs that harder guarantee rather than a durable-but-anonymous in-content signal, that's a different requirement to solve for separately, not something choosing a Google-family model substitutes for.

Takeaway

"Watermarked" collapses three different mechanisms into one reassuring-sounding word: a visible badge that's a policy toggle, a signed manifest that's a separate metadata structure, and an in-content statistical signal like SynthID that's neither. SynthID does one job precisely — biasing pixels, waveforms, or token probabilities at generation time in a way built to survive ordinary handling — and it does that job per modality, under the provider's control, detectable only by a tool built for it. It was never designed to identify a signer, record an edit history, or answer a disclosure question, and treating it as if it does any of those three things is the actual failure mode here, not any weakness in the mechanism itself.