The Watermark in the AI Text in Your Notes Is Not Yours to Read

A production text watermark exists inside AI-generated prose — a real statistical signal, tested in a live experiment on the Gemini production system in 2024. But the cryptographic key that detects it is held by the system that issued the watermark, not by you. For a note-taker, this is the whole finding: a positive detection is evidence; an absent watermark is not.

The paper is Dathathri et al., "Scalable watermarking for identifying large language model outputs," published in Nature 634, pp. 818–823, on 23 October 2024.¹ Twenty-four authors at Google DeepMind describe a technique called SynthID-Text. Rather than appending a tag or altering meaning, SynthID-Text adjusts the model's sampling procedure — which specific word gets chosen when several candidates are statistically similar. The watermark lives in the pattern of those choices, not in any visible character. To confirm the approach held up under production conditions, the authors ran a live experiment on the Gemini system and analysed approximately 20 million watermarked and unwatermarked responses as part of a quality A/B test.² The thumbs-up rate between the two groups differed by 0.01%, the thumbs-down rate by 0.02% — both statistically insignificant.² The watermark did not detectably degrade the text that users rated.

The study, briefly

SynthID-Text modifies only the sampling step that selects tokens. It does not fine-tune the model, embed hidden characters, or alter overall meaning. Detection is computationally efficient and does not require the underlying language model — but it does require the watermarking key.³

The technique is called Tournament sampling. The model holds a small tournament among candidate tokens and biases the selection toward those that score more highly against a pseudorandom function seeded by a secret key. Nothing in the output marks which tokens were selected this way. A reader fluent in probability, looking at the raw text, could not identify a watermarked passage any more than a card player could identify a stacked deck from a single hand.

The key detail for anyone reasoning about their own text: the watermark is not something you placed. It is a statistical artifact of how the model was configured to generate — and only the system with that configuration's key can confirm it.

What detection actually requires

Detection depends on two conditions beyond the key itself: the text must be long enough to accumulate statistical signal, and the model must have faced genuine choices when generating it — high-entropy moments where multiple words were plausible. Short text and predictable text both defeat the watermark detector, regardless of whether the text was originally watermarked.⁴

The paper is precise about this. Length matters because the scoring function needs enough token-level decisions to clear a statistical threshold. Entropy matters because if the model's distribution is so constrained it almost always returns the same word — a date, a proper noun, a fixed formula — the tournament has nothing to bias.⁴

The paper's own evaluations ran at 200 and 400 tokens as the lower and upper test lengths.⁴ A short command, a three-line list, or a stock definition sits well below that floor. A one-sentence meeting summary, a three-bullet action plan, the opening line of a drafted email — these are exactly the fragments that arrive in a note vault as AI-assisted text, and they are precisely where detection fails.

Why note-takers cannot verify the watermark

Even if you obtained a detector, you would need the watermarking key — held only by the issuing system, not distributed to users.⁵ Detection is a closed loop. Only the vendor who issued the watermark can confirm it. No third-party tool, no local script, and no reading of the output can substitute for that key.

This is the structural fact the headline points at. The watermark is not like a visible tag you attached to a file, or a generated-by: frontmatter field you wrote yourself. It is a statistical pattern embedded in the choices the model made — and only the system that seeded those choices can recognize the pattern.

The practical consequence: if you paste a paragraph from a chat session into a note, you have no instrument that can confirm whether that paragraph carries a watermark. You have the text. The key that could verify its origin lives elsewhere, and it is not available to you.

What a positive result proves — and what absence does not

A positive watermark detection — if the system that generated the text reports one — is meaningful evidence. The scoring function, given sufficient length and entropy, provides a credible signal that the text passed through a specific model. An absent watermark, by contrast, establishes nothing: it is not evidence of human authorship.⁶⁷

The authors state this directly. SynthID-Text does "not offer a complete solution" and is "complementary to other approaches."⁷ Among the reasons: other actors who choose not to implement watermarking produce unmarked text that is indistinguishable by absence alone. A post in a vault that lacks a detected watermark could have been written by a human, paraphrased after generation, produced by a non-watermarking system, or generated as short low-entropy text that the detector cannot score reliably.

Absence is not evidence of human authorship. It is evidence of nothing.

The honest limits

The watermark degrades under editing. The authors acknowledge in the paper that generative watermarks "are weakened by edits to the text, such as through LLM paraphrasing — although this usually does change the text significantly" — and refer readers to Supplementary §C.6 for the robustness evaluations.⁶ Separate academic work on attack methods confirms the vulnerability.

Software engineer Sean Goedecke, writing on 2 July 2026, put it plainly: "Unlike image and video watermarks, text watermarks will always be trivial to remove."⁸ His argument is that the watermark is "inherent to subtle vocabulary choices," which means that "re-wording the content will remove the watermark."⁸ He identifies a concrete mechanism: "you can strip out SynthID watermarking by asking that LLM to paraphrase the text content."⁸

This is not a removal guide. It is the condition that makes absence meaningless as evidence: a text that was watermarked can become undetectable through ordinary editing. The mark is fragile.

Academic research on attack methods reaches the same conclusion from a different direction. Sadasivan, Kumar, Balasubramanian, Wang, and Feizi, publishing in TMLR, found that recursive paraphrasing "can significantly reduce detection rates" while only "slightly" degrading text quality — characterizing this as a "potential vulnerabilit[y] in current detection systems in the presence of an attacker."⁹

The paper's own concession, the practitioner's observation, and the attack-research finding all point the same way. The watermark is real. It is not yours to read. And its absence tells you nothing you did not already know.

One further detail: SynthID-Text has been released on HuggingFace and is available there for inspection. The open-source release covers the inference code. It does not distribute the production watermarking key used in the Gemini experiment. Without the issuing key, detection against that particular watermark remains out of reach.

What this means for a note vault

The asymmetry is the whole practical lesson. A confirmed watermark detection, issued by the system that generated the text, is a meaningful signal. An undetected watermark — which covers virtually every note-taker's situation — does not confirm human authorship and does not confirm AI absence. It confirms only that the detector did not fire.

If you want a durable record of which notes you wrote with AI assistance, the only instrument you control is one you create yourself — a notation at the time of writing, in the file, in a format that travels with the note. The post that explores that habit, and why C2PA does not apply to plain-text Markdown, lives at Mark What the AI Wrote: Note Provenance in the Age of Model Collapse.¹⁰

One architectural distinction is worth stating clearly. C2PA — the standard used to certify image and video provenance — does not apply to plain-text Markdown.¹⁰ The watermarking technique described here is a separate mechanism, statistical rather than cryptographic in origin, and held by the vendor rather than embedded in the file format. These are different problems with different architectures. If the question of AI copyright ownership is what you are working through, that axis is covered in Your Notes Are Yours: What the AI Wrote May Belong to Nobody.

Frequently Asked Questions

Is the text that Gemini writes watermarked?

The Nature paper documents a live experiment on the Gemini production system in 2024, in which approximately 20 million watermarked and unwatermarked responses were analysed as part of a quality A/B test.² The paper demonstrates the technique at production scale. It does not specify current deployment status for any particular product, and the experiment describes the technique as it was configured at the time of publication.

Can I tell if something in my notes was written by AI?

Not by reading the text. The watermark, where present, is a statistical pattern in token selection — invisible to a reader, and detectable only with the watermarking key held by the issuing system.⁴⁵ Detection also requires sufficient text length and entropy. Short, predictable passages do not accumulate enough signal to score reliably. Most AI-assisted fragments in a note vault fall below the viable detection threshold.

Does paraphrasing remove an AI watermark?

Yes, at the cost of also changing the text. The original authors acknowledge that generative watermarks "are weakened by edits to the text, such as through LLM paraphrasing."⁶ Sadasivan et al. found that recursive paraphrasing "can significantly reduce detection rates" while only slightly degrading text quality.⁹ The two effects are coupled: you cannot strip the watermark without altering the words.

Does SynthID-Text work on short text?

The paper's evaluations used text lengths of 200 and 400 tokens as the lower and upper test conditions.⁴ Below that range, the statistical signal is too weak for reliable detection. A bullet point, a one-sentence summary, or a short command falls well below the minimum. Detection on typical note-taking fragments — the kind of AI-assisted text most likely to land in a vault — is unreliable.

What does it mean if text in my notes has no detectable watermark?

It means the detector did not fire — not that the text was written by a human. An absent watermark may indicate human authorship, paraphrased AI output, output from a system that does not implement watermarking, or text too short and low-entropy to score.⁷ The authors describe SynthID-Text as "complementary to other approaches," not a complete solution to the provenance question.

Is SynthID-Text open source?

SynthID-Text was released on HuggingFace and is available there for inspection. The open-source release covers the inference code. It does not distribute the production watermarking key used in the Gemini experiment — detection against that particular key is not possible without it. The code is useful for understanding the mechanism and for building watermarking into other systems.

Why can't I rely on C2PA or Content Credentials to verify my notes?

As the MNMNOTE post on note provenance explains: "Because C2PA certifies the provenance of media content — images, video, audio — by its own specification, not plain-text Markdown."¹⁰ Text watermarking is a separate mechanism, statistical rather than format-embedded, operated at the model layer rather than at the file layer. C2PA solves a different problem for a different medium.

A watermark in a text file is a statistical whisper — present, where it exists, only to the system that placed it there. The note-taker holds the text. The key is elsewhere.

Notes stay on your own device with mnmnote.com — plain Markdown, no account, open in any editor.