A working, in-browser model of how AI text watermarks like Google's SynthID-Text are planted and detected. Watermark a passage with a key, then watch the detector recover it — and watch it go dark the instant the key is wrong. The key is the whole story.
This is the part every "AI watermark remover / detector" product runs into. A detector only works when it holds the same secret key used to write the mark. Paste anything below — a Gemini answer, an email, a novel excerpt — and run it against this lab's key.
Why Gemini text reads as "no signal" here. Google plants SynthID with a private key it has never published. Without that exact key, our g-values are just coin flips, so the mean sits at 0.50 and nothing is detected. That is the design, not a bug: only the watermarker can verify its own mark.
Which is also why a browser extension can't strip a real provider's watermark — you can't remove a signal you have no key to even see.
SynthID-Text doesn't add hidden characters or metadata — it biases which words the model chooses, using a secret key, in a way that's invisible to read but measurable in bulk.
At each position, the secret key and the preceding n-gram are hashed into a pseudo-random g value of 0 or 1 for every candidate next word. Same key + context always yields the same coin.
The model draws several plausible next words and quietly prefers the ones whose coin landed on g = 1. Any single choice looks natural; across a passage the text drifts g-positive.
To detect, re-derive g for every word with the same key and average. Human or wrong-key text averages ≈ 0.50; watermarked text sits well above it, and a z-score says how sure.