SynthID and Tournament Sampling: How Production Text Watermarks Actually Work

Why production watermarking is a milestone

For years, LLM watermarking lived in papers. The core idea, biasing token choice with a secret key so the text carries a measurable signal, was well understood, but nobody had shown it working in a live product without visibly degrading quality. That changed when DeepMind reported SynthID-Text running inside Gemini and Gemini Advanced, the first deployment of a generative text watermark at scale, with the details published in Nature. If you already understand the green list and red list approach, our earlier technical deep dive covers it, this article is the next step: how a real system generalises that idea.

A one paragraph recap of sampling

At each step, a language model produces logits over its vocabulary, applies softmax to get a probability distribution, and samples a token. The process is stochastic, which is exactly what makes watermarking possible: you can nudge the randomness in a keyed pattern without making any single word look wrong. Standard green list watermarking adds a fixed bias to a pseudo randomly chosen half of the vocabulary at each position. SynthID does something more flexible.

Tournament Sampling, step by step

Tournament Sampling replaces the single green or red split with a bracket. For each token position, the algorithm hashes the preceding tokens together with the secret key to seed a set of m independent scoring functions. Each function, call them g functions, assigns a pseudo random binary score to every candidate token.

Generation then runs an actual tournament:

• Sample a pool of candidate tokens from the model's original distribution, enough to fill a bracket of m layers.
• In layer one, pair the candidates and, within each pair, keep the token with the higher g score from the first scoring function.
• Repeat through m layers, each layer using its own g function, until one token wins and is emitted.

Because winners are drawn from the model's own distribution and only reordered by the g scores, the emitted text stays fluent. But across many positions, watermarked text accumulates systematically higher g scores than unwatermarked text. That gap is the signal.

Non-distortion, and why it matters

A watermark is called non-distortionary when, in expectation, it does not change the distribution of text the model produces. SynthID is notable because Tournament Sampling can be tuned toward non-distortion, so quality is preserved, or toward a stronger, slightly distortionary signal when robustness matters more. The paper frames this as unifying the two families of watermarking that earlier work treated as separate. Independent analyses, such as this theoretical study of SynthID-Text and ETH Zurich's probing of the deployed system, have since examined how much signal survives under real conditions.

Detection: a statistical test, not a lookup

Detection does not "find a stamp." It runs a hypothesis test. Given a candidate text, the same secret key, and the g functions, the detector recomputes the g scores at every position and layer and takes the mean. Under the null hypothesis, that the text was not produced by the watermarked model, the mean sits near the unwatermarked baseline. Watermarked text pushes the mean up. Convert that into a z score or a p value and you have a calibrated confidence, with a tunable false positive rate.

The educational sketch below shows the shape of a green list style detector. It is deliberately simplified, it assumes you hold the keyed partition function, which in a real system only the model owner has.

class="syn-keyword">import hashlib
class="syn-keyword">import math

class="syn-keyword">def green_set(prev_token_id, vocab_size, key, gamma=0.5):
    """Keyed pseudo-random 'green' partition class="syn-keyword">for the next position."""
    seed = hashlib.sha256(f"{key}:{prev_token_id}".encode()).digest()
    rng_state = int.from_bytes(seed, "big")
    green = set()
    class="syn-keyword">for tok class="syn-keyword">in range(vocab_size):
        rng_state = (rng_state * 6364136223846793005 + 1) & ((1 << 64) - 1)
        class="syn-keyword">if (rng_state >> 33) / (1 << 31) < gamma:
            green.add(tok)
    class="syn-keyword">return green

class="syn-keyword">def watermark_zscore(token_ids, vocab_size, key, gamma=0.5):
    """z-score class="syn-keyword">for how many tokens landed class="syn-keyword">in their keyed green set."""
    hits, total = 0, 0
    class="syn-keyword">for i class="syn-keyword">in range(1, len(token_ids)):
        g = green_set(token_ids[i - 1], vocab_size, key, gamma)
        hits += 1 class="syn-keyword">if token_ids[i] class="syn-keyword">in g class="syn-keyword">else 0
        total += 1
    expected = gamma * total
    std = math.sqrt(total * gamma * (1 - gamma))
    class="syn-keyword">return (hits - expected) / std class="syn-keyword">if std class="syn-keyword">else 0.0

# z above ~4 is strong evidence; but you MUST hold &#39;key&#39; to compute it.

The takeaway from the code is not the arithmetic, it is the dependency on key. Remove the key and the green set becomes unknowable, the hit rate collapses to chance, and the z score is meaningless. That single fact governs everything downstream.

Robustness and its limits

Keyed sequential watermarks like this are genuinely robust to the edits people try first. Copy and paste changes nothing, because the signal is in the tokens, not in hidden characters. Reformatting and minor synonym swaps leave most of the bracket outcomes intact. But the robustness is not unlimited:

• Short texts. Fewer positions means fewer samples, so the z score never clears the bar. Passages under a couple of hundred tokens are unreliable by construction.
• Heavy paraphrase. Re-generating the text with a different model rewrites the token sequence and washes most of the signal out. This is the one general purpose lever, and it trades your original wording for a reduced, non-guaranteed signal.
• No key, no read. There is no reliable key-free detector. Work on black-box detection of watermarks can sometimes tell that some watermark is present, but that is a long way from reading it or attributing it.

Why the key changes everything for attribution

It is worth being precise about what the key buys, because it is the difference between a watermark and a guess. The key seeds the g functions, and the g functions define which tokens count as evidence at every position. Hold the key and the mean g score is a calibrated statistic with a known null distribution, so you can quote a z score and a false positive rate and defend them. Lose the key and the same text yields a hit rate indistinguishable from chance. There is no halfway state. This is why a watermark is fundamentally an attribution tool for the model owner, not a public detector, and why cross model claims fall apart: the g functions for one provider's key say nothing about another provider's output.

The consequence for anyone downstream is stark. A teacher, editor, or platform cannot run the real test, because they do not have the key, so they fall back on heuristic detectors that infer AI authorship from surface statistics. Those tools answer a different, softer question, and they answer it with meaningful error, which is why treating a heuristic score as if it were a watermark read is a category mistake with real human consequences.

Robustness, measured honestly

Papers report watermark robustness as the detection rate that survives a given attack at a fixed false positive rate. Read those numbers with the attack model in mind. Light edits, reformatting, and single word swaps typically leave detection high, because most bracket outcomes are unchanged. Translation and full paraphrase through a different model drive detection down sharply, because the token sequence that carried the signal is gone. Truncation matters because detection scales with length: halve the text and you roughly halve the evidence. The practical reading is that keyed sequential watermarks are robust against casual tampering and fragile against a determined rewrite, which is exactly the profile you would expect from a signal that lives in token choices. Independent evaluations, including goodness of fit analyses of watermark detection power, keep landing on the same qualitative picture even as they refine the exact thresholds.

Design tradeoffs a builder actually feels

If you were implementing something like this, three tensions would dominate. First, bias strength versus quality: a larger nudge is easier to detect but more likely to distort word choice, which is the whole reason non distortionary schemes are prized. Second, context window for the seed: hashing more preceding tokens makes the partition harder to reverse engineer but more brittle to edits near the hashed span. Third, the detection threshold: set it to catch more watermarked text and you accept more false positives, the same unavoidable trade every detector faces. None of these has a free lunch, and a vendor who claims to have escaped all three is selling something the math does not offer.

How this connects to the tools you build

If you are building on our text API, the honest engineering position falls out of the statistics. A scan endpoint can reliably find hidden Unicode characters, that is deterministic. A rewrite endpoint can reduce a statistical watermark by changing token choices, but it cannot promise a text will pass an owner's detector, because the owner holds a key you do not. Any product that reports a precise "87 percent watermarked" score on arbitrary third party text is inferring, not measuring. We would rather expose the real endpoint behaviour in the playground than dress guesses up as certainty.

The bottom line

SynthID and Tournament Sampling show that production text watermarking is real, quality preserving, and robust to casual edits. They also show its hard boundary: the signal is keyed, so detection and attribution stay with the model owner, and everyone else is left with heuristics. Build with that boundary in mind and your tools will be both useful and honest. Promise past it and you are selling a number the math does not support.

Frequently asked questions

What is Tournament Sampling? A method that biases token selection through a bracket of keyed scoring functions, so watermarked text carries systematically higher scores that a keyed detector can measure, while quality is preserved.

Is SynthID-Text detectable without the key? No. Detection recomputes keyed scores, so it requires the secret key. Black box methods may sometimes sense that some watermark is present, but that is not reading or attributing it.

Does it hurt text quality? It can be tuned toward non distortion, meaning it does not change the output distribution in expectation, which is why it can run in production without visibly degrading text.

How long must text be to detect reliably? Detection power grows with length, so short passages, under a couple of hundred tokens, are unreliable by construction.

Keep reading: Green list watermarking explained · Build a detector in Python · Text API reference