If you've been watching the watermarking debate, you've probably seen the claims. DeepMind's SynthID works at the distribution level, nudging the model's token probabilities in a pattern that's invisible to the human eye (or ear, or text parser) but detectable by a decoder. Attempting to strip it without destroying the content's quality is a cryptanalytic nightmare. That part is real, and it's a serious step up from earlier logger-based approaches. Why the watermark is genuinely hard to break
SynthID isn't a visible artifact or a metadata tag someone can just delete. For images, it's a pixel-space perturbation that survives resizing and recoloring. For text, it's a subtle bias across the entire vocabulary distribution rather than a single inserted marker. For audio, it's a phase-based embedding that can handle background noise. That's why adversarial removal usually degrades the content so much that it becomes useless.
But "hard to break" is not the same as "solves disinformation." And the more I dig into real-world deployment, the more I think we're measuring the wrong metric.
Where the whole approach falls apart
Watermarking only works if you can actually check the content. That means the detection tool needs to be available to every platform, every browser, every mobile app—not just a few big tech players. SynthID isn't a universal standard. It's a closed technique running on specific Google models and a handful of partners. If disinformation gets generated by an open-source LLM or a custom fine-tune, there's no watermark to detect.
And here's the nasty part: paraphrasing. Even a perfect watermark on a paragraph can be evaded by a simple summary rewrite. You don't need to break the watermark; you just change the words. The semantic meaning survives, the watermark doesn't. This is a fundamental limitation of content-embedded watermarks, not a bug that a better training run will fix.
Even if you magically detected every AI-generated text on the internet, you wouldn't have solved disinformation. AI content isn't automatically false, and human content isn't automatically true. A watermark just tells you the origin. It doesn't tell you about intent, factual accuracy, or harm. In many real-world scenarios, people don't care whether a message was generated by an LLM agent or a human—they care whether it's convincing and on-message. A strong fake with a detectable watermark is still a strong fake.
So I'm not saying SynthID is useless. It's a valuable forensic tool for auditing, content provenance, and post-hoc attribution. But as a practical defense against AI disinformation, it's whack-a-mole. The people spreading misinformation have the same access to the technology as everyone else, and they don't have to play by the watermarking rules. We need better provenance infrastructure, platform-level standards, and media literacy—not just a more cryptographically robust sticker.
By all means, keep making watermarks harder to break. Just don't expect them to save us from the disinformation problem. They're a label, not a cure.
[EU AI Labeling Rules 18h ago](/en/news/4744/)
[Next Claude's Malicious Code Leak: How an AI Attacked 3 Real Companies →](/en/news/4798/)