In October 2024, Google co-authored the seminal paper on watermarking AI-generated text published in none other than Nature. Its SynthID technology has since watermarked over ten billion pieces of content. And yet, the same Google insists, backed by official documentation, that it does not penalise content simply because it was written by a machine.
These are two positions that seem somewhat contradictory, but with Google, we’re somewhat used to it: that the company funding the most advanced research into AI detection refuses, in black and white, to make it a ranking criterion, it’s strange, but it’s not that strange after all: detecting the origin of a text and measuring its value are two distinct problems, and Google has decided to focus solely on the latter.
The question ‘Is my AI content penalised?’ is therefore misguided, and here’s why.
What is text watermarking?
Whilst the term ‘watermark’ is easily recognised in relation to a photo, it is hard to imagine that the same could be done for text; yet it is well documented: SynthID-Text, the method developed by Google DeepMind, has been documented, published in a peer-reviewed journal, and made open-source on Hugging Face.
It even appears to be running in production within the Gemini application.
The principle is as follows: a language model (LLM) generates the text token by token, sampling at each step from a probability distribution.
SynthID intervenes at this point with a pseudo-random function (the g-function), which subtly modulates the choice of tokens via a mechanism called tournament sampling. What this essentially does is this: when SynthID intervenes, it refrains from using certain terms during generation (or rather, it forces the use of an alternative term) within its probability table.
The text remains fluid, the meaning is preserved, and a human reader is none the wiser, but the statistical pattern left in the sequence of words is recognisable by a trained detector.
What is retained is not the sentence or the words used here, but the statistical sequence that corresponds to the expected watermark.
What is the point of an LLM watermarking its content?
An LLM is trained on astronomical volumes of data scraped from the web. However, since the widespread adoption of generative AI, a growing proportion of this web content is itself generated by models, including the model itself. With no way of identifying them, these synthetic texts end up being fed back into the training corpora, and the model ends up relearning from its own outputs: a feedback loop that gradually erodes the diversity and quality of the generated content, a phenomenon documented under the name of ‘model collapse’.
Watermarking offers a solution: by signing the texts it produces, the provider can reliably identify them during crawling and filter them out before training.
Detection methods are fragile (even Google admits it)
The watermark only works if the text was generated by a model designed to produce watermarked text: if you generate your content using a local model, an open-source model without a watermark, or a provider that doesn’t include one, there is simply nothing to detect.
What do studies on the subject say? When applied to a text used as-is after creation (including the watermark), SynthID is robust against minor alterations (cropping, changing a few words, mild paraphrasing). However, the detector’s confidence plummets as soon as the text is substantially rewritten or translated into another language. Watermarking is also recognised as being less effective on short content and factual responses, where there is little scope to modify tokens without compromising accuracy.
In “Can AI-Generated Text Be Reliably Detected? ”, the co-authors demonstrated as early as 2023 that a simple paraphrasing attack breaks a wide range of detectors, including watermarking, and they backed up this empirical result with an impossibility theorem: for a sufficiently powerful language model, the best possible detector performs only marginally better than a random guess.
More recent work (2025) drives the point home: a cross-language summarisation attack (translate, summarise, retranslate) reduces detection to a coin-toss, whilst preserving the text’s meaning.
And there’s something even worse: spoofing. A writer who has seen enough output from a watermarked model can produce human-written text that the detector will classify as AI-generated. In other words, a detector deployed on a large scale doesn’t just fail to identify AI-generated content; it also falsely flags human-written content. For a search engine, this is the worst of both worlds: a false negative lets spam slip through, but a false positive demotes a legitimate, high-quality page.
We arrive at a clear conclusion: a reliable detection system, deployable across hundreds of billions of pages and resistant to even a moderately motivated adversary, does not exist, and is unlikely to be developed any time soon.
Why Google isn’t banking on detection
Anyone familiar with the reasoning behind the search engine’s cascading architecture will recognise the pattern: running a watermark classifier on every page in the index, for every evaluation, is exactly the kind of cost that the cascading architecture is designed to avoid. Except that here, the calculation is even worse: not only is it costly, but it doesn’t work against paraphrasing, and it produces catastrophic false positives.
Put yourself in the shoes of the search team for a moment: you’re being offered a signal that: is expensive to evaluate at scale, breaks down as soon as a writer runs their text through a paraphrasing tool, fails to capture anything from unbranded models, and risks causing flawless human-written content to drop in rankings. You’re not going to make it a cornerstone of your ranking. You’re going to do what Google already does very well: ignore the question of origin, and measure value.
And Google knows how to measure value—or at least has a good idea of how to assess it—and it does so without needing to know who’s behind the pen: User satisfaction via behavioural signals (aggregated clicks, the longest click in a session), semantic relevance via the salient terms expected for a query, and demonstrated experience and expertise via the E-E-A-T framework (as on Yourtext Guru and the LLM SEO module).
None of these signals requires answering ‘did a machine write this?’, but rather ‘does this deserve to rank?’. It is more robust, cheaper, and insensitive to paraphrasing.
When Google states that it does not penalise AI content, it is neither naivety nor generosity. It is the clear-eyed realisation that assessing the origin of a text is a technical and economic dead end.
But since March 2024, Google has also rolled out its policy on scaled content abuse: the mass production of pages whose primary aim is to manipulate rankings without providing any added value to the user. Under this policy, all text that offered no value to the user is penalised, regardless of whether or not it contained AI-generated content (and spoiler alert: there was some).
Hence the prevailing confusion: ‘Google says it doesn’t penalise AI, but penalises AI-generated sites’. Both statements are true, because the target has never been AI, but rather thin content churned out en masse.
Google doesn’t need to know if a machine wrote your text. That information would be costly to obtain, would be lost at the first paraphrase, and wouldn’t tell it anything useful. All it needs to know—and what it already measures very well—is whether a human wanted to read it all the way through.
The watermark answers ‘who wrote this?’. The engine, however, asks a completely different question: ‘should anyone have read this?’. As long as you focus on the second question, the first one is of no concern to you.
Sources used:
Google DeepMind: Scalable watermarking for identifying large language model outputs (SynthID-Text), Nature, October 2024: https://www.nature.com/articles/s41586-024-08025-4
Google DeepMind: Responsible GenAI Toolkit, SynthID Text documentation (robustness and limitations): https://ai.google.dev/responsible/docs/safeguards/synthid
Sadasivan et al.: Can AI-Generated Text Be Reliably Detected? (paraphrase attack, impossibility result), 2023: https://arxiv.org/abs/2303.11156
Google Search Central: Guidance on Generative AI Content and Spam Policies (scaled content abuse): https://developers.google.com/search/docs/fundamentals/using-gen-ai-content
