On 7 October the check went public
On 7 October Google opened SynthID Detector to everyone, the portal that until then had been reserved for journalists and researchers.1 On synthid.com you upload an image, a video or an audio file and the system tells you whether it contains the invisible watermark Google puts into what its models produce. Since this year it also recognises it in content from OpenAI, NVIDIA and Kakao, and Google says Apple will join soon.
The figures give a sense of scale. Google says it has marked more than 180 billion images and videos and the equivalent of 240,000 years of audio. Checks run through Search, the Gemini app and Chrome exceed one million a day.1 In May the same feature in the Gemini app had been used 50 million times.2
It matters to me for a practical reason. We can no longer do this by eye: in a study published in PNAS, 315 people told real faces from generated ones 48.2% of the time, worse than a coin toss, and rated the synthetic faces as more trustworthy than the real ones.3 Tools are becoming necessary, but they need to be understood, because they do not all do the same thing and none of them answers the question we usually ask: is this content real?
Three different ways to look for AI
When people talk about "AI detectors" they lump together tools that work in very different ways.
The first is the watermark. While it generates, the model hides in the content a signal the eye cannot see and a program with the right key can read. This is what SynthID does. It works well, but only on content from the models that add it.
The second is provenance. The C2PA standard, also called Content Credentials, attaches to the file a kind of identity card signed with cryptography: who created it, with which tool, what changes it went through.4 It says where a file comes from and what has happened to it, without judging the content. The problem is that this identity card lives in the metadata, and a screenshot or an upload to social media makes it disappear.
The third is the detector proper, a classifier trained to recognise the style of AI without any signal to read. These are GPTZero, Turnitin, Hive and dozens of others. They work on any content, but they are guessing, and I will come back to that.
Three families of tools for recognising generated content
| Family | How it works | Examples | Main limit |
|---|---|---|---|
| Watermark | An invisible signal added by the model as it generates | Google's SynthID, OpenAI's textGrain, Claude's watermark, Meta's Video Seal | Only covers the models that add it and weakens with rewriting |
| Provenance | Signed metadata that records a file's origin and edits | C2PA and Content Credentials, Leica, Sony and Pixel 10 cameras | Disappears with a screenshot or a re-upload |
| Detector | A classifier that estimates probability from style | GPTZero, Turnitin, Pangram, Hive, Reality Defender | False alarms and results that shift with new models |
How SynthID works
For text, SynthID acts at the moment the model chooses the next word. A secret key sets up a kind of tournament among candidate words and nudges the probabilities slightly, enough to leave a statistical imprint over a long text, too little for a reader to notice. Google described it in Nature in October 2024 and tested it on about 20 million Gemini responses, with no difference in how users rated them.5 It also made it open source, so other developers can use it on their own models.
For images, video and audio the signal is woven into the pixels or the sound and is designed to survive cropping, filters, compression and speed changes. The portal answers "watermark detected" or "not detected" and, for video and audio, shows where.
Google itself is clear about the limits. Very short text, factual answers with few possible alternatives, translations and deep rewrites greatly lower the confidence of the check.6 Above all, "not detected" does not mean the content is human: it may come from Midjourney, from an open-source model or from any system that does not use SynthID.
What the others do
2026 is the year watermarks became the norm, mostly because of European law.
Since May OpenAI has added SynthID and C2PA to images created with ChatGPT and its APIs.2 On 5 October it announced textGrain, a text watermark switched on by default for ChatGPT and Codex only in the European Union, and available on request to developers elsewhere. For now the detector is reserved for approved researchers. OpenAI itself reports that replacing 10% of the words with synonyms lowers recognition from about 92% to 66%.7
Anthropic adds a watermark to text from Claude models and attaches Content Credentials to the PNG and JPEG files it generates. Files can be checked for free at claude.com/check-content, while text checking is open only to regulators, researchers, media and schools. Anthropic too warns that a mark found is not conclusive proof, because Claude may only have corrected or translated a text written by someone else.8
Meta has open-sourced Video Seal and AudioSeal, ElevenLabs is adopting SynthID for synthetic voices, and on the provenance side the Pixel 10 was the first phone to sign camera photos with Content Credentials.2 Anyone can read those credentials at contentcredentials.org/verify.
How we got here
- Jan 2023OpenAI launches a classifier for generated text
- Jul 2023It withdraws it: it recognised only 26% of AI-written texts
- Aug 2023Google introduces SynthID for images
- Oct 2024SynthID for text appears in Nature and goes open source
- May 2025The SynthID Detector portal opens to journalists and researchers
- Aug 2026In Europe marking generated content becomes mandatory
- Oct 2026SynthID Detector opens to everyone
How well they work
Watermarks survive small changes, but a rewrite almost always wipes them out. In July two researchers put marked texts through a paraphrase that keeps the meaning: the watermark most used in research, called KGW, disappeared in 100% of cases, SynthID's in 98.3%.9 For images the problem also runs the other way: back in 2023 a study showed that a fake signal can be added to a real photo to make it look generated.10
Text watermarks removed by a paraphrase
Detectors that guess from style do worse. OpenAI launched its classifier in January 2023 and withdrew it six months later: it recognised 26% of AI-written texts and flagged 9% of human ones as artificial.11 A study of six detectors measured an accuracy of 39.5%, down to 17.4% after small edits designed to fool them.12
The most worrying result, to me, comes from a University of Notre Dame paper published in August. Scientific abstracts written by people were flagged as AI up to 15% of the time. Those lightly touched up with AI, as many guidelines allow, up to 80%. Those generated and then run through a program that "humanises" them almost never, under 4%.13 In practice, people who use AI openly and properly are at greater risk than those who use it to cheat.
How often a text detector says "AI"
For images, video and audio the picture is similar. The Deepfake-Eval-2024 benchmark, built from deepfakes that actually circulated online in 2024 in 52 languages, showed that open-source detectors lose about half their ability to tell real from fake compared with academic tests: 50% for video, 48% for audio, 45% for images. Commercial products do better, but they do not yet match human forensic analysts.14
The rules: since 2 August marking is an obligation
Since 2 August 2026, Article 50 of the AI Act requires providers of generative AI systems to mark images, video, audio and text in a machine-readable format, and those who publish deepfakes to disclose them. Under the Digital Omnibus agreement, systems already on the market before that date have until 2 December to add the marking.15 The European code of practice, published in June, had about 190 signatories by the end of July, including Google, OpenAI, Anthropic, Meta, Microsoft and Mistral.16 China has had similar rules since September 2025, California since 2 August this year.
In Italy, Law 132 of 2025 introduced the offence of unlawfully spreading content generated or altered with AI, with sentences of one to five years when the content deceives and causes harm.17 It is a tool for punishing after the fact. Watermarks are there to prevent, and to give investigators a trail to follow.
What I think
Watermarks are a real step forward, and the fact that Google has opened its check to content from OpenAI and NVIDIA matters more than any technical announcement. But they should be read for what they are: a positive signal. If the watermark is there, the content went through a particular model. If it is not, we know nothing, because anyone who wants to deceive will use a model that does not mark, or rewrite the text until the mark is gone.
That is why I believe the greatest value lies not in recognising what is fake but in proving what is real. A photo signed by the camera at the moment it was taken, with an edit history that can be checked, is worth more than any probability score. A newspaper, a company or an institution that publishes authentic material should start there.
On text detectors I am firmer: I would never use them to judge a person, whether a student, a candidate or a colleague. With those error rates the risk of accusing someone who wrote honestly is too high. If an organisation needs to know how a text was produced, the way forward is to ask and to make declaring it normal.
How to check content today
- Images, video, audioLook for the watermarkUpload the file to synthid.com or ask the Gemini app whether it was made with AI. It covers Google and its partners, not everyone.
- Photos and filesRead the provenancecontentcredentials.org/verify shows origin and edits, if the metadata is still there. Claude's files can be checked at claude.com/check-content.
- ContextFind the originalReverse image search and the free InVID-WeVerify plugin for video. Fact-checkers start here, not with detectors.
- A voice on the phoneCall backHang up and call back on a number you already know. In February 2025 the fake voice of Italian minister Crosetto persuaded Massimo Moratti to transfer almost one million euros, most of it later frozen by prosecutors.
Full Fact, one of the main British fact-checkers, considers online detectors unreliable and does not use them routinely: it cross-checks source, context and details, and when it writes it prefers "likely generated" to "generated".18 It seems the right method to me even for people who do not do this for a living. An automatic check can help decide where to look, but the conclusion is still ours, and reaching it takes several clues put together.
The Crosetto case shows this better than any study. The voice was credible and the request urgent, and only a verification call made on another channel would have stopped the scam.19