Does paraphrasing remove SynthID? We tested 120 watermarked passages
We watermarked 120 passages with the open-source release of Google’s SynthID-Text, edited each one six ways, and checked which were still detected. Before editing, the detector caught 120 of 120. Swapping 10% of the words left 92% detectable. A full paraphrase by another AI model left 8%, and Unmark’s three rewrite strengths 1%–3% — close to the 1% the detector flags in text that was never watermarked. All results use a 1% false-positive rate.
Updated .
of watermarked passages detected before any edit
still detected after swapping 10% of the words for synonyms
after a 25% synonym swap, which leaves the text visibly garbled
after Unmark’s default rewrite, with a median meaning similarity of 0.91
Vertical line: the 1% of unwatermarked passages the detector flags by chance. Whiskers: 95% confidence interval.
The results
| Edit | Detected | Meaning kept | Words reused |
|---|---|---|---|
| No edits | 100% | — | — |
| Swap 10% of words for synonyms | 92% | 0.94 | 91% |
| Swap 25% of words for synonyms | 23% | 0.84 | 77% |
| Paraphrase with another AI model | 8% | 0.94 | 74% |
| Unmark, light | 1% | 0.91 | 61% |
| Unmark, balanced (default) | 3% | 0.91 | 70% |
| Unmark, aggressive | 1% | 0.91 | 67% |
“Detected” means the passage’s SynthID score clears the bar that only 1% of unwatermarked text clears. “Meaning kept” scores how close the edit’s meaning is to the original’s (1.00 = the same); “words reused” is the share of the edit’s words that appear in the original.
Each dot is one passage’s z-score. Right of the line (z > 2.33) counts as watermarked; unwatermarked text lands there 1% of the time. Scores above 12 are drawn at the edge.
Light edits don’t remove SynthID
Swapping one word in ten for a synonym — the edit OpenAI uses to test its own textGrain watermark — left 110 of 120 passages detectable. The text still reads the same, and most of it is unchanged: 61% of the five-token runs the detector looks at survived. Pushing the swap to a quarter of the words cut detection to 23%, but at that point the prose is visibly mangled — “Vinyl discs made a surprising counter in late years” — and its meaning score (0.84) was lower than any full rewrite’s. A reader notices before any detector does.
OpenAI reports the same shape for its own textGrain watermark on 400-token passages: about 92% detected unedited, 66% after 10% swaps and 17% after 25%. The watermarks and detectors differ, so the numbers aren’t directly comparable, but in both cases a quarter of the words has to change before most passages slip under the line.
A full rewrite does
When every sentence is rewritten, most of the watermark goes with the old wording. Asking another AI model to paraphrase each passage — the same Qwen model, without the watermark — left 10 of 120 detectable (8%). Unmark’s light, balanced and aggressive rewrites left 1, 4 and 1: 6 of 360 rewrites in all, close to the 0.6% of never-watermarked passages the detector flags by chance.
The difference is how much of the original survives. The AI paraphrase kept 14% of the original’s five-token runs (median); Unmark’s default kept 5%. The cost is that Unmark changes more of the wording: its median meaning similarity was 0.91, against 0.94 for the AI paraphrase, and it kept 95% of the names and numbers in the originals, against 96%. Re-read anything you rewrite, whichever tool you use.
One catch with the do-it-yourself route: if you paraphrase in the Gemini app, with ChatGPT in the EU, or with a recent Claude model, the new text carries that provider’s own watermark. You swap one mark for another.
Update, November 11: fewer lost names and numbers
The rewrites above sometimes dropped a name or a number: “60 to 70 degrees Fahrenheit” came back without the unit. Since November 11, Unmark checks each rewritten paragraph for the names and numbers in the original and rewrites it again when one is missing. To see whether that helped, we ran the same 120 passages through the live site again at the Light and Balanced strengths.
| Strength | Names and numbers lost | Still detected | Median time |
|---|---|---|---|
| Light | 16 → 4 | 1 → 1 | 1.6 → 2.0 s |
| Balanced | 9 → 5 | 4 → 2 | 1.6 → 2.0 s |
Light, which had lost the most, now loses far fewer: 16 down to 4. Balanced went from 9 to 5. Detection stayed as low as before, and the extra check adds about 0.4 s per rewrite. Of the 9 still flagged, five are the same fact in other words, such as “50%” written as “half”; four were really left out.
Why: the watermark lives in five-token runs
SynthID-Text doesn’t mark words; it marks choices. At each step, a secret key and the four previous tokens decide which candidate words get a small boost. The detector repeats that calculation for every token and its four predecessors, and asks whether the text picked the boosted options more often than chance. Change any one of those five tokens and that position goes back to a coin flip.
That is why the share of five-token runs that survive an edit predicts the score so well. A 10% swap keeps 61% of them; a 25% swap keeps 25%; a full rewrite keeps 5% or less — too few for any signal to remain.
In plain counts: of the 405 edited texts that kept under 10% of the original’s five-word runs, 6 were still detected; of the 195 that kept 10–35%, 38; of the 120 that kept more than half, 110. Unmark’s tool now reports that share after every rewrite, so you can see where your own text falls.
Length matters too. Scoring only the first 50 tokens (about 40 words), the detector caught 28% of unedited passages; by 200 tokens it caught 98%, and with the whole passage 100%. After a 10% swap it needed the whole passage to reach 92%. Rewritten text stays near the 1% floor at every length, so a longer text doesn’t bring the watermark back.
Is anything left after a rewrite?
After Unmark’s rewrites, a faint trace at most. Averaged over all 120 passages, their scores sat only slightly above those of text that was never watermarked, too little to flag a single passage; the AI paraphrase sat clearly higher. What remains comes from the few phrases a rewrite keeps. A few rewrites did cross the line: 6 of 360, where chance alone would put about 4. The highest-scoring ones kept only a handful of the original’s phrases, so they read as rewrites, not as copies.
Does the detector cry wolf?
A watermark test is only meaningful if it rarely flags innocent text, so we generated 160 more passages from the same prompts and model without the watermark. The detector flagged 1 of them (0.6%), in line with the 1% it is designed for.
What this means for Gemini, Claude and ChatGPT text
- Gemini watermarks with SynthID using Google’s private keys and detector, so we can’t test it directly. Google’s own documentation says detector confidence “can be greatly reduced when an AI-generated text is thoroughly rewritten” — consistent with our results.
- ChatGPT uses OpenAI’s own watermark, textGrain, for users in the EU. OpenAI’s published synonym-swap figures follow the same pattern we measured.
- Claude uses Anthropic’s watermark; Anthropic says a complete rewrite removes it. See the tracker for who marks what.
- In every case, hidden-character cleaners do nothing against statistical watermarks: there are no characters to remove. Only the wording carries the mark.
How we ran it
An open model, Qwen3-4B-Instruct, wrote 120 passages of about 300 words on 40 everyday topics, as explainers, blog posts, newsletters and letters, with the open-source SynthID-Text watermark on at the settings Hugging Face recommends. Each passage was then edited six ways: random synonym swaps for 10% and 25% of the words, a paraphrase by the same model with the watermark off, and Unmark’s three rewrite strengths on the live site on November 1, 2026. Every version was scored with the detector from the SynthID paper.
Limits
- Not Gemini’s production watermark. We used our own keys on a small open model. Google’s keys, hashing and trained detector are private, and a trained detector can be more sensitive than the training-free one we used.
- English prose only, about 300 words per passage. Code, lists, very short answers and other languages weren’t tested.
- Rewrites are random. A rerun gives slightly different texts; our November 11 re-run of two strengths gave similarly low detection.
- Automated synonym swaps are cruder than a person editing by hand; they stand in for “change some words”, not for careful editing.
- Meaning similarity is an automatic score, not a human judgment.
Cite this study
Unmark’s default rewrite, as tested here. Free, no sign-up.