The Tournament Is a Distribution Update
7 min read
A text watermark lets a provider recognize generated text using a secret key. Google DeepMind reports using SynthID-Text to watermark Gemini [DS+, Nature ’24], and in August 2026 Anthropic announced that future Claude models will use a version of the same approach.
SynthID creates a watermark through a tournament between sampled tokens. Each round assigns tokens scores of zero or one; a score-one token wins against a score-zero token, and ties use a fair coin. The score function is computed by hashing the secret key with the few preceding tokens. A detector holding the key can therefore reconstruct the scores from the text and check how often the emitted tokens scored one, without needing the model or its prompt. The tournament favors those tokens for a fixed key, while averaging over fresh random keys preserves the model’s token probabilities.
The figure shows two rounds with four sampled tokens, \(a,b,c,d\). The first-round score function \(g_1\) favors \(a\) and \(d\); the second-round function \(g_2\) favors \(a\) over \(d\), leaving \(a\) as the output. Toggle a score or a tied match’s coin to see how the winner changes.
Samples
four draws from p
Round 1 · g1
Winners
after round 1
Round 2 · g2
Output
after round 2
Round 1: a and d advance. Round 2: a is the output.
In general, an \(m\)-round tournament starts with \(2^m\) independent draws from the model’s next-token distribution \(p\), after temperature and any truncation. Round \(\ell\) uses the same score function \(g_\ell(x)\) in every match. Thirty rounds would start with more than a billion draws for one output token. We can compute the winner’s distribution one round at a time instead, then sample once from the final probabilities.
One Round Rescales the Probability Vector
Take the first round of the example, with \(p=(0.4,0.3,0.2,0.1)\) on \((a,b,c,d)\) and \(g_1=(1,0,0,1)\), so half the mass sits on score-one tokens. A contestant that is \(a\) wins its match if the opponent scores zero, which happens with probability one half, and wins half the time otherwise. Either of the two slots can hold that \(a\), so \(a\) leaves the round with probability \(2\times0.4\times(\tfrac12+\tfrac12\cdot\tfrac12)=0.6\). The same count gives \(b\) probability \(2\times0.3\times\tfrac12\cdot\tfrac12=0.15\): it wins only against a score-zero opponent, and then only on the coin. Each is the incoming probability times a factor that depends only on the score, \(1.5\) for score one and \(0.5\) for score zero.
In general, write \(\mu_\ell\) for the incoming mass on score-one tokens at round \(\ell\):
\[ \mu_\ell=\sum_{y\in V}p_{\ell-1}(y)\,g_\ell(y), \]
where \(V\) is the set of tokens with positive probability after any truncation, \(p_0=p\), and \(p_{\ell-1}\) is the distribution of a contestant entering round \(\ell\). A contestant is an independent draw from \(p_{\ell-1}\), so \(\mu_\ell\) is the probability that an opponent scores one.
Lemma: Every token leaving round \(\ell\) has distribution:
\[ p_\ell(x)=p_{\ell-1}(x) \left[1+g_\ell(x)-\mu_\ell\right]. \]
Proof
Fix a token \(x\) with \(g_\ell(x)=1\). An occurrence of \(x\) wins outright against a score-zero opponent and wins half the time against another score-one token. Either contestant slot can supply that occurrence, so its winning probability is:
\[ \begin{aligned} p_\ell(x) &=2p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr) +2p_{\ell-1}(x)\mu_\ell\cdot\frac12 \\ &=2p_{\ell-1}(x) -p_{\ell-1}(x)\mu_\ell \\ &=p_{\ell-1}(x)\bigl(2-\mu_\ell\bigr), \qquad g_\ell(x)=1. \end{aligned} \]
A score-zero token can win only when its opponent also has score zero. The same tie calculation gives:
\[ \begin{aligned} p_\ell(x) &=2p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr)\cdot\frac12 \\ &=p_{\ell-1}(x)\bigl(1-\mu_\ell\bigr), \qquad g_\ell(x)=0. \end{aligned} \]
Substituting \(g_\ell(x)=1\) in the first case and \(g_\ell(x)=0\) in the second combines them into the claimed formula. It is a valid probability distribution because its total mass is:
\[ \begin{aligned} \sum_{x\in V}p_\ell(x) &=\sum_{x\in V}p_{\ell-1}(x) +\sum_{x\in V}p_{\ell-1}(x)g_\ell(x) -\mu_\ell\sum_{x\in V}p_{\ell-1}(x) \\ &=1+\mu_\ell-\mu_\ell \\ &=1. \end{aligned} \]
Within a round the matches use disjoint contestants and separate coins, so the winners are independent draws from \(p_\ell\), which is the premise for round \(\ell+1\). Repeating through round \(m\) gives the final winner’s distribution \(p_m\).
The interactive figure below runs the example’s two rounds as probability updates.
p0
input distribution
Round 1 · g1
μ1 =
p1
winner distribution
Round 2 · g2
μ2 =
p2
winner distribution
The scores start as in the bracket, \(a\) and \(d\) scoring one under \(g_1\) and \(a\) and \(c\) under \(g_2\). Change any score to see both the immediate update and its effect on the following round. The final column is \(p_2\), the distribution from which the algorithm draws its one token.
Each round costs one weighted sum for \(\mu_\ell\) and one pass over the vector, so \(m\) rounds cost \(O(m|V|)\) for a support of \(|V|\) tokens, and the bracket’s \(2^m\) draws and \(2^m-1\) matches are never made. (When \(2^m\) is small next to \(|V|\), playing the bracket is cheaper; what the lemma guarantees is equal output distributions, and the update also exposes the whole watermarked vector, which the bracket never does.)
Random Keys Restore the Model Distribution
What is the winner’s distribution once we average over the score function? SynthID’s hash behaves like a fair coin for each score, but nothing below needs the coin to be fair, so let each \(g_\ell(x)\) be an independent Bernoulli(\(q\)) draw, independent of the earlier rounds. Hold the incoming distribution \(p_{\ell-1}\) fixed and average the update over \(g_\ell\) alone.
Lemma: Averaging over this fresh random function returns every token to its incoming probability:
\[ \mathbb E_{g_\ell}\!\left[p_\ell(x)\right] =p_{\ell-1}(x). \]
Proof
A fixed token has mean score \(q\):
\[ \mathbb E_{g_\ell}\!\left[g_\ell(x)\right]=q. \]
So does the incoming score-one mass, because it is a probability-weighted average of such scores:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[\mu_\ell\right] &=\mathbb E_{g_\ell}\!\left[ \sum_{y\in V}p_{\ell-1}(y)g_\ell(y) \right] \\ &=\sum_{y\in V}p_{\ell-1}(y) \mathbb E_{g_\ell}\!\left[g_\ell(y)\right] \\ &=q\sum_{y\in V}p_{\ell-1}(y) \\ &=q, \end{aligned} \]
where we moved the expectation inside the sum, then used that every token has mean score \(q\) and that \(p_{\ell-1}\) sums to one. The update is linear in \(g_\ell(x)\) and \(\mu_\ell\), so the expectation passes through it:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[p_\ell(x)\right] &=p_{\ell-1}(x)\left( 1+\mathbb E_{g_\ell}[g_\ell(x)] -\mathbb E_{g_\ell}[\mu_\ell] \right) \\ &=p_{\ell-1}(x)(1+q-q) \\ &=p_{\ell-1}(x). \end{aligned} \]
Because \(g_\ell\) is independent of the earlier score functions, averaging over it with the earlier ones held fixed is the lemma, and the outer average then sees \(p_{\ell-1}\) in place of \(p_\ell\):
\[ \begin{aligned} \mathbb E_{g_1,\ldots,g_\ell}\!\left[p_\ell(x)\right] &=\mathbb E_{g_1,\ldots,g_{\ell-1}}\!\left[p_{\ell-1}(x)\right] \\ &=p_0(x), \end{aligned} \]
where the second line repeats the same step back through round \(1\).
For a fixed key, each round tilts its incoming distribution toward the score-one tokens of its own \(g_\ell\). Across random keys, every token has its original probability. This guarantee is called single-token non-distortion: it is a statement about one position, because a context that repeats produces the same score functions again, so the randomness at different positions of a sequence is not independent.
The Signal a Fixed Key Leaves
With the key fixed, what does one round change? The detector counts how often the emitted tokens scored one, so the quantity to track is the probability that a round’s winner scores one. Entering round \(\ell\), that probability is \(\mu_\ell\).
Lemma: Leaving round \(\ell\), the winner scores one with probability:
\[ \sum_{x:\,g_\ell(x)=1}p_\ell(x) =\mu_\ell+\mu_\ell(1-\mu_\ell). \]
Proof
Every score-one token’s probability is multiplied by \(2-\mu_\ell\), so the score-one mass is:
\[ \begin{aligned} \sum_{x:\,g_\ell(x)=1}p_\ell(x) &=(2-\mu_\ell)\sum_{x:\,g_\ell(x)=1}p_{\ell-1}(x) \\ &=(2-\mu_\ell)\,\mu_\ell \\ &=\mu_\ell+\mu_\ell(1-\mu_\ell). \end{aligned} \]
The second line uses that the incoming score-one mass is \(\mu_\ell\) by definition.
The rise \(\mu_\ell(1-\mu_\ell)\) is the variance of a coin with bias \(\mu_\ell\). It is largest when the incoming mass splits evenly between the two score groups, and zero when every contestant is on the same side, where every match is a tie.
The coin’s bias \(q\) also affects the rise; return to independent Bernoulli(\(q\)) scores with \(p_{\ell-1}\) held fixed.
Claim: The expected rise is the coin’s variance times the probability that two independent draws from \(p_{\ell-1}\) differ:
\[ \mathbb E_{g_\ell}\!\left[\mu_\ell(1-\mu_\ell)\right] =q(1-q)\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \]
Proof
Split the expectation into a mean and a second moment, using that \(\mu_\ell\) has mean \(q\) from the previous section:
\[ \mathbb E_{g_\ell}\!\left[\mu_\ell(1-\mu_\ell)\right] =q-\mathbb E_{g_\ell}\!\left[\mu_\ell^2\right]. \]
Squaring the sum that defines \(\mu_\ell\) pairs every token with every token:
\[ \begin{aligned} \mathbb E_{g_\ell}\!\left[\mu_\ell^2\right] &=\sum_{x\in V}\sum_{y\in V}p_{\ell-1}(x)p_{\ell-1}(y)\, \mathbb E_{g_\ell}\!\left[g_\ell(x)g_\ell(y)\right] \\ &=q\sum_{x\in V}p_{\ell-1}(x)^2 +q^2\sum_{x\ne y}p_{\ell-1}(x)p_{\ell-1}(y) \\ &=q\sum_{x\in V}p_{\ell-1}(x)^2 +q^2\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \end{aligned} \]
On the diagonal, \(g_\ell(x)^2=g_\ell(x)\) has mean \(q\); off the diagonal, independence gives \(\mathbb E_{g_\ell}[g_\ell(x)g_\ell(y)]=q^2\); and the off-diagonal products sum to one minus the diagonal ones. Subtracting from \(q\) and collecting the two sums:
\[ \begin{aligned} q-\mathbb E_{g_\ell}\!\left[\mu_\ell^2\right] &=q-q^2-\bigl(q-q^2\bigr)\sum_{x\in V}p_{\ell-1}(x)^2 \\ &=q(1-q)\left(1-\sum_{x\in V}p_{\ell-1}(x)^2\right). \end{aligned} \]
The first factor is largest at the fair coin SynthID uses:
\[ q(1-q)=\frac14-\left(q-\frac12\right)^2\le\frac14, \]
with equality at \(q=1/2\). The second factor is the probability that two independent incoming tokens differ: near one for a diffuse, high-entropy distribution and zero for a point mass, where every match is a tie.
Like exponential tilting, the update reweights a distribution by a score. Tilting multiplies \(p_{\ell-1}(x)\) by \(e^{\lambda g_\ell(x)}\) for a strength \(\lambda\) and divides by a normalizing constant; the tournament’s linear factor \(1+g_\ell(x)-\mu_\ell\) needs no normalization, because subtracting the opponent’s average score already centers it.
To detect, recompute every position’s score functions from the key and the preceding tokens, and average the scores the emitted tokens received over all positions and rounds. Watermarked text scores above one half on average, and text written without the key does not. (The production system also trains a Bayesian detector on these scores.) The evidence is statistical rather than proof of authorship: it needs enough tokens at which the model was uncertain, and paraphrasing or editing weakens it.
The same secret-randomness pattern appears in exponential minimum sampling: conditioning on the key creates a detectable correlation, while averaging over it preserves the original distribution. SynthID adds a computational move: when a randomized selection is expensive because it materializes every contestant, compute the winner’s distribution and propagate it instead.