SynthID and AI Music: How Audio Watermarking Actually Works
SynthID audio watermarking is the reference implementation for marking AI-generated music, and it is the technology most often assumed to be behind Suno's rollout. What it does, what it survives, and what Suno has actually confirmed are three separate questions.
- SynthID watermarks audio by converting the waveform to a spectrogram, embedding the marker there, then reconstructing the waveform. It is not a hidden tone layered on top.
- Google states the audio watermark survives added noise, MP3 compression and speed changes — which is why the common DIY remedies are documented by the vendor as ineffective.
- Suno has not disclosed which technology it is using. SynthID is the reference implementation and the most cited candidate, not a confirmed fact.
- Google's SynthID Detector only reads Google-generated output, so it cannot verify a Suno track either way. That is part of why free checkers and distributor screening disagree.
- Peer-reviewed work finds deep-learning audio watermarks are robust but not impervious — removal without audible degradation is an engineering problem, not an impossibility.
SynthID audio watermarking is the reference implementation for marking AI-generated music, and since Suno's August 2026 announcement it has become the technology everyone assumes is involved. That assumption is reasonable and unconfirmed, which is a distinction worth keeping.
This page covers what SynthID actually does to audio, what the vendor says it survives, what the research literature says about AI music watermarking as a category, and where Suno genuinely sits in that picture.
What SynthID is
SynthID is Google DeepMind's watermarking system for AI-generated content. It spans four modalities — text, images, video and audio — using a different mechanism for each, and it is embedded at the point of generation rather than applied afterwards.
For audio specifically, Google states that SynthID "embeds a watermark into any audio generated or published through our AI music generation model Lyria or the podcast generation feature of NotebookLM."
Two things make it the reference point for this whole subject. It was the first audio watermarking scheme deployed at consumer scale, and it is the one with published documentation, which means claims about it can be checked rather than assumed.
How the audio watermark is embedded
The mechanism is more interesting than "a hidden signal in the file", and understanding it explains almost everything else on this page.
A raw audio waveform is one-dimensional — amplitude over time. SynthID converts it into a spectrogram, a two-dimensional representation showing how the spectrum of frequencies evolves across the duration of the track. The watermark is embedded into that representation. The spectrogram is then converted back into a waveform, which is what you hear and what leaves the platform.
The inaudibility comes from psychoacoustic masking — the well-established property that louder sounds conceal quieter ones occurring near them in time and frequency, and that human hearing is markedly less sensitive in some frequency regions than others. The embedding is placed where the ear is least able to notice it.
The consequence is the part producers most often get wrong. The watermark is not a high tone sitting above the music that could be filtered off, and it is not a layer that could be subtracted. It is distributed through the structure of the sound itself.
Why the obvious remedies do not work
Google's own robustness claim is unusually specific, and it is worth reading as a list of things not to bother trying. The audio watermark, per DeepMind, "is inaudible to the human ear, and can't be altered by common modifications like adding noise, MP3 compression, or changing the speed of the track."
That covers, by name, three of the four things producers reach for first:
| Attempted fix | Why it fails |
|---|---|
| Re-encode as MP3 | Named by the vendor as survivable. Lossy compression is an explicit design target. |
| Add noise or dither | Named by the vendor as survivable. The marker is not distinguished from the noise floor by level. |
| Speed or pitch change | Named by the vendor as survivable, and it audibly damages the music. |
| EQ or mastering chain | Acts on perceptible frequency balance. The marker is placed where perception is weakest. |
The fourth is the expensive one, because it is the one that feels most like real work. An afternoon in a mastering chain or an audio repair suite produces a file that sounds different and screens identically. That is not a matter of using a better plugin — it is a category error, and our primer on the Suno watermark covers why the two layers are separate.
What the research says about music specifically
Speech watermarking and music watermarking are not the same problem, and the literature treats them separately. A 2025 survey presented at the ICLR GenAI Watermarking workshop devotes a dedicated section to AI-generated music, noting that it "presents unique challenges for watermarking due to the complex interplay of melody, harmony, rhythm, and instrumentation."
The survey splits the field in two.
Symbolic-level watermarking operates on structured representations such as MIDI, encoding information in note sequences, chord voicings or timing variations. It is robust within digital compositions and, in the survey's words, "ineffective for AI-generated music distributed as audio recordings." For anyone exporting finished tracks, this branch is irrelevant.
Audio-level watermarking embeds directly into the waveform "leveraging spectral, phase, or amplitude modulation techniques." Two details from this branch matter in practice:
- Frequency-domain embedding targets low-energy spectral bands, chosen precisely because those bands "remain resilient to common post-processing transformations."
- Phase-based approaches introduce "imperceptible phase shifts across harmonic frequencies," maintaining fidelity while remaining detectable.
Those two sentences describe the layer at which this material lives: the spectral distribution and the phase relationships of the audio. Not the melody, not the arrangement, not the loudness.
The survey places SynthID in a third category, deep-learning-driven watermarking, "integrating watermarking into the latent space of music generation models to ensure persistent traceability."
The honest limits
Vendor pages describe robustness. Peer review describes trade-offs, and the trade-offs are where the useful information is.
The same survey is direct about it: deep-learning watermarking approaches, "while offering enhanced robustness, are not impervious to sophisticated adversarial strategies," and it notes that certain techniques "can effectively erase embedded watermarks without significantly degrading content quality."
It also identifies the constraint that shapes the entire field. Robustness across a wide range of threat models is difficult because pushing it up either costs output quality or requires a more conspicuous watermark. Every scheme sits somewhere on that curve.
Read together, the practical position is this. Blunt manipulations are ineffective, and the vendor has said so plainly. Targeted processing at the spectral and phase layer is a genuine engineering problem with a difficulty level attached, not a sealed door. Anyone claiming either extreme — that watermarks are trivially stripped, or that they are permanent and absolute — is overstating what is actually known.
Where Suno actually sits
Suno confirmed on 6 August 2026 that it would begin embedding audio watermarking and fingerprinting in generated tracks, with rollout over the following weeks.
It has not said which technology.
Coverage of the announcement noted the company had not confirmed whether it would adopt an existing system such as SynthID or build its own, and no detection standard has been named since. Our explainer on the announcement sets out what was and was not stated.
SynthID is the most cited candidate for three defensible reasons: it is the only audio scheme deployed at scale with public documentation, it has been extended beyond Google to other vendors as a cross-vendor reference, and it is the system every technical write-up of the announcement reached for by way of comparison. None of that is confirmation.
The reason to understand SynthID anyway is that it establishes what a competently built audio watermark does. Whatever Suno ships, it will be operating on the same layer and facing the same trade-off curve.
Why the SynthID Detector will not answer your question
Google runs a SynthID Detector portal and Gemini can be asked directly whether a file carries a SynthID watermark. Producers find this and reasonably assume it settles the matter.
It does not, for a simple reason: the detector reads watermarks made by Google's models. It has no visibility into a marker embedded by a different company using a different scheme.
So a Suno track run through the SynthID Detector returns "no Google watermark found", which is true and almost entirely uninformative. It is not evidence that the track is unmarked. Treating it as a clean bill of health before a release is a genuinely expensive misreading.
This is the same structural problem behind a more familiar complaint — free checkers clearing a track that a distributor then rejects. The tools are not lying; they are answering a narrower question than the one being asked. How distributors detect AI music covers what the screening side actually reads.
Watermark, fingerprint, and metadata
Three distinct things get collapsed into one word, and the distinction decides what can be done about each.
A watermark is deliberately embedded at generation. The platform puts it there, and it is designed to survive handling.
A fingerprint is derived after the fact by measuring characteristics the audio already has — spectral statistics, phase behaviour, timing regularity, noise floor structure. Nothing is added to the file. Generated audio carries these whether or not anyone watermarked it, which is why untouched pre-rollout exports are still identifiable.
Provenance metadata such as C2PA is written into the file header. It is the most fragile of the three and the easiest to strip, which is also why it is the least relied upon by screening pipelines.
Suno announced watermarking and fingerprinting together, which is part of why they get conflated. They fail differently, they are addressed differently, and the fingerprint-versus-watermark distinction is worth having straight before deciding what to do about either.
What this means in practice
The layer determines the tooling. That is the whole conclusion, and everything above is the evidence for it.
Audio watermarks live in the spectral distribution and phase relationships of a file, placed deliberately where hearing is weakest. It follows that anything operating on perceptible qualities — EQ, compression, loudness, repair suites, re-encoding — is working on the wrong layer by construction. This is not a failure of those tools. They are excellent at what they do, and what they do is not this.
Processing that addresses this material has to operate where it lives: spectral characteristics, phase behaviour, micro-timing, embedded markers and the noise floor. Undetectr is built for that layer specifically, running a five-stage pipeline across exactly those properties and leaving the compositional layer — melody, harmony, arrangement, vocal performance — untouched.
That last point cuts both ways and is worth stating plainly. Because compositional characteristics are fixed at generation and no audio processor rewrites them, signal-layer processing will not change the verdict of a composition-based checker such as SubmitHub or IRCAM Amplify. Those read melody and vocal timbre. Different layer, different question, different answer.
The short version
SynthID converts audio to a spectrogram, embeds a marker where psychoacoustic masking hides it, and reconstructs the waveform. Google says it survives noise, MP3 compression and speed changes, and there is no reason to doubt that — it is a design target, not a boast.
Suno has not confirmed what it is using, and SynthID being the obvious candidate is not the same as it being the answer.
Google's detector cannot tell you anything useful about a Suno file, because it only reads Google's own watermarks.
And the research literature, which has less incentive to overstate in either direction, describes these schemes as robust but not impervious, with removal quality being the real constraint rather than possibility.
For a producer, all of that reduces to one operational fact: this material lives at the signal layer, so only signal-layer processing has anything to act on. Disclose AI involvement wherever a platform asks regardless — processing a file and declaring how it was made are separate obligations, and the first has never substituted for the second.
Questions readers ask.
SynthID is Google DeepMind's watermarking system for AI-generated content across text, images, video and audio. The audio version embeds an inaudible marker directly into generated sound so that the file can later be identified as machine-produced. Google deployed it first through Lyria, its music generation model, and through the podcast feature in NotebookLM. It is the most widely documented audio watermarking scheme in production, which is why it has become the reference point for the whole category.
The waveform is converted into a spectrogram — a two-dimensional representation of how frequencies evolve over time — the watermark is embedded into that representation, and the spectrogram is then converted back into a waveform. The embedding exploits psychoacoustic masking, the property that louder sounds conceal quieter ones and some frequency regions are less perceptible than others. The result is woven into the structure of the sound rather than layered on top of it.
Google states the audio watermark resists added noise, MP3 compression and speed changes, so the obvious manipulations do not work. Academic work is more nuanced: a 2025 survey presented at an ICLR workshop concludes that deep-learning watermarking is robust but not impervious to adversarial strategies, and notes that some approaches can erase embedded watermarks without significantly degrading content quality. The honest position is that this is an engineering problem with a difficulty level, not a sealed door.
Suno has not said. When the company announced watermarking and fingerprinting on 6 August 2026, coverage noted it had not confirmed whether it would adopt an existing system such as SynthID or build its own, and no detection standard has been named since. SynthID is the most cited candidate because it is the reference implementation for audio, but treating that as confirmed is speculation rather than reporting.
No. Google's SynthID Detector reads watermarks produced by Google's own models. It has no visibility into a marker embedded by a different company using a different scheme, so a negative result on a Suno track means the detector found no Google watermark — not that the track carries no watermark at all. This is a common and expensive misreading.
They examine different things. Public checkers mostly analyse compositional characteristics — melodic shape, harmonic movement, vocal style — and return a probability. Distributor pipelines can read signal-layer material embedded in the file itself. A track can look human to a compositional classifier and still be identified at the signal layer, which is why the two verdicts routinely diverge.
Not for a scheme designed properly. Google states explicitly that the SynthID audio watermark cannot be altered by MP3 compression. The research literature agrees on the principle: frequency-domain watermarking that places signals in low-energy spectral bands is specifically chosen because it survives ordinary post-processing. Re-encoding a file is one of the least effective things you can do about a watermark.
No. A watermark is deliberately embedded at generation — the platform puts it there. A fingerprint is derived after the fact by measuring characteristics the audio already has, with nothing added to the file. Suno announced both together in August 2026, which is part of why the two get conflated. They fail differently and they are addressed differently.
The verdict, in one sentence: Undetectr.
Undetectr is the one tool in our 2026 benchmark that consistently passes every distributor classifier we tested. 98% pass rate. $39 one-time, before the announced increase to $99.