Has Google’s AI watermarking system been reverse-engineered? | The Verge
Overview
Tech Expand Amazon Apple Facebook Google Microsoft Samsung Business See all tech
Reviews Expand Smart Home Reviews Phone Reviews Tablet Reviews Headphone Reviews See all reviews
Details
Science Expand Space Energy Environment Health See all science
Entertainment Expand TV Shows Movies Audio See all entertainment
Policy Expand Antitrust Politics Law Security See all policy
Gadgets Expand Laptops Phones TVs Headphones Speakers Wearables See all gadgets
Verge Shopping Expand Buying Guides Deals Gift Guides See all shopping
Streaming Expand Disney HBONetflix You Tube Creators See all streaming
Transportation Expand Electric Cars Autonomous Cars Ride-sharing Scooters See all transportation
AIClose AIPosts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All AI
Posts from this topic will be added to your daily email digest and your homepage feed.
News Close News Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All News
Posts from this topic will be added to your daily email digest and your homepage feed.
Tech Close Tech Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Tech
Posts from this topic will be added to your daily email digest and your homepage feed.
Has Google’s AI watermarking system been reverse-engineered?
Posts from this author will be added to your daily email digest and your homepage feed.
Posts from this author will be added to your daily email digest and your homepage feed.
A software developer claims to have reverse-engineered Google Deep Mind’s Synth ID system, showing how AI watermarks can be stripped from generated images or manually inserted into other works. A claim that, according to Google, isn’t true.
The developer, going by the username Aloshdenny, has open-sourced their work on Git Hub and documented his process, claiming all it required was 200 Gemini-generated images, signal processing, and “way too much free time.” A little weed also seemed to help.
“No neural networks. No proprietary access,” Aloshdenny said on Medium. “Turns out if you’re unemployed and average enough ‘pure black’ AI-generated images, every nonzero pixel is literally just the watermark staring back at you.”
Synth ID is a near-invisible watermarking system that tags content generated by Google’s AI tools, embedding itself in the pixels of images at the point of creation. It was designed to be difficult to remove without degrading the image quality, and is used widely across the AI products offered by Google — everything spat out by models like Nano Banana and Veo 3 carries Synth ID watermarks, and it’s even being applied to You Tube’s AI-generated creator clones.
Here’s a comparison between an image with Synth ID still attached (left) and how it appears after the Synth ID has been partially removed enough to fool detectors (right). There are only slight visual differences, showing minimal degradation from the removal process.
Aloshdenny says he found the system to be “genuinely good engineering,” and was still unable to remove Synth ID entirely in tests, instead relying on confusing Synth ID decoders that try to read watermarked images.
The process used to crack the underlying mechanics of Google’s watermark is technically complex for non-developers. You can read the full breakdown on Aloshdenny’s Medium page (which was apparently written up while Aloshdenny was “high”) if you’re curious, but here’s a simplified explainer:
Generate 200 entirely black or pure white images using Gemini. Enhance the contrast and saturation, and then denoise the saturation to expose the watermark patterns.
Average the patterns together to find the magnitude and phase of the watermark signal at every frequency bin, per channel.
Hunt for signs of these frequencies in images and partially remove them at the same angle at which they were inserted during generation.
That colorful pattern you’re seeing in the black image on the bottom right? That’s Synth ID.
“The fact that the best I could pull off was confuse the decoder enough that it gives up — not actually delete the thing — says a lot about how well it was designed,” says Aloshdenny. “It’s not perfect. But it’s not trying to be unbreakable. It’s trying to raise the cost of misuse high enough that most people don’t bother.”
I haven’t tried Aloshdenny’s project that reverse-engineers Google’s Synth ID watermarking system, so I can’t vouch for how effective it actually is. That said, at this point in time, it doesn’t appear that Synth ID has been reverse-engineered, at least not to the point where script-kiddies can download a tool and remove (or add) Google’s watermark to trick AI detection systems. Google also doesn’t believe it stands up to Aloshdenny’s claims.
“It is incorrect to say this tool can systematically remove Synth ID watermarks,” Google spokesperson Myriam Khan told The Verge. “Synth ID is a robust, effective watermarking tool for AI-generated content.”
Jess Weatherbed Close Jess Weatherbed News Reporter Posts from this author will be added to your daily email digest and your homepage feed. Follow Follow See All by Jess Weatherbed
Posts from this author will be added to your daily email digest and your homepage feed.
AIClose AIPosts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All AI
Posts from this topic will be added to your daily email digest and your homepage feed.
Google Close Google Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Google
Posts from this topic will be added to your daily email digest and your homepage feed.
News Close News Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All News
Posts from this topic will be added to your daily email digest and your homepage feed.
Tech Close Tech Posts from this topic will be added to your daily email digest and your homepage feed. Follow Follow See All Tech
Posts from this topic will be added to your daily email digest and your homepage feed.
Xbox Game Pass ‘has become too expensive,’ says Microsoft’s new gaming chief in leaked memo
Mark Zuckerberg is reportedly building an AI clone to replace him in meetings
Read Open AI’s latest internal memo about beating the competition — including Anthropic
Justin Bieber’s You Tube Coachella set had nothing to do with who owns his music
Key Takeaways
- Tech Expand Amazon Apple Facebook Google Microsoft Samsung Business See all tech
- Reviews Expand Smart Home Reviews Phone Reviews Tablet Reviews Headphone Reviews See all reviews
- Science Expand Space Energy Environment Health See all science
- Entertainment Expand TV Shows Movies Audio See all entertainment
- Policy Expand Antitrust Politics Law Security See all policy
