A developer using the handle Aloshdenny has published code that they say reverse-engineers aspects of Google DeepMind’s SynthID image watermarking system and interferes with detection. Google disputes that the tool can systematically remove its watermarks.
“It is incorrect to say this tool can systematically remove SynthID watermarks,” Google spokesperson Myriam Khan said. “SynthID is a robust, effective watermarking tool for AI-generated content.”
Aloshdenny acknowledged that their approach did not completely erase the watermark in their tests. The developer described altering the embedded signal enough to confuse the decoder that checks for it, rather than fully deleting the mark.
The developer’s claimed method
Aloshdenny described estimating the watermark’s pattern from 200 plain black or white images generated with Gemini. The developer said the approach used signal processing, without neural networks or proprietary access.
The method, as Aloshdenny described it, identifies recurring patterns in the images’ frequency data and attempts to partially subtract corresponding signals from other images. The developer says this can interfere with detection. That account does not independently establish that the tool reliably defeats Google’s deployed detector.
SynthID’s capabilities and limitations
Google introduced SynthID in 2023 to embed an imperceptible digital watermark directly into AI-generated image pixels. The company subsequently expanded SynthID to text, audio and video, introduced a detector portal for early testers, and added image verification to the Gemini app. Google says the Gemini feature checks for SynthID to help identify images generated or edited with its AI tools.
Google says its image watermarks are designed to remain detectable after changes such as filtering, colour adjustments and JPEG compression. Its original announcement also acknowledged that SynthID was not foolproof against extreme image manipulation.
Research on other watermarking systems provides context for the dispute. The paper Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks reports attacks that removed watermarks from images and caused unwatermarked images to be classified as watermarked in its evaluations.
A separate paper, Invisible Image Watermarks Are Provably Removable Using Generative AI, reports reduced detection rates across four pixel-level watermarking schemes after images were altered with noise and reconstructed. These findings concern the methods evaluated in those studies; they do not independently validate Aloshdenny’s claims about SynthID.
Google also supports C2PA content credentials, which carry provenance information in metadata. Its original SynthID announcement described embedded watermarking as compatible with metadata-based identification, while noting that metadata can be removed or lost when files are edited.
