Google’s SynthID AI Watermarking Tech Claimed to Be Reverse-Engineered

In the world of artificial intelligence (AI) detection, Google's SynthID stands out. First previewed in 2023, it is a watermarking technology that adds an invisible and imperceptible layer of watermark into the content, including text, images, videos, and audio. The Mountain View-based tech giant claims that SynthID cannot be removed, but a developer is now claiming that he was not only able to reverse engineer the watermarking tech, but also distort it to the level that it confuses systems detecting AI content.

Can Google's SynthID Be Removed?

The short answer is no. At least not entirely. But if the claims of developer Aloshdenny are to be believed, the watermarking technology is not the impenetrable wall Google claims it to be. The interesting thing to note here is that the entire process did not involve breaking into Google's watermarking models or manipulating encoders or decoders.

In a Medium post, the developer explained that he was able to detect the pattern of SynthID using 100 plain white and 100 plain black images generated by the tech giant's Nano Banana model. Alongside, he also used 1,23,268 pairs of original and AI-edited images via the same model.

The developer then enhanced the contrast of the black and white images, followed by increasing the saturation and denoising them. The idea behind it was that on a pure black Nano Banana image, every non-zero pixel value should represent the watermark. However, just observing it is not enough since Google's encoders use a randomness factor, meaning every image has a potentially unique positioning of the SynthID.

Once reverse engineering was complete, the developer then attempted to remove the watermark. However, he found that to be incredibly tricky and acknowledged that Google's implementation was solid enough that removing the pattern without distorting the image was not possible. However, he devises a technique to confuse the decoder enough so that it cannot determine with confidence if an image has the watermark or not.

Aloshdenny has made his work publicly available on GitHub so that others can review the process and verify the same. A Google spokesperson told The Verge that the claims that SynthID is removable are not true, and the technology remains an effective way to label and detect content generated using Gemini and other Google AI models.