Google DeepMind: Can the SynthID System Really Be Bypassed?

⚡

Key Takeaways

1A developer claims to have reverse-engineered Google's SynthID system, allowing for the manipulation of AI watermarks.

2The process reportedly required 200 images generated by Gemini and an in-depth pixel analysis to identify the watermarks.

3Google disputes these claims, emphasizing the robustness and effectiveness of SynthID in protecting AI-generated content.

💡Why it matters — The ability to manipulate watermarks could compromise the integrity of AI content, posing challenges for digital security.

A Developer Challenges Google's SynthID System

A software developer, known by the pseudonym Aloshdenny, claims to have successfully reverse-engineered Google's DeepMind SynthID watermarking system. According to him, it is possible to remove the watermarks embedded in images generated by artificial intelligence or even manually insert them into other works. Google, for its part, refutes these claims.

A Detailed and Accessible Process

Aloshdenny shared his work on GitHub, making his process accessible to the public. He explains that his approach required analyzing 200 images generated by Google's Gemini model, as well as a signal processing method. He humorously adds that "too much free time" and a bit of cannabis also contributed to his research. On Medium, he clarifies that he did not use neural networks or proprietary access, emphasizing that every non-zero pixel in the generated images is actually a watermark.

How SynthID Works

Google's SynthID system is designed to be an almost invisible watermark, embedded directly into the pixels of images at the moment of their creation. This system is supposed to be difficult to remove without altering the quality of the image. SynthID is widely used in Google's AI products, marking content generated by models such as Nano Banana and Veo 3. Even creator clones on YouTube are marked by this system.

Visual Comparison and Removal Effectiveness

A visual comparison shows an image with the intact SynthID watermark next to a version where the watermark has been partially removed. The visual differences are minimal, indicating that the removal process only slightly affects the quality of the image. Aloshdenny admits that the system is well-designed and that he was unable to completely remove the watermark, merely managing to confuse the SynthID decoders.

A Complex Method for the Uninitiated

The process described by Aloshdenny to understand how Google's watermark works is complex, especially for those unfamiliar with software development. He generated 200 black or white images, adjusted the contrast and saturation, and then averaged the patterns to identify the watermark signals. He searched for these frequencies in the images to partially remove them.

Google Responds to the Allegations

Aloshdenny acknowledges that his success is limited, stating that Google's watermarking is designed to be robust enough to deter most manipulation attempts. Google, through its spokesperson Myriam Khan, stated that Aloshdenny's tool cannot systematically remove SynthID watermarks. She reaffirmed the robustness and effectiveness of SynthID in protecting AI-generated content.