How Google’s SynthID Watermark Works — and How Researchers Detected and Removed It

# How Google’s SynthID Watermark Works — and How Researchers Detected and Removed It

Yes—SynthID can be detected and, in many cases, practically weakened or removed. Independent researchers report ~90% detection accuracy with open, FFT-based methods and a “surgical” frequency-domain bypass that reduced measured phase coherence by ~91.4% while keeping images visually close to the original (an example result cites ~43.5 dB PSNR). The key enablers are (1) repeatable carrier patterns in the frequency domain and (2) what researchers describe as a fixed, model-level phase template, which makes the watermark easier to recognize—and therefore target—once its structure is inferred.

What SynthID Is—and How It’s Supposed to Work

SynthID is Google/DeepMind’s system for embedding an imperceptible watermark into images generated by Gemini-family models. Google positions it as a transparency and provenance tool: the mark is designed to be invisible to users, robust to benign image processing, and detectable by an authorized decoder later for identification and attribution.

Publicly, Google describes SynthID’s approach at a high level: information is embedded into image frequency components, chosen so the watermark can survive typical transformations while remaining hard to notice. That frequency-domain framing matters, because it gives outside analysts a place to look: if a watermark consistently alters certain spectral regions, it may leave a detectable signature even without access to Google’s encoder or decoder. (For more on adjacent provenance and analysis themes, see our background topic hub on reverse engineering / synthid / gemini.)

How Researchers Reverse-Engineered the Watermark

Several public projects—most notably repositories by aloshdenny and nxpatterns—applied standard signal-processing techniques to Gemini-generated images without Google’s proprietary tools. Their work followed a straightforward but labor-intensive playbook:

• Convert images into the frequency domain using FFTs and compare spectra across many samples.
• Measure phase behavior (not just magnitude/energy) and compare phase relationships across images and channels.
• Use cross-image comparisons to find features that are stable and repeatable (more likely to be watermark structure than “normal” generative artifacts).
• Run controlled tests, including black/white generation experiments, to help distinguish true embedded carriers from incidental patterns.

That combination—lots of samples plus consistent spectral/phase features—allowed researchers to infer a watermark “shape” they could then use to build open detectors and attempt removals.

Key Technical Findings: Carriers, Phase, and Channels

The reverse-engineering efforts converged on a few technical observations that define why SynthID is both detectable and targetable.

1) Resolution-dependent carrier placement (absolute indices).

Researchers report that SynthID’s carrier components appear at absolute frequency positions tied to image dimensions, not at scale-invariant locations. Reported examples include:

• For 1024×1024 images, carriers at relatively low-frequency coordinates (e.g., around (9, 9)).
• For 1536×2816 images, carriers moving to much higher-frequency coordinates (e.g., around (768, 704)).

Implication: a detector or removal profile tuned to one resolution may fail on another unless it uses a resolution-aware codebook or a resizing/auto-selection strategy.

2) A fixed, model-level phase template (high coherence).

Across images from the same Gemini model, researchers reported >99.5% cross-image phase coherence, consistent with a stable phase template rather than a per-image randomized pattern. In plain terms: the watermark looks less like a unique stamp per image and more like a consistent “fingerprint” baked into the model’s outputs—helpful for attribution, but also helpful for reverse-engineering because repeated structure is easier to learn.

3) Channel strength asymmetry (green stands out).

In analyzed samples, the green channel carried the strongest detectable watermark signal. That finding influences both detection (where to focus features) and bypass attempts (which channel changes are most “cost-effective” for reducing detectability without visibly harming the image).

How Detection and Removal Were Achieved

Detection.

Open detectors described in the reverse-engineering reports use FFT-based spectral feature extraction coupled with phase-coherence checks aligned to the inferred template and carrier locations. One project reports ~90% detection accuracy—not perfect, but strong enough to demonstrate that an “authorized-only” watermark can still be recognized using public techniques once its structure is known.

Removal/bypass.

Early bypass attempts used common, blunt tools like JPEG compression or filtering. More recent approaches are more precise: instead of degrading the whole image, they attempt FFT-domain surgery, selectively reducing or subtracting energy at the inferred carrier positions while preserving overall fidelity.

One reported “V3” bypass adds practical engineering to handle SynthID’s resolution dependence, using a multi-resolution approach that can auto-select matching profiles or fall back to resizing logic. Reported metrics from that line of work include:

• ~91.4% reduction in measured phase coherence,
• ~75% reduction in carrier energy,
• and an example of ~43.5 dB PSNR, indicating high similarity to the original image.

These numbers don’t prove universal removal across all scenarios—but they do show that, at least for the studied configurations, targeted frequency-domain operations can significantly reduce detectability while keeping images looking largely unchanged.

Trade-offs and Limits of the Attacks

The same design traits that make SynthID robust in everyday handling also shape the attacker’s constraints:

• Resolution matters. Because carriers map to absolute indices, attackers need to know (or infer) image dimensions and use a matching codebook—or rely on resizing-based workarounds that may not always behave consistently.
• Profiles may not generalize. Public reverse-engineered profiles may not match every model variant or future SynthID implementation detail. If the embedding scheme changes, the learned carrier map and phase template could drift.
• Surgical edits aren’t “free.” FFT-domain subtraction can still introduce subtle artifacts, and outcomes can vary by image content and post-processing. Defenders can also change carrier placements, channel weighting, or other embedding characteristics to raise the cost of clean removal.

Why It Matters Now

This work became widely visible in April 2026, and it shifts how provenance debates should be framed. The big takeaway isn’t merely that a watermark can be removed—it’s that open-source signal analysis can neutralize an invisible provenance layer once its structure is learned. With public repositories and write-ups circulating, the threat model changes: watermarking alone looks less like a lock and more like a speed bump, especially when the watermark appears to be model-level and repeatable.

That has immediate implications for platforms and policy. If moderation or attribution workflows treat SynthID-style marks as a decisive indicator, public bypass methods can undermine confidence. The more realistic approach is layered: watermark signals can be useful, but they may need to sit alongside other provenance mechanisms and operational checks rather than serving as a single point of truth.

What to Watch

• Whether Google/DeepMind alters SynthID toward per-image randomness or other changes that increase the cost of reverse-engineering.
• New open-source tools that broaden detection/removal across more resolutions and model variants, and countermeasures that harden watermarks against FFT-domain surgery.
• How platforms and policymakers adjust provenance expectations—particularly whether they continue to treat a single invisible watermark as sufficient, or push toward multi-signal verification.

Sources: github.com, github.com, simplenews.ai, aitoolly.com, deepmind.google, deepwiki.com