Google AI Watermarking System Reverse-Engineered
▼ Summary
– A developer named Aloshdenny claims to have reverse-engineered Google’s SynthID, an AI image watermarking system, and open-sourced the method.
– The process involved analyzing 200 AI-generated images to isolate the watermark signal, which can then be partially removed or inserted into other works.
– SynthID is a near-invisible watermark embedded by Google’s AI tools, designed to be difficult to remove without damaging the image.
– Google disputes the claim, stating the tool cannot systematically remove SynthID watermarks and that the system remains robust.
– The developer acknowledged the watermark’s strong design, noting the method only confuses decoders rather than fully deleting the mark.
A software developer has publicly detailed a method to analyze and partially defeat Google DeepMind’s SynthID watermarking system. The developer, using the pseudonym Aloshdenny, published code and a technical explanation asserting that the process required only a collection of AI-generated images and basic signal processing. Google, however, disputes the core claim that this constitutes a systematic removal tool.
SynthID is a near-invisible digital watermark embedded directly into the pixels of images created by Google’s AI models, including Imagen and Veo. Designed to be robust, the watermark aims to persist through edits and cropping, providing a technical method for identifying AI-generated content. Aloshdenny’s approach involved generating 200 uniformly black images using Gemini, then applying contrast enhancement and denoising to isolate a repeating pattern believed to be the watermark signal. By averaging these patterns, the developer claims to have identified the specific frequencies and phases used for embedding.
The result is not a perfect removal. Aloshdenny states the technique can only confuse SynthID decoders by partially degrading the watermark signal, not erase it entirely. This partial removal can be enough to make a watermarked image appear clean to a detection system. “The fact that the best I could pull off was confuse the decoder enough that it gives up, not actually delete the thing, says a lot about how well it was designed,” Aloshdenny wrote. The developer characterized SynthID as “genuinely good engineering” meant to raise the cost of misuse, not to be an unbreakable seal.
Google has directly challenged the assertion that this method invalidates SynthID’s purpose. A company spokesperson stated, “It is incorrect to say this tool can systematically remove SynthID watermarks. SynthID is a robust, effective watermarking tool for AI-generated content.” The technical barrier to executing Aloshdenny’s process also remains high, preventing it from becoming a simple, one-click tool for widespread use. For now, this incident highlights the ongoing technical arms race between watermarking and removal techniques in the AI ecosystem.
(Source: The Verge)
