Watermark removal cracks at 90%

Digital watermarks are hidden patterns inside pixels, sound waves, or word choices that let a detector flag media as machine-made later. Google’s SynthID was built for that job, and a new public reverse-engineering project says it can now detect and strip the image version with roughly 90% success. (deepmind.google; github.com) Google says SynthID embeds an imperceptible watermark into images, video, audio, and text generated by its systems, and says the image system has already been applied to more than 10 billion images and video frames across its services. Google also says the watermark is designed to survive edits such as cropping, filters, frame-rate changes, and lossy compression. (deepmind.google; arxiv.org; deepmind.google) The reverse-SynthID project, published on GitHub and surfaced in posts this week, says it inferred the watermark’s frequency pattern without access to Google’s private encoder or decoder. The repository says its detector identifies SynthID watermarks with 90% accuracy and that its “V3” bypass cuts carrier energy by 75% and phase coherence by 91% while keeping image quality above 43 decibels peak signal-to-noise ratio. (github.com) The basic idea is closer to finding a faint radio station than reading visible text on an image. The researchers say the watermark leaves a repeatable pattern in frequency space, and their codebook matches that pattern by image resolution before removing selected frequency bins. (github.com; deepmind.google) That hits a system Google has presented as provenance technology rather than a general artificial-intelligence detector. In its 2025 paper, Google DeepMind wrote that provenance means tying media back to a generating system, and said that goal differs from broad attempts to guess whether any image was made by artificial intelligence. (arxiv.org) Google has also long cautioned that SynthID is not foolproof. In its August 2023 launch post, the company said the image watermark was not robust to “extreme image manipulations,” and in its May 2024 post on text and video it said SynthID was “not a silver bullet” for identifying artificial-intelligence content. (deepmind.google; deepmind.google) That caveat has trailed watermarking research for years. A 2023 paper titled “Warfare: Breaking the Watermark Protection of AI-Generated Content” reported about 90% bit accuracy for watermark removal under its test setup, and a 2025 paper on watermarking standards said practical schemes often fall short of ideal robustness. (arxiv.org; arxiv.org) The current public claim is narrow: it targets Google’s image watermark, not every watermarking system or every media type. Google’s current SynthID pages still describe separate systems for images and video, audio, and text, with text watermarking based on nudging token probabilities during generation rather than altering pixels after the fact. (deepmind.google; deepmind.google) Google is still expanding the verification side as well. Its SynthID Detector portal is in testing with journalists and media professionals, and Gemini support pages say a missing watermark does not prove a file was not made with artificial intelligence because it may have come from another system or lost the signal during editing. (deepmind.google; support.google.com) So the immediate takeaway is less that watermarking has ended than that the cat-and-mouse phase is now public. A watermark sold as invisible and durable is being treated like any other security feature: something researchers can probe, measure, and try to break. (arxiv.org; github.com)