Provenance watermark reportedly cracked

AI watermarking works like a hidden pattern woven into pixels so a detector can spot machine-made images later. Google says its SynthID system for Gemini images can survive cropping, filters, and compression. (deepmind.google) That system is now under challenge from a GitHub project published this week by a developer using the name Aloshdenny. The repository says it reverse-engineered SynthID from Gemini images without access to Google’s internal encoder or detector. (github.com) The project says it found SynthID’s “carrier frequency” structure, built a detector with 90 percent accuracy, and made a bypass that cut carrier energy by 75 percent and phase coherence by 91 percent while keeping image quality above 43 decibels peak signal-to-noise ratio. (github.com) Google DeepMind describes SynthID as an invisible watermark added at creation time and says it is meant to help people identify content generated or altered by Google artificial intelligence tools. Google also says users can check images, video, and audio in Gemini for a SynthID mark. (deepmind.google, support.google.com) The dispute lands after Google expanded SynthID from images into audio, video, and text, and after the company opened a SynthID Detector portal to journalists and other testers. In an October 10, 2025 paper, Google researchers said SynthID-Image had already been used on more than 10 billion images and video frames across Google services. (deepmind.google, arxiv.org) Google is pushing a provenance system, which means a way to trace where media came from, at the same time that platforms are being flooded with artificial intelligence images. Its own help page says a missing SynthID result does not prove a file is human-made, because it could come from another artificial intelligence system or from content with too little detail to watermark reliably. (support.google.com) The Verge reported Tuesday that Google disputes the new claim and said the tool does not “systematically remove” SynthID watermarks. The same report said the developer also claimed the method could be used to insert a detectable pattern into other images, not just weaken one already there. (theverge.com) Google’s own paper did not promise a perfect lock. The authors framed SynthID-Image as a large-scale deployment with tradeoffs among effectiveness, visual fidelity, robustness, and security, and said the work was shaped by threat models and practical limits. (arxiv.org) That leaves the core issue unchanged: provenance marks can help verify some Google-made media, but they still depend on detectors, attack resistance, and broad adoption across tools. The new challenge puts those limits in public view just as Google is asking journalists and users to rely on SynthID checks. (deepmind.google, support.google.com, theverge.com)