Google's SynthID watermark survives edits, but won't stop AI fakes

Google announced at its I/O conference this spring that its AI tools had generated more than 100 billion images and videos in just a couple of years, and the company coupled this announcement with a major expansion of its SynthID watermarking technology through partnerships with OpenAI, Runway, Nvidia, and others. SynthID encodes invisible watermarks into the pixels of images, videos, or audio clips, making them permanently part of the content in a way that survives common forms of degradation—compression, resizing, and edits—unlike metadata-based approaches such as the Coalition for Content Provenance and Authenticity (C2PA) standard, which can be stripped away by simply editing and saving an image or taking a screenshot.

To test SynthID's claimed durability, the article's author used a Python script to simulate data loss from repeated sharing and downloading by applying random compression and resizing transformations hundreds of times. Starting with two test images—one entirely AI-generated and one an original photo edited by AI, both created with Nano Banana Pro and carrying the SynthID watermark—the author ran them through this "image-crushing machine" 300 times, reducing them to barely recognizable blobs. Every 50 generations, the author also created cropped versions without reencoding to further weaken potential detection. After 300 generations, the SynthID watermark remained detectable on the full-frame images and even survived screenshots, as Google DeepMind scientist Pushmeet Kohli had promised: the team "put a great deal of work into ensuring SynthID was a durable way to label AI content" by testing it "against different kinds of transformations. Whether people are adding some sort of filter or cropping the image, we used these transformations and made sure that the detector was robust against them."

However, the testing also revealed SynthID's limits. After 300 compression iterations, removing a 20 percent crop from the border of the images broke SynthID detection on both the fully AI-generated and edited versions. A larger 50 percent crop could break it earlier, at around 250 iterations. While the watermark proved more robust than Meta's Content Seal—which Reuters found could often be eliminated by simple cropping—Google itself does not claim invulnerability. The original paper on SynthID notes that the watermark "is not intended to withstand adversarial attacks," and although some have claimed to have hacked it, Google's Kohli says the team has been unable to replicate the supposed workarounds.

Beyond technical vulnerabilities, the article identifies systemic limitations that watermarks cannot overcome. Access to SynthID verification is intentionally restricted: there is no public API or standalone detector webpage; users must ask Gemini to verify, and Google limits checks to approximately 10 per day to prevent brute-force attacks and tuning of bypass workflows. More fundamentally, watermarking is fragmented across providers: Google's detector does not recognize OpenAI's watermark, and OpenAI's detector does not recognize Google's, meaning an image might fail verification simply because it was generated by a different system. A Google spokesperson acknowledged the experience is "suboptimal" and expressed vague intentions to "improve" it, saying the company is "actively collaborating with industry partners to make verification more accessible and unified," but offered no timeline or concrete plan.

The deepest problem, however, lies beyond any technical fix. Adam Rose, a fellow and senior advisor at Starling Lab, emphasized that "the bigger problem here is not just the images that are being produced by the Googles and the OpenAIs of the world. The problem is people who can run their own models, who can do things on their own computers." Open-source AI models that generate images with no labeling whatsoever can be shared and improved indefinitely, and it is unlikely that all AI companies will agree to watermarking or metadata standards. As a result, unlabeled AI content will always exist, and watermarks cannot catch what they never encounter. Veteran photojournalist and Starling Lab fellow Mike Caronna explained the asymmetry: "There's a limit to how much content can be created with actual physical cameras in the world. There's no limit to how much synthetic content can be made." This suggests a strategic pivot: rather than trying to catch all fakes, focus on authenticating scarce, truthful content—a practice called proving "the liar's dividend," in which high-value, verified authentic information becomes the reliable standard against which falsehoods are measured.

Google's SynthID watermark represents a significant technical achievement in embedding permanent labels into AI-generated images, yet the article reveals a fundamental mismatch between what watermarks can do and what the misinformation problem actually requires. The scale of AI content creation is staggering: Starling Lab estimates it took 149 years for humanity to create 1.5 billion photographs, but generative AI accomplished the same volume in just 18 months. Google alone has produced more than 100 billion AI images and videos in a couple of years. Against this exponential growth, watermarks are a defensive measure designed to label content at the point of generation by major AI providers—a group that now includes OpenAI, Runway, and Nvidia using SynthID's underlying technology.

However, the article makes clear through both technical testing and expert commentary that watermarks address only a fraction of the problem. Testing shows SynthID's robustness has real limits: while it survives heavy compression and multiple edits, a 20 percent crop is enough to strip it away. More critically, Google does not claim invulnerability and notes the watermark is not meant to withstand adversarial attacks, meaning motivated actors may eventually find ways to bypass it. The real structural problem, as Adam Rose of Starling Lab explains, is that "people who can run their own models" can generate unlabeled AI content entirely outside any corporate labeling system. Open-source models can be shared and improved indefinitely with no watermark, making it impossible for watermarks alone to label all AI content.

A secondary usability problem compounds the issue: different companies' watermarks are incompatible, so a user checking whether an image is AI-generated must know which system created it—or run it through multiple detectors and still find nothing. Google limits SynthID checks to about 10 per day to prevent abuse, and access is intentionally restricted to prevent easy attack vectors. The article suggests that as watermarks become more common, people may paradoxically assume that unwatermarked content is authentic, a "dangerous but understandable mistake." Experts argue the focus should shift from trying to catch all fakes to authenticating the scarce, truthful content that actually matters.

No comments yet. Be the first to share your thoughts!