Google's SynthID watermark survives edits, but won't stop AI fakes

Google's SynthID watermark represents a significant technical achievement in embedding permanent labels into AI-generated images, yet the article reveals a fundamental mismatch between what watermarks can do and what the misinformation problem actually requires. The scale of AI content creation is staggering: Starling Lab estimates it took 149 years for humanity to create 1.5 billion photographs, but generative AI accomplished the same volume in just 18 months. Google alone has produced more than 100 billion AI images and videos in a couple of years. Against this exponential growth, watermarks are a defensive measure designed to label content at the point of generation by major AI providers—a group that now includes OpenAI, Runway, and Nvidia using SynthID's underlying technology.

However, the article makes clear through both technical testing and expert commentary that watermarks address only a fraction of the problem. Testing shows SynthID's robustness has real limits: while it survives heavy compression and multiple edits, a 20 percent crop is enough to strip it away. More critically, Google does not claim invulnerability and notes the watermark is not meant to withstand adversarial attacks, meaning motivated actors may eventually find ways to bypass it. The real structural problem, as Adam Rose of Starling Lab explains, is that "people who can run their own models" can generate unlabeled AI content entirely outside any corporate labeling system. Open-source models can be shared and improved indefinitely with no watermark, making it impossible for watermarks alone to label all AI content.

A secondary usability problem compounds the issue: different companies' watermarks are incompatible, so a user checking whether an image is AI-generated must know which system created it—or run it through multiple detectors and still find nothing. Google limits SynthID checks to about 10 per day to prevent abuse, and access is intentionally restricted to prevent easy attack vectors. The article suggests that as watermarks become more common, people may paradoxically assume that unwatermarked content is authentic, a "dangerous but understandable mistake." Experts argue the focus should shift from trying to catch all fakes to authenticating the scarce, truthful content that actually matters.