Google AI watermarking system reportedly reverse-engineered
A software developer claiming the username Aloshdenny has posted an open-source project on GitHub asserting they reverse-engineered Google DeepMind's SynthID watermarking system. The developer suggests the process allows AI watermarks to be stripped from generated images or manually inserted into other works. However, Google strongly disputes these claims, stating that the tool cannot systematically remove SynthID watermarks. SynthID is a near-invisible system designed to tag content created by Google's AI tools. It embeds watermarks directly into image pixels at the moment of creation, making it difficult to remove without degrading quality. This technology is integrated into various Google products, including models like Nano Banana and Veo 3, as well as YouTube's AI-generated creator clones. Aloshdenny detailed their methodology in a Medium post, describing a process that required no neural networks or proprietary access. Instead, the developer claimed that analyzing approximately 200 pure black AI-generated images combined with signal processing was sufficient to expose the watermark. The developer noted that every non-zero pixel in these images appeared to contain the watermark. While acknowledging the system represents good engineering, Aloshdenny admitted that the method did not completely delete the watermark. Rather, the approach aimed to confuse SynthID decoders to the point where they failed to detect the signal. Google spokesperson Myriam Khan rejected the notion that the watermark has been broken. In a statement to The Verge, Khan emphasized that SynthID remains a robust and effective tool for identifying AI-generated content. She clarified that the claim of a tool capable of systematically removing these watermarks is incorrect. The technical details of the reverse-engineering attempt are complex and may not be accessible to non-developers. Despite the developer's assertions, there is currently no evidence that the system has been compromised to a degree where casual users can easily manipulate AI detection systems. Google maintains that while SynthID is not intended to be unbreakable, its design successfully raises the cost of misuse to a level where most bad actors do not attempt to bypass it. Ultimately, while the developer's experiment offers an interesting look into the mechanics of AI watermarks, the broader consensus and official stance from Google indicate that SynthID has not been successfully cracked. The tool continues to serve its intended purpose of tagging content, even as the conversation around AI transparency and watermarking security evolves.
