Has Google’s AI watermarking system been reverse engineered?

A software developer claims to have reverse-engineered Google DeepMind’s SynthID system, showing how AI watermarks can be stripped from images created or manually inserted into other works. A claim that, according to Google, is untrue.

Developer, passes through Username Al-Washdinihe has Their work is open sourced on GitHub He documented his process, claiming that all it took were 200 Gemini-generated images, signal processing, and “a lot of free time.” A few herbs seem to help too.

“No neural networks. No special access.” Al-Washdini said on Medium. “Turns out that if you’re unemployed and have enough ‘pure black’ AI-generated images, every non-zero pixel is literally just a watermark staring back at you.”

SynthID is a near-invisible watermarking system that tags content generated by Google’s AI tools, and embeds itself into image pixels at the point of creation. It’s designed to be difficult to remove without compromising image quality, and is widely used across Google’s AI products — everything released by models like the Nano Banana and Veo 3 carries SynthID watermarks, and it’s even applied to Clone AI-generated content creators on YouTube.

Al-Washdini says he found the system to be “really well-engineered,” and was unable to completely remove SynthID in tests, instead relying on confusing SynthID decoders trying to read watermarked images.

The process used to break the basic mechanics of Google watermark is technically complex for non-developers. You can read the full explanation on the Aloshdenny Medium page (which appears to have been written when Aloshdenny was “high”) if you’re curious, but here’s a simplified explanation:

“The best I can do is confuse the set-top box enough to give up on it — not actually delete it — which says a lot about how well it’s designed,” Alushdini says. “It’s not perfect. But it’s not trying to be unbreakable. It’s trying to raise the cost of misuse so high that it won’t bother most people.”

I haven’t tried the Washdini project that reverse-engineers Google’s SynthID watermarking system, so I can’t vouch for how effective it actually is. However, at this time, it does not appear that SynthID He has It’s reverse-engineered, at least not to the extent that kids can download a tool and remove (or add) the Google watermark to fool AI detection systems. Google also doesn’t believe it stands up to Al-Washdini’s claims.

“It is incorrect to say that this tool can systematically remove SynthID watermarks,” Google spokeswoman Miriam Khan said. Edge. “SynthID is a powerful and effective tool for watermarking AI-generated content.”