The Google SynthID watermark appears hard to erase through ordinary image abuse, according to testing reported by Ars Technica, but the harder problem remains untouched: plenty of AI media will never carry a label in the first place.
Google said at I/O this spring that its tools had produced more than 100 billion AI images and videos over the past couple of years. The company is now pushing SynthID beyond its own products through partnerships with OpenAI, Runway, Nvidia and others. Starling Lab, a Stanford University and University of Southern California research collaboration, has put the scale in sharper terms: it estimated that humanity took until 1975 to create 1.5 billion images after the camera’s invention, while generative AI reached that volume in 18 months.
What is Google SynthID watermark?
SynthID is Google’s invisible watermarking system for AI-generated media. Instead of attaching a label as file metadata, it embeds a signal into the pixels of an image or video, or into the waveform of an audio clip, so the mark can survive some compression, resizing and editing.
That makes it different from C2PA, the metadata standard Google also uses. C2PA records can be cryptographically verified, so they are hard to forge, but Ars Technica notes they are easy to remove by resaving a file, editing it or taking a screenshot.
Google DeepMind scientist Pushmeet Kohli told Ars Technica that the SynthID team assumed the system would be attacked and tested it against transformations such as filters and cropping. Google has not published much detail beyond its original paper, which also says SynthID is not designed to resist dedicated adversarial attacks.
How hard is SynthID to remove?
Ars Technica tested two Google AI images made with Nano Banana Pro: one fully generated image and one AI-edited photo. Using Python’s Pillow library, the test repeatedly compressed and resized the files hundreds of times, then checked whether Gemini could still detect SynthID.
After 300 rounds of simulated sharing damage, SynthID was still detectable in both full-frame images. Screenshots of the images also retained the mark, because the embedded signal carried over into the new file.
The watermark did eventually fail after enough damage and cropping. Ars Technica reported that after 300 compression cycles, cropping 20 percent from the images made SynthID undetectable. A 50 percent crop could break detection earlier, at about 250 compression rounds. By then, the images were heavily degraded.
The result is good news for Google’s narrow claim: SynthID can withstand the kind of file mangling that social platforms and group chats inflict on images. It is less comforting as a public verification system.
Access to detection is restricted. Ars Technica reported that users must ask Gemini to run a SynthID check, because Google does not offer a public detector webpage or API. Google also limits checks to approximately 10 images per day, and the verifier may lock users out sooner when they upload many similar images.
The system is also fragmented. Although OpenAI and Runway are adopting SynthID technology, their watermarks are not interchangeable with Google’s. Ars Technica reported that Google’s detector does not recognize OpenAI’s watermark, and OpenAI’s detector does not recognize Google’s. A Google spokesperson said the company is working with partners toward more accessible and unified verification.
Why watermarks do not solve AI misinformation
Watermarks only help when the creator uses them and the detector can read them. Adam Rose, a fellow and senior adviser at Starling Lab, told Ars Technica that the bigger issue includes people running models on their own computers. Open image models can generate media without any label at all.
That creates a nasty failure mode: people may start treating unmarked images as authentic, even though an absent watermark proves very little. Meta’s recent Content Seal watermark also showed the risk of weaker implementations, with Reuters finding that modest cropping often removed it.
Starling fellow and photojournalist Mike Caronna argued that authentic media may need stronger proof at capture, because synthetic media has no practical production ceiling. That points back to C2PA-style provenance for real photos and videos. Google’s Pixel phones are described by Ars Technica as the only mainstream cameras with deep C2PA integration, adding protected metadata that records how images and videos were captured and whether AI editing was used.
SynthID looks technically useful. It does not make AI detection universal, public or reliable enough to settle what is real on its own.
This story draws on original reporting from Ars Technica.
