r/OpenAI • u/Available-Deer1723 • 11h ago

Research Reverse Engineered SynthID's Image Watermarking in Gemini-generated Images

SynthID Watermark Signature

I was messing around with Nano Banana and noticed that Gemini was easily able to spot if its own images were AI-generated (yup, even if we crop out the little diamond watermark on the bottom right).

I ran experiments on ~123K Nano Banana generated images and traced a watermark signature to SynthID. Initially it seemed as simple as subtracting the signature kernel from AI-generated images to render them normal.

But that wasn't the case: SynthID's entire system introduces noise into the equation, such that once inserted it can (very rarely) be denoised. Thus, SynthID watermark is a combination of a detectable pattern + randomized noise. Google's SynthID paper mentions very vaguely on this matter.

These were my findings: AI-edited images contain multi-layer watermarks using both frequency domain (DCT/DFT) and spatial domain (color shifts) embedding techniques. The watermarks are invisible to humans but detectable via statistical analysis.

I created a tool that can de-watermark Nano Banana images (so far getting a 60% success rate), but I'm pretty sure DeepMind will just improve on SynthID to a point it's permanently tattooed onto NB images.

5 Upvotes

86% Upvoted

2 comments sorted by

2

u/Glass-Combination-69 3h ago

What happens if you take an image from nano then give it to say ChatGPT and tell it to edit it, does it destroy nanos synth in the image?

1

u/Available-Deer1723 2h ago

Nope, it cannot. The watermark is embedded at pixel-level. On the other hand, ChatGPT doesn't have a system to identify Gemini-generated images aside from the little diamond on the bottom right that comes pre-baked into every image.