Reverse Engineering Google's SynthID Detection

The reverse-SynthID project focuses on the reverse engineering of Google's SynthID, a watermarking system embedded in images generated by Google Gemini. This project aims to understand, detect, and remove this invisible watermark through advanced spectral analysis techniques without requiring access to the proprietary encoding or decoding processes.

Key Features

• Watermark Detection: A robust detector has been crafted to identify SynthID watermarks with an impressive 90% accuracy rate.
• Multi-Resolution Spectral Bypass: Utilizing a multi-resolution approach, a sophisticated technique (Version 3) was developed that significantly reduces carrier energy and phase coherence while maintaining high visual quality (with 43+ dB PSNR).
• Multi-Model Consensus: The project expands to include consensus across different models and color backgrounds, further enhancing its efficacy.
• Cross-Color Consensus: The latest version (Version 4) incorporates a refined dataset with separate profiles for various models and colors, improving detection and removal capabilities.

How the Watermark Works

The SynthID watermark operates by embedding a subtle pattern within the pixel values of an image, which can be revealed under specific processing conditions. By analyzing the residual signal from images, the project identifies the watermark's spatial frequency signature and utilizes this information to develop counter-techniques that can effectively disrupt the watermark during image processing.

Results

• Following extensive iterative development, the current pipeline (Round 06) has achieved considerable success in bypassing the detector with visually lossless output for both gemini-3.1-flash-image-preview and nano-banana-pro-preview images.
• A comparative analysis shows significant advancements in fidelity and detection evasion capabilities from earlier iterations, resulting in a unified approach that targets every known failure mode of SynthID detection.

Technical Insights

The development process includes multiple attack stages leveraging various techniques:

1. Variational Autoencoder (VAE) round-trip: Offsets the image from natural-image distributions.
2. Elastic Deformation: Simulates complex collage effects to fragment the watermark's integrity without perceptible distortion.
3. Geometric Adjustments: Combines several transformations to disrupt watermark coherence.

Quick Start Guide

To engage with the project:

# Building the codebook from the dataset
python scripts/build_codebook_v4.py \
    --root /path/to/reverse-synthid-dataset \
    --output artifacts/spectral_codebook_v4.npz

# Running the bypass against a set of images to obtain variants
python scripts/dissolve_batch.py \
    --input ./to_clean/ \
    --output ./runs/round_06/ \
    --codebook artifacts/spectral_codebook_v4.npz \
    --model gemini-3.1-flash-image-preview \
    --strengths final nuke

This project is part of an ongoing research initiative and is intended for educational and academic purposes only, focusing on watermark robustness and AI-generated content identification analysis. Feedback and contributions from the community are encouraged to help refine the techniques and expand the dataset for improved performance.