Hacker News

Can an image just be stretched or compressed a very tiny bit?

i wouldn't have any confidence in being able to remove a 0.5 bit watermark (presence/absence). what you see is probably a functional decoy.

but with more time and a model fine tuned for this specific use-case would be able to remove any kind of ai watermarking without too many issues.

Always amusing to see AI used against itself.

It’s definitely hackable, Some of our engineers worked on this long time ago

https://deepwalker.xyz/blog/bypassing-synthid-in-gemini-phot...

But why

I guess the SynthID-Image paper from Oct 2025[0] was an encoder-decoder for which they tested checking a flag or a 136 bit payload in 512x512 images and the watermark's robustness after various transformations.

Presumably the deployed version is meaningfully different.

[0]:https://arxiv.org/html/2510.09263v1

Or perhaps a user id or fingerprint to an individual. We added that to printers long ago, this would easily enable that for every photo and image you generate too.

Don’t think that would be possible. If I paste a synthetic piece into an otherwise organic image, the synth id isn’t going to know that.

Just because something isn't perfect doesn't mean it's not useful. I've already seen posts online that were able to be proven as falsified because someone ran the images through Google for SynthID checks.

> How old is photoshop and why is it exempt?

For one, it's not developed by Google or OpenAI. The barrier to entry to making realistic but deceptive images with Photoshop is far higher than with AI, and there are already techniques that can, imperfectly, be used to detect the use of traditional image editing.

>How old is photoshop and why is it exempt?

I'm sure you can think of a couple things that differentiate gen AI from photoshop, I believe in you.

Strictly speaking, DRM = digital rights management, which is related to intellectual property.

SynthID would only be DRM if Google/OpenAI were claiming IP rights over their images. I don’t even know if that’s legal though.

For the record: https://en.wikipedia.org/wiki/Printer_tracking_dots

> How old is photoshop and why is it exempt?

How does today’s maximum theoretical disinformation output per minute compare to 2021 Photoshop?

You: "performative nonsense! Arbitrary metadata not of my choosing!"

Also you: well, games go through some kind of distribution, which has plenty of telemetry and metadata. Whether it is App Store with notarization, or Steam or Itch who collect analytics and know a lot about you, or your ISP if you self host your eclectic WebGL game from home. Posting on an iPhone or Android phone, to hacker News which has your email address, on your cell network which has IPv6 globally unique addresses...

"But my choosing!" You'll say. It is extremely performative of you to say, "everything that would make me 200% wrong isn't valid."

I don't know. I really hate these vibes-driven reactions to (checks notes) content attribution. Every accusation is a confession in this frame of mind. How do you not see that?

Stable Diffusion with 10%~15% denoising strength. Done.

I tested the day 1 when Nano Banana Pro was released and it worked. It still works today for Nano Banana 2.

I didn't post this anywhere because I (arrogantly) thought saying it publicly would make the internet worse. But it was pure arrogancy: if I came up with this the first day then of course other millions of programmers did too.

That being said, it'll introduce the typical artifacts from SD models and that might be detected by other methods (or just by zooming in a lot and looking carefully).

Probably a lot easier to use a different model in the first place

It will but many people won't as i've seen disinformation that could be detected by synth-id.

Seemingly the only use for photo realistic ai generation is deception. We are already seeing AI generated video used in political ads in America.

No, they are very resistant to modification that can be done easily. That being said I doubt it is impossible

I still don't think there's a single GitHub repo that actually removes real SynthID watermarks from Nano Banana 2/NBPro outputs. Most of them are just some research projects that haven't achieved this. The only methods so far I've seen are weird tricks with transparency/overlaying the original image if you're using edits, and also using a diffusion model to regenerate the NB-generated image at low noise levels, but this also modifies the original.

Define easily. There is an approach that apparently works and is based on spectral analysis of the images.

https://github.com/aloshdenny/reverse-SynthID

This one was released a few years ago and still seems unbroken. I'm sure it will be broken at some point, but if you have to wait a year or two from when you make a deepfake until you can post it on Facebook, maybe that's enough. Maybe even a month is enough.

I imagine the technique of having AI recreate the image from scratch based on a very detailed description might work.

It helps significantly in the current moment. A lot of people are lazy and are getting caught quickly by SynthID.

Eventually it won’t matter when image generation is cheap. But few self-host today and few are willing to pay unsubsidized prices, so the vast majority are using the Gemini, OpenAI, and Midjourney. If all 3 adopted SynthID, only a small fraction would use something else.

SynthID is fairly resistant to this sort of thing, although not perfect.

I'd built an on-device app for detecting C2PA and IPTC metadata in images, amongst other things. I might be able to add support for SynthID detection once it's been reverse engineered.

Currently, there is not. OpenAI has promised "public verification tooling" down the line, but I'll believe it when I see it.

potentially to stop bad actors from poisoning datasets by just adding the filter to real pictures?

The fact that they have to keep this closed source is a giant red flag. It means that you can copy it or strip it if you have the knowledge.

I'm not all that worried about stripping it (I'm sure that's trivial).

The problem that I am worried about is that it can be copied (I'd bet $20 that's trivial, too). People WILL put this on images so that they can be "discredited".

might be easier to strip it?

This was done in the past, Google saw it, and now either refuses to generate or doesn't emit the SynthID watermark for those images

You create an image so trivial that no one would care if it was AI-generated or not.

You waste a lot of compute on overhead?

I assume a selfish benefit is that OpenAI and Google don't want the models to train on their own data. There is just /so much/ AI generated content online that they definitely need to filter it out somehow when assembling the training data. This is a pretty effective way to do that, with the nice bonus of being mostly good from a PR standpoint.