Google DeepMind’s SynthID, a near-invisible watermarking system meant to tag AI-generated images at the point of creation, is facing a new challenge: a software developer says they have reverse-engineered how the watermark works and demonstrated techniques that could, in limited tests, strip or manipulate it. The claim is attributed to a developer using the username Aloshdenny, who says the work required “200 Gemini-generated images, signal processing” and “way too much free time.” Google, however, disputes the core conclusion—telling The Verge that it is incorrect to say the reported tool can systematically remove SynthID watermarks.
What SynthID is designed to do
According to The Verge, SynthID embeds a watermark into the pixels of images generated by Google’s AI tools. The watermark is described as near-invisible and intended to be difficult to remove without degrading image quality. The system is used across AI products offered by Google, covering outputs from models referenced in the report, including Nano Banana and Veo 3. The report also notes that SynthID is being applied to YouTube’s AI-generated creator clones.
This context matters because watermarking is not only a labeling feature—it is also a technical control point in the content pipeline. If the watermark can be removed or inserted in a way that undermines detection, then downstream trust mechanisms built around that detection could be weakened. In other words, the technical details of how SynthID is embedded—and how it might be extracted—directly affect the reliability of “AI provenance” signals that rely on the watermark.
The reverse-engineering claim: from data generation to frequency-domain removal
The Verge reports that Aloshdenny has open-sourced their work on GitHub and documented a process on Medium. The developer’s stated goal is to reveal the underlying mechanics of Google’s watermarking approach. In a quote provided by The Verge, Aloshdenny says: “No neural networks. No proprietary access.” They also claim, in the same report, that they found the method to rely on generating “pure black” AI-generated images so that “every nonzero pixel is literally just the watermark staring back at you.”
Google’s watermark is described in the report as being embedded at the point of creation. Aloshdenny’s approach, as summarized by The Verge, is technically complex and includes steps that combine image generation, signal processing, and targeted removal. The report provides a simplified explainer of the method:
1) Generate 200 entirely black or pure white images using Gemini.
2) Enhance the contrast and saturation, then denoise the saturation to expose watermark patterns.
3) Average the patterns together to determine the magnitude and phase of the watermark signal at every frequency bin, per channel.
4) Hunt for those frequencies in images and partially remove them at the same angle at which they were inserted during generation.
The report also includes an example described as a comparison: an image with SynthID still attached appears one way, while an image after SynthID has been partially removed enough to fool detectors appears with only slight visual differences. The Verge attributes the comparison to Aloshdenny and notes that the removal method results in “minimal degradation” in the view presented.
From an engineering perspective, the frequency-domain framing is significant. If watermarking signal components are detectable in predictable ways, then the watermark’s robustness depends on how resistant those components are to partial cancellation without affecting perceptual quality and without confusing the decoder.
Limits, decoders, and what “removal” means in practice
Aloshdenny’s account, as reported by The Verge, draws a distinction between deleting a watermark entirely and disrupting detection. The developer says they were unable to remove SynthID entirely in tests, instead relying on confusing SynthID decoders that attempt to read watermarked images. In a quote included in the report, Aloshdenny says: “The fact that the best I could pull off was confuse the decoder enough that it gives up — not actually delete the thing — says a lot about how well it was designed.”
They also add that SynthID is “not perfect,” but that it is “trying to raise the cost of misuse high enough that most people don’t bother.” This framing is directly tied to how watermarking systems are typically evaluated: not only whether they can be reversed in theory, but whether the reversal is practical at scale and accessible enough to enable widespread abuse.
At the same time, The Verge cautions that it has not tested the specific project and cannot “vouch for how effective it actually is.” The report further states that, “at this point in time,” it doesn’t appear that SynthID has been reverse-engineered “at least not to the point where script-kiddies can download a tool and remove (or add) Google’s watermark to trick AI detection systems.”
For technologists watching this space, the key variable is operational: what level of tooling is required, how repeatable the process is, and whether attackers can reliably produce results that pass or evade detectors. Even if an approach can partially reduce detectability, the system’s real-world risk depends on how detectors behave under those partial modifications.
Google’s response: disagreement over systematic removal
Google disputes Aloshdenny’s implication that the watermark can be systematically removed. A The Verge spokesperson, Myriam Khan, is quoted saying: “It is incorrect to say this tool can systematically remove SynthID watermarks.” The spokesperson adds that “SynthID is a robust, effective watermarking tool for AI-generated content.”
This matters because the public debate is likely to turn on definitions. A developer might demonstrate that a watermark can be manipulated in controlled conditions, while the vendor may argue that the conditions do not translate into systematic, repeatable removal at the level of “tools” that generalize to broad misuse.
More broadly, the episode highlights a recurring technical tension in watermarking: systems aim to be robust against removal, but the publication of methods—especially those that rely on accessible steps like generating images with Gemini and applying signal processing—can shift the threat model. Even if Google is correct that “systematic removal” is not established, the availability of a documented reverse-engineering workflow could influence how researchers evaluate watermark resilience and how future watermark designs are validated.
Source: The Verge