Has Google’s Ai Watermarking System Been Reverse-engineered?

A package developer claims to person reverse-engineered Google DeepMind’s SynthID system, showing really AI watermarks tin beryllium stripped from generated images aliases manually inserted into different works. A declare that, according to Google, isn’t true.

The developer, going by nan username Aloshdenny, has open-sourced their activity connected GitHub and documented his process, claiming each it required was 200 Gemini-generated images, awesome processing, and “way excessively overmuch free time.” A small weed besides seemed to help.

“No neural networks. No proprietary access,” Aloshdenny said connected Medium. “Turns retired if you’re unemployed and mean capable ‘pure black’ AI-generated images, each nonzero pixel is virtually conscionable nan watermark staring backmost astatine you.”

SynthID is simply a near-invisible watermarking strategy that tags contented generated by Google’s AI tools, embedding itself successful nan pixels of images astatine nan constituent of creation. It was designed to beryllium difficult to region without degrading nan image quality, and is utilized wide crossed nan AI products offered by Google — everything spat retired by models for illustration Nano Banana and Veo 3 carries SynthID watermarks, and it’s moreover being applied to YouTube’s AI-generated creator clones.

Aloshdenny says he recovered nan strategy to beryllium “genuinely bully engineering,” and was still incapable to region SynthID wholly successful tests, alternatively relying connected confusing SynthID decoders that effort to publication watermarked images.

The process utilized to ace nan underlying mechanics of Google’s watermark is technically analyzable for non-developers. You tin publication nan afloat breakdown connected Aloshdenny’s Medium page (which was apparently written up while Aloshdenny was “high”) if you’re curious, but here’s a simplified explainer:

“The truth that nan champion I could propulsion disconnected was confuse nan decoder capable that it gives up — not really delete nan point — says a batch astir really good it was designed,” says Aloshdenny. “It’s not perfect. But it’s not trying to beryllium unbreakable. It’s trying to raise nan costs of misuse precocious capable that astir group don’t bother.”

I haven’t tried Aloshdenny’s task that reverse-engineers Google’s SynthID watermarking system, truthful I can’t vouch for really effective it really is. That said, astatine this constituent successful time, it doesn’t look that SynthID has been reverse-engineered, astatine slightest not to nan constituent wherever script-kiddies tin download a instrumentality and region (or add) Google’s watermark to instrumentality AI discovery systems. Google besides doesn’t judge it stands up to Aloshdenny’s claims.

“It is incorrect to opportunity this instrumentality tin systematically region SynthID watermarks,” Google spokesperson Myriam Khan told The Verge. “SynthID is simply a robust, effective watermarking instrumentality for AI-generated content.”