Reverse-Engineering SynthID

Discovering, detecting, and surgically removing Google's AI watermark through spectral analysis

Visit us on PitchHut

This fork adds a drag and drop desktop app for the V3 bypass, no command line needed after setup. See gui/README.md for setup and usage.

---

What the Watermark Looks Like

SynthID encodes an imperceptible pattern directly into pixel values. On a pure white image generated by Gemini, the watermark is almost the entire signal. Amplify the high-frequency residual and it looks like this:

Amplified SynthID carrier pattern extracted from a pure-white Gemini image. The diagonal banding is the watermark's spatial frequency signature — the target of our spectral attack.

---

Overview

This project reverse-engineers Google's SynthID watermarking system — the invisible watermark embedded into every image generated by Google Gemini. Using only signal processing and spectral analysis (no access to the proprietary encoder/decoder), we:

1. Discovered the watermark's resolution-dependent carrier frequency structure
2. Built a detector that identifies SynthID watermarks with 90% accuracy
3. Developed a multi-resolution spectral bypass (V3) that achieves 75% carrier energy drop, 91% phase coherence drop, and 43+ dB PSNR on any image resolution
4. Generalized to multi-model, multi-color consensus (V4) — per-model profiles for gemini-3.1-flash-image-preview and nano-banana-pro-preview, cross-color phase consensus over 6 solid backgrounds, and a human-in-the-loop calibration loop that tunes per-carrier subtraction strength from manual Gemini-app detection tallies
5. Broke the detector across both models (Round 06) with a unified 7-stage all-in-one attack targeting every documented SynthID failure mode simultaneously

VT-OxFF built a really cool visualizer to view the process of how SynthID watermark is added to images here (also available in repo description)!

---

Round 06 — It Works ✓

After six iterative rounds of adversarial development, Round 06's bypass_v4_final / bypass_v4_nuke pipeline defeats the Gemini SynthID detector on both gemini-3.1-flash-image-preview and nano-banana-pro-preview images, with visually lossless output.

Round 01 vs Round 06 — Fidelity Comparison

Left: Round 01 output (gentle spectral subtraction only). Right: Round 06 output (final — VAE + elastic warp + squeeze + color + JPEG). Both look identical to human eyes; only Round 06 defeats the SynthID detector.

What Changed Between Rounds

Round	Strategy	Outcome
01	Conservative spectral subtraction (gentle)	✗
02	Aggressive spectral subtraction + JPEG	✗
03	Blog-guided absolute bin targeting	✗
04	Denoise-residual phase extraction	✗
05	Diffusion-VAE re-generation + geometric warp	✗
06	All-in-one: VAE + elastic fragmentation + squeeze + color + JPEG	✓

The breakthrough in Round 06 came from treating the Gemini app's own published failure-mode list as an attack specification:

"When an AI-generated image is part of a complex collage, layered behind other elements, or has many different textures and patterns placed over it, the detector may struggle to isolate the specific signature from the overall file." — Gemini app, SynthID detection help text

The elastic deformation stage simulates this effect at the pixel level: a smooth, low-frequency random warp field gives every ~50-pixel neighbourhood its own independent sub-pixel offset, fragmenting the watermark's spatial phase consensus without introducing any visible distortion.

---

V4 — Cross-Color Consensus + Human-in-the-Loop Calibration

V4 is a ground-up re-think of the codebook built on a much richer dataset:

• Multi-model: separate profiles for gemini-3.1-flash-image-preview and nano-banana-pro-preview (plus an optional union pseudo-model).
• Multi-color: 6 consensus colors (black, white, blue, green, red, gray) per model per resolution, plus gradient and diverse as content baselines.
• Cross-color phase consensus: the primary carrier mask. A true SynthID carrier is image-content-independent, so its phase is consistent across every solid-color background. Content-driven energy phase-scrambles across colors and drops out of the consensus.
• Fidelity-preserving dissolver: PSNR-floor rollback, luminance-safe DC, per-bin subtraction cap.
• Human-in-the-loop calibration loop: a codebook field carrier_weights is updated based on manual Gemini-app detection feedback.

Consensus coherence (why V4 wins)

For each frequency bin (fy, fx) and channel ch:

consensus(fy, fx, ch) = | mean_over_colors( exp(i * phase_color(fy, fx, ch)) ) |

Values near 1.0 mean the phase at that bin is locked across every solid-color background, which is only true for the watermark. Content bins collapse to < 0.3 because their phase is randomized by different color tints. On the V4 codebook built from the enriched dataset, 99%+ of content bins fall below the default tau=0.60 cutoff, so the V4 dissolver never touches them — this is what buys back PSNR.

Two-phase release workflow

flowchart LR
    dataset[reverse-synthid-dataset<br/>model x color x resolution] --> build[scripts/build_codebook_v4.py]
    build --> codebook[artifacts/spectral_codebook_v4.npz]
    codebook --> dissolve[scripts/dissolve_batch.py]
    input[watermarked inputs] --> dissolve
    dissolve --> variants[final / nuke variants]
    variants --> gemini[Gemini app<br/>manual SynthID detection]
    gemini --> feedback[detection feedback]
    feedback --> calibrate[scripts/calibrate_from_feedback.py]
    calibrate -->|updates carrier_weights| codebook

V4 Quickstart

# 1. Build the codebook from the enriched hierarchical dataset
python scripts/build_codebook_v4.py \
    --root /path/to/reverse-synthid-dataset \
    --output artifacts/spectral_codebook_v4.npz