4 ms·

SynthID: A tool to watermark and identify content generated through AI

82 points by tosh 9mo ago

u1hcw9nx 9mo ago
This technology could be used to copyrights as well. >The watermark doesn’t change the image or video quality. It’s added the moment content is created, and designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression. But does it survive if you use another generative image model to replicate the image?
- lxgr 9mo ago
  > This technology could be used to copyrights as well. That's been a thing for a while: https://en.wikipedia.org/wiki/Digital_watermarking https://en.wikipedia.org/wiki/Digital_watermarking
- nerdsniper 9mo ago
  Extremely doubtful, due to the way that embedding and diffusion works. I would be utterly floored if they had achieved that.
- elpocko 9mo ago
  It doesn't. I don't have a link for you right now but there was a post on reddit recently showing that SynthID is removed from images by passing the image through a diffusion model for a single step at low denoise. The output image is identical to the input image (to the human eye).
andrewmcwatters 9mo ago
I wonder how it stands up to feature analysis. "Generate a pure white image." "Generate a pure black image." Channel diff, extract steganographic signature for analysis.
- amingilani 9mo ago
  I just tried this idea, and it looks like it isn't that simple. > "Generate a pure white image." It refused no matter how I phrased it ¯\_(ツ)_/¯ > "Generate a pure black image." It did give me one. In a new chat, I asked Gemini to detect SynthID with "@synthid". It responded with: > The image contains too little information to make a diagnosis regarding whether it was created with Google AI. It is primarily a solid black field, and such content typically lacks the necessary data for SynthID to provide a definitive result. Further research: Does a gradient trigger SynthID? IDK, I have to get back to work.
  - interloxia 9mo ago
    Ask for a coloring page and an inverted version.
- alibero 9mo ago
  I've been looking into this. There seems to be some mostly-repeating 2D pattern in the LSB of the generated images. The magnitude of the noise seems to be larger in the pure black image vs pure white image. My main goal is to doctor a real image to flag as positive for SynthID, but I imagine if you smoothed out the LSB, you might be able to make images (especially very bright images) no longer flag as SynthID? Of course, it's possible there's also noise in here from the image-generation process... Gemini really doesn't like generating pure-white images but you can ask it to generate a "photograph of a pure-white image with a black border" and then crop it. So far I've just been looking at pure images and gradients, it's possible that more complex images have SynthID embedded in a more complicated way (e.g. a specific pattern in an embedding space).
throwaway13337 9mo ago
These sorts of tools will only be able to positively identify a subset of genAI content. But I suspect that people will use it to 'prove' something is not genAI. In a sense, the identifier company can be an arbiter of the truth. Powerful. Training people on a half-solution like this might do more harm than good.
- greensoap 9mo ago
  It will just be an arms race if we try to prove "not genAI." Detectors will improve, genAI will improve without marking (opensource and state actors will have unmarked genAI even if we mandate it). Marking real from lense through digital life is more practical. But then what do we do with all the existing hardware that doesn't mark real and media that preexisited this problem.
  - throwaway13337 9mo ago
    I agree. A mechanism to voluntarily attach a certificate metadata about the media record from the device seems like a better idea. That still can be spoofed, though. In the end, society has always existed on human chains of trust. Community. As long as there are human societies, we need human reputation.
- sippeangelo 9mo ago
  It is actively harmful to society. Slap SynthID on some of the photographic evidence from the unreleased Epstein files and instantly de-legitimize it. Launder a SynthID image through a watermark free model and it's legit again. The fact that it exists at all can't be interpreted in any other way than malice.
- observationist 9mo ago
  You could take a picture or video with your phone of a screen or projection of an altered media and thereby capture a watermarked "verified" image or video. None of these schemes for validation of digital media will work. You need a web of trust, repeated trustworthy behavior by an actor demonstrating fidelity. You need people and institutions you can trust, who have the capability of slogging through the ever more turbulent and murky sea of slop and using correlating evidence and scientific skepticism and all the cognitive tools available to get at reality. Such people and institutions exist. You can also successfully proxy validation of sources by identifying people or groups good at identifying primary sources. When people and institutions defect, as many legacy media, platforms, talking heads, and others have, you need to ruthlessly cut them out of your information feed. When or if they correct their mistake, just follow tit for tat, and perhaps they can eventually earn back their place in the de-facto web of trust. Google's stamp of approval means less than nothing to me; it's a countersignal, indicating I need to put even more effort than otherwise to confirm the truthfulness of any claims accompanied by their watermark.
gregorkas 9mo ago
I genuinely feel that in this AI world we need the inverse. That every analogue or digital photo taken by traditional means of photography will need to be signed by a certificate, so anyone can verify its authenticity.
- hedora 9mo ago
  Some cameras support this, but usually only for raw. Note that your cell phone camera is using gen AI techniques to counteract sensor noise. Was that famous person in the background really there, or a hallucination filling in static? Who knows at this point? So, the signatures you proposed need to have some nuance around what they’re asserting.
  - graypegg 9mo ago
    To be fair, I think just signing details about the way an image was assembled makes sense. Deciding on fake vs real doesn't have to be done at time of capture. We store things like the aperture size, sensitivity, camera name/model, etc in the EXIF data, including details about the image processing pipeline seems like a logical step. (With a signature verification scheme... and I guess also trying to embed that in the actual bitmap data) There is no original image to recover, since we can't capture and describe every photon, so it's not a "fake vs real" image signature... that would be a UI choice the image viewer client would make based on the pipeline data in the image.
- andrewmcwatters 9mo ago
  [dead]
- gumby271 9mo ago
  I'm sure Apple would love that too. More seriously, would that also mean all editing tools would need to re-sign a photo that was previously signed by the original sensor. How do we distinguish an edit that's misleading vs just changing levels? It's an interesting area for sure, but this inverse approach seems much trickier.
  - 9mo ago
squigz 9mo ago
Looks like there's a lot more info here, at least about the text version. https://ai.google.dev/responsible/docs/safeguards/synthid https://ai.google.dev/responsible/docs/safeguards/synthid
kingstnap 9mo ago
It's security through obscurity. I'm sure with the technical details or even just sufficient access to a predictive oracle you could break this. But I suppose it ads friction so better than nothing. Watermarking text without affecting it is an interesting seemingly weird idea. Does it work any better than (with knowledge of the model used to produce said text), just observing the perplexity is low because its "on policy" generated text.
PaulHoule 9mo ago
...But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. Pro-Tip: Something like that Sherbet colored dog is always AI generated
- pavel_lishin 9mo ago
  You'd be surprised what dog owners do sometimes.
zelias 9mo ago
Seems like this really just validates whether a piece of AI content was generated by Google, not AI generated in general What incentive do open models have to adopt this?
parliament32 9mo ago
Note that watermarking (yes, including text) is a requirement[1] of the EU AI Act, and goes into effect in August 2026, so I suspect we'll see a lot more work in this space in the near future. [1] Specifically, "...synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated", see https://artificialintelligenceact.eu/article/50/ https://artificialintelligenceact.eu/article/50/
- raincole 9mo ago
  EU really like unenforceable regulations, doesn't it?
  - hansihe 9mo ago
    What do you mean? There is nothing unenforceable about this.
    - nightski 9mo ago
      How would you prove that something was generated by AI yet did not include a watermark?
      - pegasus 9mo ago
        You generate it with that particular AI and look for the watermark :/
      - littlestymaar 9mo ago
        You can trivially enforce that at the AI provider level, which covers 99% of the problem the law is designed to address. Of course it doesn't cover the issue of foreign state psyop operations but the fact that enforcing laws against organized crime and adversary state actors is hard isn't specific to AI.
        mikestorrent 9mo ago
ChrisArchitect 9mo ago
something new here OP? Some previous discussion: https://news.ycombinator.com/item?id=45071677 https://news.ycombinator.com/item?id=45071677
geor9e 9mo ago
This is from 2025. Did something new happen? What am I missing here?
deleted 9mo ago
[deleted]
Aldipower 9mo ago
As a synthesizer collector with serious GAS I find this particular name very offensive.
jamiecode 9mo ago
[dead]
- dpe82 9mo ago
  The act doesn't explicitly require watermarking, does it?
- doctorpangloss 9mo ago
  haha "you" say this, when your comment was written by an LLM! it's watermarked!
- pegasus 9mo ago
  Long-form content from controlled providers is by far the lion's share of what needs this regulation, at least at the moment. Perfect is the enemy of good enough. Or at least of better than the status-quo.
- ekjhgkejhgk 9mo ago
  Link to the paper please?
ks2048 9mo ago
How about a database of verified non-AI images? I'm thinking of historical images, where there aren't a huge number of existing images and no more will ever be created. If I see something labeled "Street scene in Paris, 1905". I want to know if it is legit.
galleywest200 9mo ago
This is great, but there is no way for me to verify if groups or nation states can pay for a special contract where they do not have to have their outputs watermarked.
gigel82 9mo ago
Reposting a comment I made on an earlier thread on this. We need to be super careful with how legislation around this is passed and implemented. As it currently stands, I can totally see this as a backdoor to surveillance and government overreach. If social media platforms are required by law to categorize content as AI generated, this means they need to check with the public "AI generation" providers. And since there is no agreed upon (public) standard for imperceptible watermarks hashing that means the content (image, video, audio) in its entirety needs to be uploaded to the various providers to check if it's AI generated. Yes, it sounds crazy, but that's the plan; imagine every image you post on Facebook/X/Reddit/Whatsapp/whatever gets uploaded to Google / Microsoft / OpenAI / UnnamedGovernmentEntity / etc. to "check if it's AI". That's what the current law in Korea and the upcoming laws in California and EU (for August 2026) require :(
manbash 9mo ago
It's nice that they explain the "what" (...it is doing) but not the "why". Who is going to use it and for what reasons? Also, if it's essentially a sort of metadata, can't the output generated image be replicated (e.g. screenshot) and thus stripped of any such data?
- ainch 9mo ago
  I've heard of journalists using it to try and figure out whether images sent by sources were generated. In their Nano Banana 2 release blogpost, Google mentioned that SynthID has been used ~20 million times, so there's clearly some interest in identifying AI-generated images.
ekjhgkejhgk 9mo ago
Is there a paper for this?
deleted 9mo ago
[deleted]
omgmo 9mo ago
What about spoofing a SynthID false positive for a real image or video? Who can arbitrate what is true? I think that AI service providers should have safeguards and encoded attribution. This solution helps when people lazily share things with friends or on social media I suppose, rather than stopping motivated bad actors. The only way to actually implement this I think would be to ban all local models, and to have the service providers store perceptual hashes all generated images and video. It feels like the cat's out of the bag already though (for images at least).
dang 9mo ago
Related: Remove/Bypass Google's SynthID AI Watermark - https://news.ycombinator.com/item?id=46692023 https://news.ycombinator.com/item?id=46692023 - Jan 2026 (1 comment) SynthID – A tool to watermark and identify content generated through AI - https://news.ycombinator.com/item?id=45071677 https://news.ycombinator.com/item?id=45071677 - Aug 2025 (83 comments) SynthID Detector – a new portal to help identify AI-generated content - https://news.ycombinator.com/item?id=44045946 https://news.ycombinator.com/item?id=44045946 - May 2025 (1 comment)
mediumsmart 9mo ago
Excellent. Everything without the wartmark is real then. Too easy.

82 points by tosh 9mo ago

This technology could be used to copyrights as well. >The watermark doesn’t change the image or video quality. It’s added the moment content is created, and designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression. But does it survive if you use another generative image model to replicate the image?

lxgr 9mo ago
> This technology could be used to copyrights as well. That's been a thing for a while: https://en.wikipedia.org/wiki/Digital_watermarking https://en.wikipedia.org/wiki/Digital_watermarking
nerdsniper 9mo ago
Extremely doubtful, due to the way that embedding and diffusion works. I would be utterly floored if they had achieved that.
elpocko 9mo ago
It doesn't. I don't have a link for you right now but there was a post on reddit recently showing that SynthID is removed from images by passing the image through a diffusion model for a single step at low denoise. The output image is identical to the input image (to the human eye).

andrewmcwatters 9mo ago

I wonder how it stands up to feature analysis. "Generate a pure white image." "Generate a pure black image." Channel diff, extract steganographic signature for analysis.

amingilani 9mo ago
I just tried this idea, and it looks like it isn't that simple. > "Generate a pure white image." It refused no matter how I phrased it ¯\_(ツ)_/¯ > "Generate a pure black image." It did give me one. In a new chat, I asked Gemini to detect SynthID with "@synthid". It responded with: > The image contains too little information to make a diagnosis regarding whether it was created with Google AI. It is primarily a solid black field, and such content typically lacks the necessary data for SynthID to provide a definitive result. Further research: Does a gradient trigger SynthID? IDK, I have to get back to work.
- interloxia 9mo ago
  Ask for a coloring page and an inverted version.
alibero 9mo ago
I've been looking into this. There seems to be some mostly-repeating 2D pattern in the LSB of the generated images. The magnitude of the noise seems to be larger in the pure black image vs pure white image. My main goal is to doctor a real image to flag as positive for SynthID, but I imagine if you smoothed out the LSB, you might be able to make images (especially very bright images) no longer flag as SynthID? Of course, it's possible there's also noise in here from the image-generation process... Gemini really doesn't like generating pure-white images but you can ask it to generate a "photograph of a pure-white image with a black border" and then crop it. So far I've just been looking at pure images and gradients, it's possible that more complex images have SynthID embedded in a more complicated way (e.g. a specific pattern in an embedding space).

throwaway13337 9mo ago

These sorts of tools will only be able to positively identify a subset of genAI content. But I suspect that people will use it to 'prove' something is not genAI. In a sense, the identifier company can be an arbiter of the truth. Powerful. Training people on a half-solution like this might do more harm than good.

greensoap 9mo ago
It will just be an arms race if we try to prove "not genAI." Detectors will improve, genAI will improve without marking (opensource and state actors will have unmarked genAI even if we mandate it). Marking real from lense through digital life is more practical. But then what do we do with all the existing hardware that doesn't mark real and media that preexisited this problem.
- throwaway13337 9mo ago
  I agree. A mechanism to voluntarily attach a certificate metadata about the media record from the device seems like a better idea. That still can be spoofed, though. In the end, society has always existed on human chains of trust. Community. As long as there are human societies, we need human reputation.
sippeangelo 9mo ago
It is actively harmful to society. Slap SynthID on some of the photographic evidence from the unreleased Epstein files and instantly de-legitimize it. Launder a SynthID image through a watermark free model and it's legit again. The fact that it exists at all can't be interpreted in any other way than malice.
observationist 9mo ago
You could take a picture or video with your phone of a screen or projection of an altered media and thereby capture a watermarked "verified" image or video. None of these schemes for validation of digital media will work. You need a web of trust, repeated trustworthy behavior by an actor demonstrating fidelity. You need people and institutions you can trust, who have the capability of slogging through the ever more turbulent and murky sea of slop and using correlating evidence and scientific skepticism and all the cognitive tools available to get at reality. Such people and institutions exist. You can also successfully proxy validation of sources by identifying people or groups good at identifying primary sources. When people and institutions defect, as many legacy media, platforms, talking heads, and others have, you need to ruthlessly cut them out of your information feed. When or if they correct their mistake, just follow tit for tat, and perhaps they can eventually earn back their place in the de-facto web of trust. Google's stamp of approval means less than nothing to me; it's a countersignal, indicating I need to put even more effort than otherwise to confirm the truthfulness of any claims accompanied by their watermark.

gregorkas 9mo ago

I genuinely feel that in this AI world we need the inverse. That every analogue or digital photo taken by traditional means of photography will need to be signed by a certificate, so anyone can verify its authenticity.

hedora 9mo ago
Some cameras support this, but usually only for raw. Note that your cell phone camera is using gen AI techniques to counteract sensor noise. Was that famous person in the background really there, or a hallucination filling in static? Who knows at this point? So, the signatures you proposed need to have some nuance around what they’re asserting.
- graypegg 9mo ago
  To be fair, I think just signing details about the way an image was assembled makes sense. Deciding on fake vs real doesn't have to be done at time of capture. We store things like the aperture size, sensitivity, camera name/model, etc in the EXIF data, including details about the image processing pipeline seems like a logical step. (With a signature verification scheme... and I guess also trying to embed that in the actual bitmap data) There is no original image to recover, since we can't capture and describe every photon, so it's not a "fake vs real" image signature... that would be a UI choice the image viewer client would make based on the pipeline data in the image.
andrewmcwatters 9mo ago
[dead]
gumby271 9mo ago
I'm sure Apple would love that too. More seriously, would that also mean all editing tools would need to re-sign a photo that was previously signed by the original sensor. How do we distinguish an edit that's misleading vs just changing levels? It's an interesting area for sure, but this inverse approach seems much trickier.
- 9mo ago

squigz 9mo ago

Looks like there's a lot more info here, at least about the text version. https://ai.google.dev/responsible/docs/safeguards/synthid https://ai.google.dev/responsible/docs/safeguards/synthid

kingstnap 9mo ago

It's security through obscurity. I'm sure with the technical details or even just sufficient access to a predictive oracle you could break this. But I suppose it ads friction so better than nothing. Watermarking text without affecting it is an interesting seemingly weird idea. Does it work any better than (with knowledge of the model used to produce said text), just observing the perplexity is low because its "on policy" generated text.

PaulHoule 9mo ago

...But it can be hard to tell the difference between content that’s been AI-generated, and content created without AI. Pro-Tip: Something like that Sherbet colored dog is always AI generated

pavel_lishin 9mo ago
You'd be surprised what dog owners do sometimes.

zelias 9mo ago

Seems like this really just validates whether a piece of AI content was generated by Google, not AI generated in general What incentive do open models have to adopt this?

parliament32 9mo ago

Note that watermarking (yes, including text) is a requirement[1] of the EU AI Act, and goes into effect in August 2026, so I suspect we'll see a lot more work in this space in the near future. [1] Specifically, "...synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated", see https://artificialintelligenceact.eu/article/50/ https://artificialintelligenceact.eu/article/50/

raincole 9mo ago
EU really like unenforceable regulations, doesn't it?
- hansihe 9mo ago
  What do you mean? There is nothing unenforceable about this.
  - nightski 9mo ago
    How would you prove that something was generated by AI yet did not include a watermark?
    - pegasus 9mo ago
      You generate it with that particular AI and look for the watermark :/
    - littlestymaar 9mo ago
      You can trivially enforce that at the AI provider level, which covers 99% of the problem the law is designed to address. Of course it doesn't cover the issue of foreign state psyop operations but the fact that enforcing laws against organized crime and adversary state actors is hard isn't specific to AI.
      - mikestorrent 9mo ago

ChrisArchitect 9mo ago

something new here OP? Some previous discussion: https://news.ycombinator.com/item?id=45071677 https://news.ycombinator.com/item?id=45071677

geor9e 9mo ago

This is from 2025. Did something new happen? What am I missing here?

deleted 9mo ago

[deleted]

Aldipower 9mo ago

As a synthesizer collector with serious GAS I find this particular name very offensive.

jamiecode 9mo ago

[dead]

dpe82 9mo ago
The act doesn't explicitly require watermarking, does it?
doctorpangloss 9mo ago
haha "you" say this, when your comment was written by an LLM! it's watermarked!
pegasus 9mo ago
Long-form content from controlled providers is by far the lion's share of what needs this regulation, at least at the moment. Perfect is the enemy of good enough. Or at least of better than the status-quo.
ekjhgkejhgk 9mo ago
Link to the paper please?

ks2048 9mo ago

How about a database of verified non-AI images? I'm thinking of historical images, where there aren't a huge number of existing images and no more will ever be created. If I see something labeled "Street scene in Paris, 1905". I want to know if it is legit.

galleywest200 9mo ago

This is great, but there is no way for me to verify if groups or nation states can pay for a special contract where they do not have to have their outputs watermarked.

gigel82 9mo ago

Reposting a comment I made on an earlier thread on this. We need to be super careful with how legislation around this is passed and implemented. As it currently stands, I can totally see this as a backdoor to surveillance and government overreach. If social media platforms are required by law to categorize content as AI generated, this means they need to check with the public "AI generation" providers. And since there is no agreed upon (public) standard for imperceptible watermarks hashing that means the content (image, video, audio) in its entirety needs to be uploaded to the various providers to check if it's AI generated. Yes, it sounds crazy, but that's the plan; imagine every image you post on Facebook/X/Reddit/Whatsapp/whatever gets uploaded to Google / Microsoft / OpenAI / UnnamedGovernmentEntity / etc. to "check if it's AI". That's what the current law in Korea and the upcoming laws in California and EU (for August 2026) require :(

manbash 9mo ago

It's nice that they explain the "what" (...it is doing) but not the "why". Who is going to use it and for what reasons? Also, if it's essentially a sort of metadata, can't the output generated image be replicated (e.g. screenshot) and thus stripped of any such data?

ainch 9mo ago
I've heard of journalists using it to try and figure out whether images sent by sources were generated. In their Nano Banana 2 release blogpost, Google mentioned that SynthID has been used ~20 million times, so there's clearly some interest in identifying AI-generated images.

ekjhgkejhgk 9mo ago

Is there a paper for this?

deleted 9mo ago

[deleted]

omgmo 9mo ago

What about spoofing a SynthID false positive for a real image or video? Who can arbitrate what is true? I think that AI service providers should have safeguards and encoded attribution. This solution helps when people lazily share things with friends or on social media I suppose, rather than stopping motivated bad actors. The only way to actually implement this I think would be to ban all local models, and to have the service providers store perceptual hashes all generated images and video. It feels like the cat's out of the bag already though (for images at least).

dang 9mo ago

Related: Remove/Bypass Google's SynthID AI Watermark - https://news.ycombinator.com/item?id=46692023 https://news.ycombinator.com/item?id=46692023 - Jan 2026 (1 comment) SynthID – A tool to watermark and identify content generated through AI - https://news.ycombinator.com/item?id=45071677 https://news.ycombinator.com/item?id=45071677 - Aug 2025 (83 comments) SynthID Detector – a new portal to help identify AI-generated content - https://news.ycombinator.com/item?id=44045946 https://news.ycombinator.com/item?id=44045946 - May 2025 (1 comment)

mediumsmart 9mo ago

Excellent. Everything without the wartmark is real then. Too easy.