4 ms·
Reverse engineering Gemini's SynthID detection
- andrewmcwatters 6mo ago> We're actively collecting pure black and pure white images generated by Nano Banana Pro to improve multi-resolution watermark extraction. Oh hey, neat. I mentioned this specific method of extracting SynthID a while back.[1] Glad to see someone take it up. [1]: https://news.ycombinator.com/item?id=47169146#47169767 https://news.ycombinator.com/item?id=47169146#47169767
- raphman 6mo agoFWIW, I had Nano Banana create pure white/black images in February, and there was no recognizable watermark in them (all pixels really were #ffffff / #000000 IIRC). Meta: your comment was marked [dead], like a few other constructive comments I saw in recent days. Not sure why.
- andrewmcwatters 6mo agoI suspect they strip the SynthID for these specific cases to prevent exfiltration of the steganography. I appreciate you pointing it out, but this account is banned. Thank you for vouching though!
- pattilupone 6mo agoI tried it with Nano Banana 2 through the API just now, and it was content filtering me on both white and black images.
- deleted 6mo ago[deleted]
- refulgentis 6mo agoIt says not to use these tools to misrepresent AI-generated content as human-created. But the project is a watermark removal tool with a pip-installable CLI and strength settings named "aggressive" and "maximum." Calling this research while shipping turnkey watermark stripping is trying to have it both ways in a way that's uncomfortable to read. The README itself reads like unedited AI output with several layers of history baked in. - V1 and V2 appear in tables and diagrams but are never explained. V3 gets a pipeline diagram that hand-waves its fallback path. - The same information is restated three times across Overview, Architecture, and Technical Deep Dive. ~1600 words padded to feel like a paper without the rigor. - Five badges, 4 made up, for a project with 88 test images, no CI, and no test suite. "Detection Rate: 90%" has no methodology behind it. "License: Research" links nowhere and isn't a license. - No before/after images, anywhere, for a project whose core claim is imperceptible modification. - Code examples use two different import styles. One will throw an ImportError. - No versioning. If Google changes SynthID tomorrow, nothing tells you the codebook is stale. The underlying observations about resolution-dependent carriers and cross-image phase consistency are interesting. The packaging undermines them.
- jonshariat 6mo agoAgreed. This isn't punk this just helps the bad guys. Society needs to know what content is AI generated and what is not.
- SR2Z 6mo agoIf that's the case, society will inevitably be disappointed. There are already ten million AI image generators, the overwhelming majority of which do not watermark their outputs. Google auto-inserting them is nice, but ultimately this kind of tool to remove them will inevitably be widespread.
- recursive 6mo agoThis was never going to be a reliable way to do it. It's basically the evil bit . It only works for as long as everyone is making a good-faith effort to follow the convention. But the bad guys do not do that.
- charcircuit 6mo agoIt really doesn't need such capability. Nor does it need the capability to know what human generated it either.
- deleted 6mo ago[deleted]
- deleted 6mo ago[deleted]
- kelsey98765431 6mo agoif you downscale then upscale it removes the watermark
- armanj 6mo agokinda ironic you can clearly see signs of Claude, as it shows misaligning table walls in the readme doc
- rafram 6mo agoParenthesized, comma-separated lists with no “and” is an even stronger tell. Claude loves those.
- LiamPowell 6mo agoI also use those extensively, they just flow better, especially if you have an "and" in the surrounding sentence.
- TacticalCoder 6mo ago> kinda ironic you can clearly see signs of Claude, as it shows misaligning table walls in the readme doc This one is such a gigantic clusterfuck... They're mimicking ASCII tables using Unicode chars of varying length and, at times, there's also an off-by-one error. But the model (not Claude, but the model underneath it) is capable of generating ASCII tables. P.S: I saw the future... The year is 2037 and we've got Unicode tables still not properly aligned.
- dgellow 6mo agoI mean, just reading the readme content it is pretty obvious it is Claude
- huflungdung 6mo ago[dead]
- khernandezrt 6mo agoOk i get that eventually someone was gonna do this but why would we want to purposely remove one of the only ways of detecting if an image is ai generated or not...?
- deleted 6mo ago[deleted]
- lokar 6mo agoIt was always going to be available to some people, but not everyone would know or believe that. Now they will.
- subscribed 6mo agoMore likely than not it would be used to deanonymise the author. So it's a "no" by default.
- pixl97 6mo agoMuch like every other thing in the tech world. He'll, it's why AI will kill us off eventually. If a system depends on every person on the planet not doing one particular thing or the system breaks, expect the system to break quickly. This is an especially common trope in software. If someone can make software that does something you consider bad, it will happen. Also it's software. There is no difference between it being available to one person or a million. The moment the software exists and can be copied an unbound number of times.
- raincole 6mo agoUh... you can do this pretty easily since day 1. Just use Stable Diffusion with a low denoising strength. This repo presents an even less destructive way[0], but it has always been very easy to hide that an image is generated by Nano Banana. [0]: if it does what it claims to do. I didn't verify. Given how much AI writing in the README my hunch is that this doesn't work better than simple denoising.
- akersten 6mo agoFundamentally it's a fuzzy signal and people shouldn't rely on it. The general public does not understand Boolean logic (oh, so the SynthID is not there, therefore this image is real). The sooner AI watermarking faces its deserved farcical demise the better. Also something about how AI is not special and we haven't added or needed invisible watermarks for other ways media can be manipulated deceptively since time immemorial, but that's less of a practical argument and more of a philosophical one.
- M4v3R 6mo agoSynthID is visible in some generations (areas with a lot of edges, or text), I wonder if this would make them look better.
- thecupisblue 6mo agoAnd it gets more and more visible in every edit if you use Nano Banana for the edits.
- sodacanner 6mo agoI don't understand all the handwringing. If it's this easy to remove SynthID from an AI-generated image then it wasn't a good solution in the first place.
- rustyhancock 6mo agoYes. This kind of project needs aggressive red teaming, it leads to better products and we need excellent products in this space. This project proves what red teaming was in place wasn't good enough.
- raincole 6mo agoThere is no solution. I don't know why people discuss this subject as if there is a technical solution. As if there are fairies or souls hidden in the pixels that help us tell what is AI generated and what is not.
- sodacanner 6mo agoSure, and things like this help drive home that SynthID wasn't a solution at all.
- DonsDiscountGas 6mo agoIf you want to make an AI generated image but don't want other people to know that it's AI, the most obvious solution is to not use Gemini. Synth ID is watermarking. It's only ever going to be useful to good actors, who want an AI generated image and aren't trying to hide the fact that it's AI generated.
- dummydummy1234 6mo agoNever underestimate that people are lazy.
- levocardia 6mo agoSure there is a solution, you are just looking at it the wrong way. Make non-AI images provably unaltered with signed keys from the device (e.g. the camera) that took it.
- doctorpangloss 6mo agoOkay... this tests its own ability to remove the watermark against its own detector. It doesn't test against Gemini's SynthID app. So it does nothing...
- Tiberium 6mo agoSeems like a very low-quality AI-assisted research repo, and it doesn't even properly test against Google's own SynthID detector. It's not hard at all (with some LLM assistance, for example) to reverse-engineer network requests to be able to do SynthID detection without a browser instance or Gemini access, and then you'd have a ground truth.
- ddtaylor 6mo agoI read a lot of comments on HN that say something is not hard, yet don't provide a POC of their own or link to research they have knowledge of. I also read a lot of comments on HN that start by attacking the source of the information, such as saying it was AI assisted, instead of the actual merits of the work. The HN community is becoming curmudgeonly and using AI tooling as the justification.
- love2read 6mo agobecoming? under most posts that even in passing mention using AI tools there are multiple people raising their noses talking about how much they hate AI use
- pixl97 6mo agoEh, just the same people that have been killing tech forums and closing posts on stack overflow for like ever.
- theamk 6mo agoThat's how life generally works. If your friend tells you, "I went to that new movie yesterday. It was very boring, I fell asleep midway." - then you either listen to his advice or don't. You don't ask your friend if they ever made a movie of their own.. And you don't ask for a 3rd party research of that movie's either. As for AI specifically.. life is too short to read all the interesting pages already, and AI just makes is so much worse. - AI is verbose in general, so you are spending a lot of time reading and not getting much new facts out of that. - Heavy AI use often means that author has little idea about the topic themselves, and thus cannot engage in comments. Since discussion with authors are often most interesting part of HN, that makes submission less interesting. And yes, it is possible to use AI assistance to create nice and concise report on the topics you can happily talk about, but then this would not be labeled as "AI".
- coppsilgold 6mo agoInserting an undetectable 1-bit watermark into a multi megapixel image is not particularly difficult. If you assume competence from Google, they probably have two different watermarks. A sloppy one they offer an online oracle for and one they keep in reserve for themselves (and law enforcement requests). Also given that it's Google we are dealing with here, they probably save every single image generated (or at least its neural hash) and tie it to your account in their database.
- JoshBlythe 6mo agoThe dual-watermark theory makes alot of sense for defensive engineering. You always assume your outer layer will be broken and so keep a second layer that isn't publicly testable. Same as defence in depth anywhere else. I'm curious - as new models are being built constantly and they're naturally non-deterministic, do you think it's possible for end users to prove that?
- coppsilgold 6mo ago> I'm curious - as new models are being built constantly and they're naturally non-deterministic, do you think it's possible for end users to prove that? How is the model relevant? The models are proprietary and you never see any of its outputs that haven't been watermarked.
- matthias_m_dev 6mo ago[dead]
- m00dy 6mo agoIt's not really hard as it looks https://deepwalker.xyz/blog/bypassing-synthid-in-gemini-photos https://deepwalker.xyz/blog/bypassing-synthid-in-gemini-phot...
- techpulselab 6mo ago[dead]
- stevomacdaddy 6mo agoIm confident i saw the watermark in use today, in nano banana, i copied the image from chrome into slack. the resulting upload was a black square with a red dot. and not the image i had generated.
- funcantor 6mo agoI remember experiencing something similar. But then iirc I noticed you can draw on a screenshot and I think i was copying the random dots I made by accidental clicks... You sure it wasnt this?
- jiusanzhou 6mo ago[dead]
- neuzhou 6mo ago[dead]
- enesz 6mo ago[dead]