Last week we discussed SynthID and how it watermarks AI-generated content so specific detectors can identify it. Today I wanted to discuss a GitHub project by aloshdenny that claims to confuse Gemini’s SynthID image detector. I think its an interesting piece of akin to cracking software security by reverse engineering. Lets discuss how something like this can be done.
SynthID has an invisible image watermark that’s fundamentally a weak signal hidden inside pixels. In a normal mountain or portrait image, that signal is buried under texture, edges and color variation. So the method’s first move is to simplify the input. It uses plain Gemini images, like near-white or near-black frames. When the image content is almost flat, repeated hidden structure becomes easier to isolate by enhancing contrast and saturation. You can then amplify the residual, which means studying tiny pixel variation that should ideally stay invisible.
So now you have look at the image from the frequency domain PoV. An FFT views an image as slow and fast spatial patterns instead of only pixel values. If the watermark has repeated structure, it may show up as carrier-like energy at certain frequencies. Based on experimentation, these patterns change with resolution of created, and that phase consistency across simple images helps separate watermark-like signal from normal image content. That is the core idea.
The removal side is based on the same idea. Once they have isolated watermark-related frequency patterns, they apply small image transformations and spectral adjustments designed to weaken those patterns while keeping the image visually similar. This can reduce detector confidence. Its like adding noise to a pattern so that detector cant detect it accurately. These are for image creations, similar breaking patterns emerge for AI generated text too.
Google has disputed these claims, so I would not call this a full crack. Still, it is an interesting example of how AI watermarking is becoming a signal-processing challenge as much as an AI one. I think watermarking and watermark stress-testing will become an hot research area.
