Habr author bypasses SynthID on a 1536×1024 frame using ControlNet Canny

One frame at 1536 × 1024, two failed attempts and one trick that worked. A Habr author reports removing the signal that the detector uses to recognize SynthID, Google's watermark for AI-generated content. JPEG compression and noise did not help: the check kept returning "SynthID detected." The not detected verdict appeared only after the author blended into the original a strip of texture from a second version of the scene, generated with ControlNet Canny.

What was tried and why it didn't work

The test scene is simple: a girl by a pond, ducks in the grass, autumn trees. First, the author "crumpled" the file with ordinary processing. The result was always the same: the picture looked worse, and the mark stayed in place.

This fits SynthID's design. The signal is embedded in the pixels at the moment of generation and is built to survive compression, cropping and filters. Brute-force degradation of the file turned out to be the most obvious and weakest form of attack: you pay in quality and get nothing for it.

How the bypass worked

The method's logic is as follows. Canny extracts an edge map from the frame, and ControlNet uses that map to generate a new version of the scene with the same composition but different pixels. The author takes a strip of texture from this version and blends it into the original image. The mark is tied to the pixel structure of the original generation, and when part of that structure is replaced, the detector stops finding it. The content barely suffers. The grass changed; the ducks stayed ducks.

The idea is not new in essence. Academic papers have already shown that invisible watermarks on images can be removed with generative models that redraw the picture while preserving its meaning. Here the same principle is reduced to a cheap, practical workflow built on open tools.

Key details of the experiment:

• frame size: 1536 × 1024;
• did not work: JPEG compression and added noise;
• worked: a second version of the scene via ControlNet Canny, with a strip of texture blended into the original;
• result: a manual check returned not detected;
• side effect: the grass texture changed, while the objects in the scene were preserved.

What remains in question in this case

The evidence is still thin. It is one frame, one author and a manual check. There is no independent reproduction. It is unknown how the method behaves on portraits, interiors and text in the frame, how stable the result is across repeated runs, and what share of the image must be replaced before the detector gives up. A not detected verdict also does not mean the mark was never there: it says only that this particular detector did not find it.

Another point matters too. The author describes a bypass of the check, not a hack of the generation process itself. Google still has room to respond: strengthen the signal, spread it across frequencies and scales, and train the detector on such redrawn versions.

What editorial teams and platforms should do

The main takeaway in practice: the absence of a SynthID mark cannot be read as "shot by a human." It is only one weak signal among several. When checking questionable images, combine a watermark detector with cryptographic provenance metadata such as C2PA, reverse image search, and analysis of EXIF data and the context of publication. If material arrives without a file history and the watermark check shows "not detected," that is a reason to look for the source, not to close the question.

Platforms that build moderation on watermarks need a second line of defense: classifiers trained on redrawn images, and a provenance log on the upload side. A single detector is no longer enough for that.