Developer claims to have cracked Google DeepMind's SynthID watermarking system

A developer going by Aloshdenny has published a GitHub repository with code that, he says, bypasses SynthID, Google DeepMind's hidden watermarking system for labeling AI-generated images. The author claims he learned to remove the watermarks from images or, conversely, to insert them into any image without Google's permission.

SynthID is a Google DeepMind technology built into Gemini and other company tools. It alters an image's pixels in ways the human eye cannot detect, leaving a digital "signature" that is supposed to survive compression, cropping and other manipulations. The goal is to make it possible to identify AI content long after publication. Google unveiled SynthID publicly in November 2023, and from 2024 watermarking began to be applied to text as well.

Aloshdenny described his method in a Medium post. He says the reverse engineering required neither neural networks nor privileged access to Google's infrastructure. It was enough to generate 200 images through Gemini and apply signal processing techniques. "If you're unemployed and average enough black AI images, the pattern just shows up on its own" is roughly how he describes his process.

The developer published the code on GitHub under an open license and deliberately stressed that the whole process is legal: no hacking, only analysis of publicly available images.

Google DeepMind responded cautiously. Company representatives said the described method is not a real break of SynthID. According to Google, Aloshdenny did not gain access to the marking algorithm itself and only learned to reproduce superficial statistical patterns that are not equivalent to the system's genuine signature. In other words, Google insists SynthID has not been compromised.

Still, the episode exposes a fundamental weakness in the very idea of watermarking AI content. If a lone developer with a few hundred images can guess the marking pattern, even partially, what stops well-funded teams from doing it an order of magnitude more effectively? Experts have long warned that any watermarking system built on statistical regularity in images is, in theory, vulnerable to such attacks.

The debate matters also because AI-content watermarks are seen as one of the key tools of future regulation. The European AI Act and a number of US bills provide for mandatory labeling of content generated by artificial intelligence. If such systems can be bypassed by a hobbyist with a laptop and spare time, their practical value as a regulatory tool is open to serious doubt.

How deeply he actually understood SynthID's architecture remains an open question: Google denies a break, and there has been no independent public review of Aloshdenny's code so far. But the mere fact that building such a tool proved possible with minimal resources is already a serious signal for the whole industry.