Developer claims to have hacked Google DeepMind's SynthID watermarking system

A developer under the nickname Aloshdenny published a repository on GitHub with code that, according to him, allows bypassing SynthID — Google DeepMind's hidden watermarking system for marking AI-generated images. The author claims he learned how to remove watermarks from pictures or, conversely, insert them into any images without Google's permission. SynthID is a development by Google DeepMind, embedded in Gemini and other company tools.

The technology imperceptibly modifies image pixels, leaving a digital "signature" that should survive compression, cropping, and other manipulations. The goal is to enable identification of AI-generated content even long after publication. In November 2023, Google presented SynthID publicly, and since 2024, watermarks have been applied to text as well.

Aloshdenny shared details of his method in a Medium publication. According to him, reverse engineering didn't require neural networks or closed access to Google's infrastructure. It was enough to generate 200 images through Gemini and apply signal processing methods.

"If you're unemployed and average out enough black AI pictures, the pattern will reveal itself on its own" — roughly how he describes his process. The developer published the code on GitHub under an open license and deliberately emphasized that the entire process is legal: no hacking, just analysis of publicly available images. Google DeepMind responded cautiously: company representatives claimed that the described method is not a real hack of SynthID.

According to Google, Aloshdenny didn't gain access to the actual marking algorithm but merely learned to reproduce superficial statistical patterns that are not equivalent to the system's genuine signature. In other words, Google insists: SynthID is not compromised. Nevertheless, this episode exposes a fundamental vulnerability in the very idea of watermarks for AI content.

If a solo developer with a few hundred pictures can at least partially guess the marking pattern, what would prevent well-funded teams from doing this orders of magnitude more effectively? Experts have long warned: any watermarking system built on statistical regularity in images is theoretically vulnerable to such attacks. The discussion is instructive also because AI-content watermarks are perceived as one of the key tools for future regulation.

The European AI Act and several US legislative proposals require mandatory marking of AI-generated content. If such systems can be bypassed by an amateur with a laptop and free time, their practical value as a regulatory tool raises serious doubts. The question of how deeply someone managed to understand SynthID's architecture remains open — Google denies a hack, and there has been no independent public expertise of Aloshdenny's code yet.

But the fact itself that developing such a tool proved possible with minimal resources is already a serious signal for the entire industry.