Google’s SynthID watermark withstands heavy edits but cannot stop AI deception

Google’s SynthID watermark can remain detectable after severe image compression, resizing and screenshots, but it cannot reliably distinguish authentic media from the growing volume of unlabeled AI content.

Ryan Whitwam writes for Ars Technica that tests of images generated and edited with Google AI found SynthID still detectable after 300 rounds of simulated sharing and recompression. The invisible marker is embedded in image pixels, rather than stored only in metadata, allowing it to survive changes that can easily remove file-based labels.

The test also identified a limit. Cropping about 20 percent from heavily compressed images removed the detectable watermark. Google does not describe SynthID as invulnerable to deliberate attacks. The company says it has measures to update the system if attackers develop effective bypasses.

Verification remains fragmented

SynthID faces practical limits beyond technical resilience. Google restricts its verification tool through Gemini, with roughly 10 image checks per day. That makes it harder for users to investigate a large number of suspicious posts.

Watermark systems are also not fully interoperable. OpenAI and Runway use SynthID technology, but their detectors do not necessarily recognize Google-marked content, or the other way around. A user may therefore need to know which service created an image before selecting a verification tool.

The larger challenge is coverage. Open models and many smaller AI services can create images and video without any watermark or provenance record. An absent label cannot prove that content is genuine.

Whitwam’s report points to C2PA, a cryptographic provenance standard, as a potentially stronger complement. Its metadata can document how a file was captured and edited, although it can be stripped by screenshots or re-saving files. In an internet flooded with synthetic media, proving the origin of trusted material may matter more than trying to label every false item.