Google announced this past spring that its tools have already generated over 100 billion AI images and videos. To combat this flood of synthetic media, the company expanded partnerships with OpenAI, Runway, and Nvidia to deploy its SynthID watermarking technology across the industry.

While metadata systems like the Coalition for Content Provenance and Authenticity (C2PA) are cryptographically secure, they are trivially easy to strip through simple edits or screenshots. SynthID takes a different approach by hiding encoded data directly within image pixels or audio waveforms.

According to Google DeepMind scientist Pushmeet Kohli, the development team explicitly assumed the technology would face attacks. They engineered the system to remain robust against standard transformations like filters and cropping.

Testing the Limits of Invisible Watermarks

Putting Google's durability claims to the test reveals that SynthID actually walks the walk. When subjected to a Python script simulating rapid data loss through hundreds of generations of compression and resizing, the watermark stubbornly persists.

Even after 300 generations of aggressive compression that turns crisp original files into barely recognizable, blurry blobs, Gemini's SynthID detector successfully identifies the AI origin. The system even successfully detects the watermark on screenshots taken of the degraded images.

The technology does eventually hit a breaking point, though. Combining massive compression with aggressive cropping ultimately defeats the system.

After 300 compression cycles, removing 20 percent of the image border renders the watermark undetectable. A larger 50 percent crop breaks the detection slightly earlier, at around 250 compression iterations.

While researchers note that the original SynthID paper acknowledges the system is not intended to withstand dedicated adversarial attacks, current attempts to hack the watermark remain unconfirmed. Kohli states that his team has been unable to replicate any supposed workarounds claimed online.

Fragmented Ecosystems and Access Limits

Despite its technical durability, systemic implementation issues severely limit SynthID's practical utility for the average user. Google intentionally restricts access to prevent bad actors from reverse-engineering the detection system.

There is currently no public API or standalone webpage for detection. Users must ask Google's Gemini to verify an image, and the system imposes a strict limit of approximately 10 image checks per day.

To make matters worse, the actual deployment across major tech companies remains a disorganized mess. While OpenAI and Runway utilize the underlying SynthID technology, their actual watermarks are entirely different. Google’s detector cannot recognize OpenAI’s watermark, and OpenAI’s system cannot read Google’s.

A Google spokesperson confirmed the company is aware of this suboptimal experience and is actively collaborating with industry partners to create a more unified verification ecosystem.

The Open-Source Loophole

The most significant barrier to watermarking as a definitive solution is the widespread availability of unmonitored AI models. Centralized guardrails implemented by Big Tech cannot regulate software running independently on personal hardware.

Adam Rose, a fellow and senior advisor at Starling Lab, notes that the major threat extends well beyond corporate platforms. "The problem is people who can run their own models, who can do things on their own computers," Rose stated.

Currently, countless open-source models generate images with no invisible watermarks or C2PA metadata attached. As labeled AI content becomes more common, the danger is that the public will falsely assume any unlabeled image is authentic. Until the industry can enforce standards on locally hosted open-source models, bad actors will always have a free pass to flood the internet with untraceable fakes.