Discussion: Theorised fixes and how they will be broken again

[S-Mahoney]

Hi, interesting work.. Thought it might be worth having an open discussion on this topic.

I presume there will be a scramble to fix this, so heres some theorycrafting.

• I initially thought maybe treating the watermark as a reseting auth key might be a solution, Broken by figuring out the pattern change via time series repetition prior to generation of the actual image you want.
• Forcing the model to never generate pure black / pure white images - Broken by then switching to a fixed simple image request (ie; generate green circle of specific values, specific dimensions on pure white background.

It would be interesting to know whether this embedding is done via a postprocessing step or if it is baked into the model itself, the latter may be more of an issue for them.

Also do we think generated audio could also be de-watermarked (if it is in fact watermarked) in this manner too, using blank audio generations?

[aloshdenny]

Love the questions! These really made me scratch my head and go over the original SynthID paper once again: https://arxiv.org/html/2510.09263v1

Deepmind uses randomness as the defense mechanism here: the idea being that if the watermark payload or key varies per image/user/session, an attacker can't build a universal codebook. You're correct in stating that time-series analysis of sequential generations could break naive rotation, but if the key space is large enough (which I believe it is - ginormously large) and tied to something the attacker can't observe (like a server-side secret), it becomes significantly harder. This is actually the strongest fix Google could deploy and probably already is in flagship versions of SynthID.

Oh and SynthID is post-hoc model-independent i.e. the watermark is applied on top of AI-generated content using an encoder. The reference image attack works on any generated image if you average enough of them. The "green circle" approach would still work, just with more images needed before phase coherence emerges clearly.

If it (SynthID) were baked into the diffusion model itself (say, steering the latent sampling process like tree-ring watermarking), the signal would be far more entangled with image content and much harder to isolate. So ironically, Google's choice of post-hoc for scalability and flexibility is part of what made it reversible.

Yes, all content generated by Gemini - audio, video, text, images - are watermarked by SynthID. I'm working on that separately here: https://github.com/aloshdenny/reverse-SynthID-text