SynthID and the visible watermark are not the same thing

Two marks, two jobs

The visible mark is a label. It sits in the corner, it is obvious, and its job is to tell a person looking at the image that a model made it. It is a piece of artwork composited on top of the finished picture, which is what makes it removable: it was added last and it can be taken off last.

SynthID is a different proposition. It is DeepMind's imperceptible watermarking system, and rather than sitting on top of the content it is embedded within it, as a pattern of adjustments too small for a person to notice. Its job is not to inform a viewer. Its job is to let a detector determine, later and automatically, whether a piece of media came from a Google model.

Google has applied SynthID across its generative output: images, video from Veo, audio from its music models, and text from Gemini through a related token-selection technique. The scale is substantial, running into billions of pieces of content.

What this tool touches

This tool removes the visible mark. That is the whole of what it does.

It does this by inverting the alpha composite that applied the logo, which is arithmetic over a small region in one corner of the frame. It has no model of SynthID, no detector for it, and no mechanism that would act on it. The imperceptible signal lives in the picture content, and the picture content is exactly what the method is designed to leave alone.

Why SynthID is hard to disturb by accident

An imperceptible watermark is only useful if it survives what people normally do to files. A signal that vanished the first time someone saved a JPEG would detect nothing in practice. So these systems are built for robustness against the ordinary transformations that media goes through on its way around the internet.

Google describes SynthID as designed to remain detectable through common modifications: compression, resizing, cropping, colour adjustment, filters, screenshots. The signal is spread across the content rather than concentrated anywhere, so removing part of the image removes part of the signal and leaves the rest.

That robustness is not unlimited, and Google does not claim it is. Heavy enough degradation will eventually defeat any watermark, for the plain reason that a signal embedded in the content cannot survive the destruction of the content. But the degradation required tends to be severe enough to be obvious in the result, which is rather the point.

Precisely how robust it is against a determined adversary is an open research question rather than a settled fact, and published work has probed the limits of imperceptible watermarking schemes in general. Treat strong claims in either direction with suspicion.

Does re-encoding a video affect it?

This comes up because cleaning a video requires decoding every frame and encoding them again, which is a lossy round trip. The honest answer is that a re-encode is exactly the kind of transformation the signal is built to survive, and that this tool neither attempts to remove it nor measures whether it has been weakened.

What the tool does do is keep the re-encode as light as it reasonably can, because quality loss is bad for its own sake. That work is covered in measuring what a browser re-encode costs you. The motivation there is fidelity, not provenance.

How to check a file yourself

Google runs a SynthID Detector portal for verifying whether its models produced a given piece of media, and it has been rolling access out to journalists, researchers and media professionals. Gemini itself can also be asked directly whether an image it is shown carries the signal.

There is a broader standard in this area too. C2PA, the Coalition for Content Provenance and Authenticity, defines cryptographically signed metadata that records how a file was made and what has happened to it since. It solves a related problem in a different way: C2PA metadata is a manifest attached to the file, so it is tamper-evident but also strippable, where an embedded signal is neither. The two approaches are complementary rather than competing, and Google participates in both.

Why the distinction is worth keeping straight

People approach a watermark remover with two quite different situations in mind, and the distinction determines which one they are actually in.

The first is wanting your own generated work to look finished. You made an image, you are going to use it in something you are building, and a logo in the corner is in the way. Removing the visible label serves that, and the provenance signal continuing to exist costs you nothing, because you were not trying to conceal anything.

The second is wanting generated media to pass as something it is not. Removing the visible label does not accomplish that, because the embedded signal remains and detection does not depend on the corner logo. It also runs into the terms you agreed to when you generated the file, and into the reason the marks exist at all.

That second situation is worth thinking about on its own terms rather than as a technical footnote, and it is the subject of removing a watermark from your own work, and where the line is.