Someone just broke Google's SynthID watermark. Here's what that means for AI media proof.

A researcher named Alosh Denny published a method in March 2026 that strips Google's SynthID invisible watermark out of AI-generated images, and the numbers are what make this a structural break rather than a curiosity: 91 percent of the watermark energy removed, PSNR 43.5 dB, SSIM 0.997. At an SSIM of 0.997, the cleaned image is visually indistinguishable from the watermarked original to a human eye. The code sits on GitHub, the paper is up on Medium, and the technique works against SynthID-Image, the system Google ships by default on Imagen, Veo, and Gemini's image generation (reverse-SynthID GitHub repo, Hacker Factor analysis, GIGAZINE coverage).

Enterprise tech press covered it, but the story never landed the way it should have. Google has not publicly shipped a SynthID v2 fix, has not paused the watermark, and has not issued a customer advisory to the enterprise Vertex AI customers who pay for it to be applied to their Gemini outputs. The watermark keeps running at internet scale, unchanged, while it sits publicly broken.

So if a vendor has told you SynthID gives you adversary-proof evidence that an image came out of a Google model, that claim is no longer true. What follows is what actually broke, what still works, and the engineering-honest answer for buyers who need to ship AI media provenance before the December 2, 2026 grace-period deadline.

The full provenance stack (C2PA, FRE 707, EU AI Act Article 50) gets the deep treatment elsewhere; this is the engineering-analyst short take on the SynthID break specifically.

What Denny actually showed

Denny's method starts with a counter-intuitive observation: SynthID's "invisible noise" is not random. Most invisible watermark schemes work by adding a random-looking perturbation to the pixels that survives common transformations. SynthID's perturbation is structured, not random. It uses fixed carrier frequencies at constant phase.

The method:

1. Collect a large set of image pairs from Gemini's image generation system: the watermarked version and a reference of similar content generated separately. Denny used 123,000 pairs at 1024x1024 and 1536x2816.
2. Take the two-dimensional Fourier transform on the difference between the watermarked and reference frames.
3. The fixed-frequency, constant-phase signature surfaces statistically as more pairs are averaged.
4. Once the carrier pattern is identified, it can be subtracted from any new SynthID-watermarked image. Result: a cleaned image with 91 percent of the watermark energy removed and SSIM 0.997 (near-perfect fidelity).
5. Denny also trained a reverse detector that identifies the SynthID watermark with 90 percent accuracy, so an attacker can verify their cleaning worked.

The break is not a special-case attack. It is a structural break. SynthID uses a watermark whose signal is statistically identifiable once enough samples are averaged. The fix (if Google ships one) would require redesigning the watermark to use random carriers, not fixed ones. That is the difference between SynthID v1 and a hypothetical v2.

See Pasquale Pillitteri's technical write-up for the spectral-analysis details.

SynthID-Text is also broken

Less publicised but equally important. SynthID-Text was independently broken via paraphrasing attacks in 2025. Multiple research groups demonstrated that paraphrasing a SynthID-Text-watermarked LLM output through a different language model scrubs the watermark to below detectability. Reported scrub rates above 90 percent in some attack conditions (arXiv 2508.20228, ETH Zurich SRI Lab analysis).

This matters because SynthID-Text is what Google watermarks Gemini's text outputs with. Any organisation relying on SynthID-Text to detect AI-generated text in 2026 has been working with a tool that does not work against a paraphrasing-attack adversary.

And UnMarker breaks the rest of the field

A more general result from earlier in 2025 is the UnMarker universal attack from Andre Kassis and Urs Hengartner at the University of Waterloo (IEEE S&P 2025). UnMarker works on the spectral amplitudes of any watermarked image without needing detector feedback. Reported attack success: 79 percent on SynthID, plus successful defeats of Stable Signature, StegaStamp, Tree-Ring, HiDDeN, PTW, Yu1, Yu2. Runs on a single 40 GB A100 (arXiv 2405.08363, IEEE Spectrum coverage).

The Tree-Ring scheme, which the University of Maryland published as invariant to crops, rotations, and flips, was independently broken at USENIX Security 2025 by an attacker who only needs access to the publicly-available VAE used by the diffusion model (arXiv 2506.10502).

The pattern is clear. No current invisible watermark survives a determined adversary with modest compute.

What still works

SynthID and similar schemes still do some things well, and it is worth being honest about what. They defeat:

• The screenshot-and-repost casual attacker who does not know watermark forensics exists
• JPEG re-compression
• Mild cropping (depending on scheme)
• Format conversion
• Casual edits that do not regenerate the image

That is the consumer-grade misuse floor, and it is a real one: an unmodified SynthID-watermarked image circulating on Reddit, Threads, or Discord still registers as AI-generated to a SynthID detector, so Google's continued deployment is not pointless.

What it no longer defeats is any of the publicly-available attacks. The reverse-SynthID code sits on GitHub, the UnMarker code is described in detail in a peer-reviewed paper, and a determined attacker is roughly a $50 GPU rental and a few hours of work away from clean output.

What this means for AI media provenance

Four practical implications for buyers shipping AI media in 2026:

One. Stop treating any single watermark as a provenance system. Layer defences. C2PA Content Credentials in the file header. Invisible watermark in the pixels. Visible label on screen. Audit-trail entry in your DAM. Vendor warranty in the contract. Each layer fails to a different attack; the stack is the defence.

Two. Ask vendors which version of SynthID (or any other watermark) they are emitting. If a vendor sells you on "unbreakable invisible watermarking" today, they are either not aware of the public breaks or counting on you not being aware. Either way, that is a vendor risk signal.

Three. The EU AI Act Article 50(2) provider marking and watermarking obligation was postponed from August 2, 2026 to December 2, 2026 by the 2026 EU Digital Omnibus, while the other Article 50 transparency duties still apply from August 2, 2026. Either way, machine-readable provenance is still required. The publicly-broken status of SynthID does not change the obligation; it changes the strategy. Buyers should plan to satisfy Article 50(2) primarily through C2PA Content Credentials with a Durable Credentials path via cloud manifest store, supplemented by invisible watermarking as a secondary defence rather than a primary one. The European Commission published the finalised EU Code of Practice on Marking and Labelling on June 10, 2026, and adherence to it creates a presumption of compliance.

Four. The theoretical possibility of unbreakable watermarks exists. Christ, Gunn, and Zamir at CRYPTO 2024 proved that cryptographically-undetectable LLM watermarks exist in principle, based on one-way functions (arXiv 2306.09194). They are not yet deployed in production. The watermarking community is moving toward them. Buyers who plan provenance pipelines today should design for layered defences with the assumption that any specific watermark in their stack will be publicly broken within 12 months, and the resilience is in the layering.

What Google should do (and what they have not)

Google DeepMind has not publicly shipped a SynthID v2 fix. Five months on from the Denny break, and roughly two years after the UnMarker paper first went public, the watermark keeps running at internet scale as if the durability question had never been raised. If anything, deployment has only grown: Google's own May 19, 2026 update put the tally past 100 billion watermarked images and videos, plus 60,000 years of audio (Google blog), rolled out across Search, Gemini, Chrome, Pixel, Photos, and Cloud. Google has publicly disputed the 91 percent removal figure, arguing that real-world removal rates are lower, but it still has not shipped a documented SynthID v2 in response.

The technically correct response would be at minimum:

• A public engineering bulletin acknowledging the structural fix needed (random carriers, not fixed ones)
• A SynthID v2 specification with carrier randomisation, validated against the Denny method and UnMarker before deployment
• Customer-facing guidance to enterprise Vertex AI customers about the durability gap
• A clear roadmap for when v2 will replace v1 in Imagen / Veo / Gemini outputs

None of this has been published as of this piece. The C2PA Content Credentials layer Google also emits is not affected by the SynthID break (different layer of defence). Buyers should rely on the C2PA layer for machine-readable provenance and treat the SynthID layer as a casual-attacker filter rather than an adversary-proof signal.

The longer view

Three years running, the watermarking community has kept publishing "this scheme breaks under X attack" papers, and the pace is accelerating rather than slowing: WAVES (ICML 2024), UnMarker (IEEE S&P 2025), A Crack in the Bark (USENIX Security 2025), SoK Watermarking for AI Content (IEEE S&P 2025).

For a brand director, content marketing leader, or in-house counsel, the honest message is this. Assume any single watermark your AI provenance pipeline depends on today will be publicly broken within 12 months, so build for layered defences, document your good-faith compliance methodology, and adhere to the EU Code of Practice, finalised June 10, 2026. Ship with documented layered provenance in 2026 and you are operating correctly. Depend on a single watermark and assume it works, and you are accepting a risk you may not realise you are taking.

This piece will need a refresh the day a cryptographically-undetectable watermark reaches production at scale, and current literature puts that day roughly 18 to 24 months out. Until then, the layered posture is the engineering-honest one.

Keep reading

The deep version of the AI media provenance stack (C2PA in detail, FRE 707 status, Durable Content Credentials, vendor authentication state, and the run-up to the December 2 grace-period deadline) and the matching legal map get their own coverage elsewhere on this site. For the broader AI video stack, see AI video generation 2026 and the AI video tool comparison. If you need help designing a layered provenance pipeline before the grace period runs out, our Enterprise AI service builds C2PA, watermark, and audit-trail stacks on private infrastructure you control, or book a strategy call to walk one specific decision live.