Can Google SynthID Be Removed? What Diffusion Tests Show

Updated 25 July 2026: A community proof of concept reports that diffusion-based regeneration can produce images in which Google's public verifier no longer detects SynthID. Separate research supports the broader finding that regeneration can disrupt several image-watermark schemes. However, this does not prove that every SynthID trace is erased, that the method works universally, or that it has been independently reproduced by Josh.

This article is specifically about invisible watermarks in AI-generated images. It does not assess Google's separate uses of SynthID for text, audio or video.

The careful answer to whether Google SynthID can be removed is therefore: its detectability can apparently be degraded under some conditions, but the available evidence does not establish complete, universal removal.

What Google SynthID does to AI-generated images

Google DeepMind describes SynthID as an invisible watermark embedded in AI-generated content. Unlike a visible logo, it is designed to survive ordinary changes while remaining imperceptible to people viewing the image.

The watermark gives a compatible detector another signal for assessing whether content came from a supported AI system. Google's public Gemini verification feature is currently framed around recognising supported images generated or edited using Google's own AI tools. It is not a universal detector for every synthetic image on the internet.

Scale matters here. Google's published SynthID-Image paper says that more than ten billion images and video frames had been watermarked at the time of publication. The same paper discusses explicit threat models and makes an important admission: perfect security is impossible.

That is not evidence that SynthID is useless. It is a realistic description of watermarking as an adversarial problem. A watermark must remain detectable after benign edits, while someone deliberately trying to disrupt it can make far more aggressive changes.

A missed detection is not proof of total removal

Much of the confusion comes from treating three different claims as if they mean the same thing:

1. A detector did not find a watermark. A particular check returned no positive result for a particular image.
2. The watermark signal was degraded. Processing weakened the embedded signal enough to reduce reliable recovery.
3. Every trace was erased. No detector, including internal or future forensic systems, could recover any meaningful evidence.

A failed public verification supports the first claim. It may be consistent with the second. On its own, it does not prove the third.

Google's own Gemini verification guidance says that repeated edits can make a watermark no longer detectable. That wording is significant. "Not detectable" describes the outcome of the available verification process, not necessarily the complete absence of any residual statistical signal.

What diffusion regeneration changes

A diffusion model generates or reconstructs an image through a process that progressively removes noise. When used for regeneration, it does not simply edit the original pixels like a basic crop or colour adjustment. It can rebuild visual content into a new pixel arrangement that remains perceptually similar.

This creates a difficult test for invisible watermarks. If the watermark depends on carefully distributed patterns within the original image, regeneration may preserve the subject, composition and broad appearance while disturbing those patterns.

A 2025 research preprint found that diffusion regeneration reduced watermark recoverability in HiDDeN, StegaStamp, TrustMark, VINE and a classic spread-spectrum scheme while preserving perceptual content. It did not test SynthID, so it supports a general vulnerability class, not universal removal from Google's production system.

The evidence ladder for SynthID removal claims

The most useful way to assess this question is to rank the available evidence rather than looking for a simple yes or no.

1. Google's product documentation and research paper

Google confirms that SynthID is an invisible watermark, that its public verification covers supported Google AI content, and that repeated editing can make detection fail. Its paper also recognises that perfect watermark security is impossible.

This is authoritative evidence about the system's intended design and stated limits. It does not independently validate a specific bypass.

2. Independent diffusion-regeneration research

The preprint supports a credible technical explanation for missed detection after regeneration. Because it did not test SynthID, it cannot establish removal from Google's production system.

3. The community proof of concept

The Synthid-Bypass repository reports bypass results and now presents a V2 workflow with comparison artefacts. It also acknowledges practical limitations involving GPU resources, tooling and image quality.

Those artefacts make the claim inspectable, but the repository remains community evidence rather than a vendor-independent benchmark. Josh did not independently reproduce the reported bypass, and the available evidence does not show that it works consistently across a representative collection of SynthID images.

Why provenance needs more than one signal

Invisible watermarks are useful because they can remain associated with an image after ordinary sharing or after metadata disappears. They are still only one part of a stronger provenance system.

C2PA Content Credentials take a different approach. C2PA defines cryptographically signed records that can describe provenance and edit history. This metadata can carry more context than a binary watermark result, although its preservation depends on websites, applications and export tools retaining it.

The two signals are therefore complementary:

• Invisible watermarks can provide a persistent signal within image data, but sufficiently disruptive processing may weaken detection.
• Content Credentials can provide richer provenance and editing context, but metadata may be removed or lost through an unsupported toolchain.

OpenAI now reflects this layered approach. Its official guidance says images generated with ChatGPT, Codex and its API include both C2PA metadata and SynthID watermarks. OpenAI also warns that finding no signal may mean metadata was stripped or the watermark was degraded, rather than proving that the image was not AI-generated.

What UK organisations should take from the tests

UK publishers, creators and businesses should not treat a single watermark check as a final verdict. A positive result can be useful evidence of supported AI provenance. A negative result is much weaker and should not be presented as proof that an image is authentic.

For higher-risk decisions, provenance should be assessed alongside source history, retained originals, signed credentials, editorial records and visual or contextual inconsistencies. My guide to spotting deepfakes and rebuilding trust online explains why layered verification is more reliable than searching for one technical giveaway.

Creators should also keep provenance separate from copyright. A watermark may indicate that a supported AI tool was involved, but it does not settle ownership, permission or lawful reuse. Those issues are covered in more detail in what UK creators need to know about AI images, video and copyright.

There is a governance lesson too. Vendors can build useful authenticity systems, but claims about robustness need external testing and carefully defined standards. That balance between developer responsibility and independent scrutiny is central to the wider question of who should define AI safety.

The defensible answer on SynthID removal

Diffusion regeneration can disrupt invisible image watermarks, and a community proof of concept reports that Google's public verifier can miss SynthID after such processing. Google's own documentation accepts that repeated edits may make the watermark undetectable.

What has not been demonstrated is universal, complete and irreversible removal from every SynthID-protected image. The sound conclusion is narrower: detection can fail, watermark recoverability can be degraded, and no single negative check should be mistaken for proof that every trace is gone.