Six Rounds of Adversarial Surgery on Google's AI Watermark

What it does

This project reverse-engineers Google’s SynthID, the invisible watermark embedded in every Gemini-generated image. Using only signal processing and spectral analysis—no access to Google’s proprietary encoder or decoder—it builds a detector that spots the watermark with 90% accuracy and a multi-stage bypass that strips it while keeping images visually lossless. The latest V4 pipeline targets multiple Gemini models and resolutions through a data-driven spectral codebook.

The interesting bit

The breakthrough came from treating Gemini’s own published failure-mode list as an attack specification: the authors simulate “collage fragmentation” with a smooth elastic warp field that fragments the watermark’s spatial phase consensus without visible distortion. They also use cross-color phase consensus across six solid backgrounds to isolate the watermark from image content, since true watermark carriers are content-independent while real image data phase-scrambles across colors.

Key highlights

• Discovered the watermark’s resolution-dependent carrier frequency structure by amplifying residuals from pure-white Gemini images
• V4 codebook supports per-model profiles for gemini-3.1-flash-image-preview and nano-banana-pro-preview across multiple resolutions
• Round 06 stacks a 7-stage pipeline—VAE round-trip, elastic deformation, geometric warp, resize-squeeze, color nudge, FFT subtraction, and JPEG re-encoding—each stage gated by a PSNR floor with automatic rollback
• Achieves confirmed bypass of the live Gemini app detector on both supported models; V3 bypass maintains 43+ dB PSNR
• Includes a human-in-the-loop calibration loop that updates carrier_weights based on manual Gemini-app detection feedback

Caveats

• The V4 bypass trades V3’s 43+ dB pixel-level PSNR for 18–24 dB because elastic warp displaces pixels rather than altering them, though outputs are described as visually lossless
• The workflow requires uploading images to the Gemini app and feeding back detection results manually to tune the calibration loop

Verdict

Security researchers and adversarial-ML engineers will find this a meticulous case study in watermark evasion; photographers or casual users looking for a one-click scrubber should look elsewhere given the manual calibration overhead and multi-stage pipeline.