How SynthID Works: Embedding, Detection, and Its Limits

Most explanations of how SynthID works place the watermark inside the diffusion model, written into the latent representation during the denoising steps. Google’s own 2025 paper describes something different: an encoder applied to the finished image, in pixel space, after generation. That distinction changes what you should expect the mark to survive, and it explains why two incompatible accounts have circulated side by side for years.

How SynthID embeds the watermark

The watermark is added after the image exists, not during the sampling loop that produced it. The SynthID-Image paper defines the system as a pair of functions: an encoder that writes an imperceptible mark into an image, and a decoder that reads it back out as a signed score. Google states the position plainly. The watermark “is applied on top of the AI-generated content using an encoder, not as part of the generation process.”

That choice has a price, and the paper names it. Post-hoc watermarking is “inherently lossy,” meaning the encoder measurably touches the pixels it marks, and it adds compute on top of generation. The trade is portability: an encoder that works on finished images is not tied to one generator, which is how the same system reached over ten billion images and video frames across Google’s services.

Text works nothing like this. SynthID for text biases token selection through a scheme called Tournament Sampling, so everything below applies to images only.

Why pixel space and latent space keep getting confused

Both accounts trace back to real Google wording. The SynthID product page says the mark “is added the moment content is created,” which reads naturally as an in-model step, and for years no public architecture document contradicted that reading. The 2025 paper is the first place Google spells out where the encoder actually sits.

The gap between pixel space and latent space is not cosmetic. A mark written into the latent representation would be welded to one generator, while a post-hoc encoder can be pointed at any finished image. It also sets expectations correctly: an invisible watermark applied to output pixels is subject to whatever later touches those pixels.

How SynthID detection works

Detection is a threshold decision, not a lookup. The decoder produces a logit, and the system compares it against a detection threshold, with the paper evaluating at a 0.1% false positive rate operating point. It also uses conformal p-values, which the authors chose because they are “particularly scalable as they are non-parametric” and allow both error rates to be controlled at once.

Publicly, your options are narrower than the search results imply. The Gemini app is the one open route for Google-generated media: upload the file, then ask whether it was created or edited by Google AI. A hit returns that “all or part of the image or video was created or edited by Google’s AI models.”

Google’s dedicated SynthID Detector portal is not open access. The paper describes the verification service as “available to trusted testers,” and the portal runs an early-tester waitlist aimed at journalists and researchers. OpenAI runs a separate Verify tool covering its own images. Third-party sites advertising free SynthID checks have access to neither decoder.

The limits SynthID’s own paper describes

The paper is unusually direct about what the system cannot do. It states that “achieving perfect security is impossible,” framing the work as making attacks expensive rather than unachievable. It also concedes that invisibility resists measurement, calling quality “the most difficult requirement to properly evaluate in practice.”

One limitation lands close to home for anyone generating graphics rather than photographs. The authors name logos, gradients, pixel art and sparse drawings as corner-case content they had to identify and track throughout development, because flat regions give an encoder very little to hide in. A further operational wrinkle: multiple watermark versions eventually coexist in production, so detection has to recognize all of them.

Robustness to cropping and compression

Google trains for robustness against common edits and benchmarks it, but the paper publishes the evaluation set rather than a single survival number. The suite spans about 30 basic transformations, among them rotation, flips, brightness and contrast shifts, Gaussian and shot noise, blur, cropping and resize, format changes, JPEG and other lossy compression, Instagram filters, and emoji or text overlays.

The paper is also pointed about how others report these numbers. It argues prior work “often simulates results at such low FPRs based on assumptions” and that this “has been found to be misleading,” so it relies on large datasets and one consistent threshold across every transformation. Knowing how SynthID works in principle still will not tell you whether a particular edit defeated it, and we publish no survival claims of our own. For the visible layer, we do measure the cost — see what cropping actually costs.

The threat model, including forgery

Removal is only one of five attacks in the paper’s threat model. The others are forgery, model extraction, secret extraction, and payload manipulation. Forgery is the one most explainers skip: stamping a convincing watermark onto human-made content is a provenance failure in the opposite direction, and it corrodes the same trust the mark exists to build.

The listed defenses are adversarial training of the decoder, stochastic watermark generation to frustrate collusion, content-dependent watermarks that stop marks being swapped between images, and filtering of corner-case content such as uniform images.

2026 changed who uses SynthID

SynthID is no longer only Google’s. On May 19, 2026, OpenAI announced that images generated by ChatGPT, the OpenAI API and Codex carry both a C2PA manifest and a SynthID watermark, and that it had joined the C2PA steering committee alongside Adobe, Google, Meta and Microsoft.

OpenAI frames the two layers as complementary: “Watermarking can be more durable through transformations such as screenshots, while metadata can provide more information than a watermark alone.” Most SynthID explainers still online predate this change and describe the technology as Google-only. How the two layers differ is covered in SynthID vs C2PA.

One thing we could not establish: whether the Gemini app reads SynthID in OpenAI-generated images. Google’s help page says its detection covers content created by Google AI tools, and we found no source addressing the cross-vendor case. We flag it as unknown rather than guess.

What a negative result does not prove

No watermark found is not evidence of human origin. Google’s own help page spells out the ambiguity: a negative result means the file “wasn’t created or edited by Google AI, but it could have been created by other AI systems.” Detectors have limits, many generators embed nothing at all, and provenance metadata is easy to strip in transit. Understanding how SynthID works makes that ambiguity clearer, not smaller.

This site does not detect, remove, or alter SynthID, and makes no claim about detection results before or after any edit. Our tool addresses the one layer we can actually verify: the visible sparkle overlay, which we measured at 48×48 pixels with 96-pixel margins on specific Gemini export sizes.

FAQ