AI-generated media is becoming hard to separate from ordinary Internet content, not just because it can look convincing, but because there is so much of it. Google’s SynthID is one answer to that problem: an invisible watermark meant to signal when content was created or edited by AI.
Testing described by Ars Technica suggests SynthID can be difficult to remove through normal sharing, editing, and compression. But the same testing also shows why labeling AI content is unlikely to be a complete solution to misinformation.
The scale problem behind AI watermarking
The basic challenge is volume. Starling Lab, a research collaboration from Stanford University and the University of Southern California, estimates that humanity took until 1975—149 years after the invention of the camera—to create 1.5 billion images. Generative AI reached the same figure in 18 months.
Google said this spring at I/O that its tools had produced more than 100 billion AI images and videos in just a couple of years. That number only covers Google’s tools, while AI content also comes from many other sources.
This is why provenance systems matter. If AI images, videos, and audio clips circulate at massive scale, people need some way to evaluate whether a file was generated, edited, or captured from the real world. SynthID is designed to help with that judgment by placing a signal inside the media itself.
How SynthID differs from metadata labels
The source article describes two main approaches to AI labeling: invisible watermarks such as SynthID and metadata systems such as the Coalition for Content Provenance and Authenticity, or C2PA. Google uses both for AI content, but they work differently.
C2PA is cryptographically secure, which means it is built so that the credential cannot simply be forged. Its weakness is persistence. The source notes that editing and saving an image, or even taking a screenshot, can remove C2PA metadata.
SynthID takes another route. Instead of attaching information around the file, it encodes the watermark into the pixels of an image or video, or into the waveform of an audio clip. That matters because files passed around the Internet are often compressed, resized, cropped, screenshotted, or altered by apps and platforms.
Google DeepMind scientist Pushmeet Kohli told Ars that the team expected attacks and tested the watermark against transformations such as filters and cropping. The goal was to make the detector keep working even after ordinary edits.
What the testing found
Ars tested SynthID by using the Python Pillow library to simulate repeated Internet sharing. The test applied random compression and resizing values, then used each output image as the basis for the next round.
The test covered two image types: one generated fully from scratch by Nano Banana Pro, and one original photo edited by AI. Both included SynthID. The article notes that metadata editing did not hide the watermark.
After hundreds of simulated generations, the images became badly degraded. Even after 300 generations of compression and resizing, SynthID still worked on the full-frame images. The source also says a screenshot of the full image still produced a SynthID label because the relevant pixels carried over into the new file.
That result is important for everyday use. Many AI labels fail when a file is saved again, shared again, or stripped of metadata. SynthID appears more durable under those ordinary forms of wear.
Where the watermark starts to fail
SynthID is not indestructible. The same testing found that cropping could eventually break detection once the image had already been heavily degraded.
After 300 compression generations, cropping 20 percent from the test images made SynthID undetectable. A larger 50 percent crop could break the watermark earlier, at around 250 image compression iterations.
That does not mean a casual crop immediately defeats SynthID in every case. It does show a practical boundary: because the signal is distributed through the image, removing enough of the image can reduce what the detector has left to read.
The source also points to another cautionary example. Meta released its Content Seal AI watermark, but Reuters found that simply cropping the images a bit would often eliminate the watermark. SynthID performed better in the Ars test, but one strong system does not prove that all invisible AI watermarks will be reliable.
Why strong labels still do not solve misinformation
The larger issue is that watermarks are a tool, not a final answer. Google’s original paper says SynthID is not intended to withstand adversarial attacks. The source also reports that some people have claimed to hack SynthID, though Ars could not confirm those claims through testing, and Kohli said Google’s team could not replicate the supposed workarounds.
If SynthID becomes more widely used by companies including OpenAI, Runway, Nvidia, and others, it also becomes a more valuable target. The source notes that between Google and OpenAI, much of the consumer AI space is now using the technology.
Google has plans to respond to hacks, but the company is keeping many details private. Kohli said, “We can, of course, change the watermark,” while adding that Google cannot publicly disclose many mitigations because they help protect the system.
Access is another limitation. There is no API or public SynthID detector webpage described in the source. A user who wants to check an image has to ask Gemini to call the verifier.
Google also limits SynthID checks to “approximately 10 image checks” per day, according to the source. Ars found that the verifier could lock out a user even faster when many similar-looking images were uploaded. That makes the system less useful for anyone who needs to evaluate more than a small number of suspicious images in a day.
The takeaway is narrow but important. SynthID can be robust against common degradation, and that makes it more serious than a fragile metadata label. But AI trust will still depend on availability, resistance to future attacks, and whether people can actually verify the content they encounter.