---
title: "Open-Source Tool reverse-SynthID Strips Google DeepMind's Invisible Watermark From Gemini Images"
subtitle: "An independent researcher cracked Google's SynthID image watermark using only FFT and a Stable Diffusion VAE, bypassing the detector with visually lossless output"
url: "https://alphasignal.ai/news/open-source-tool-reverse-synthid-strips-google-deepmind-s-invisible-watermark"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-29T02:18:19.000Z"
updated: "2026-06-20T13:12:45.614Z"
type: "Repo"
topics:
  - "Security"
  - "Image"
subtopics:
  - "Red Teaming"
  - "Image Generation"
upvotes: 29
source_url: "https://github.com/aloshdenny/reverse-SynthID"
comments: 0
truncated: true
---

# Open-Source Tool reverse-SynthID Strips Google DeepMind's Invisible Watermark From Gemini Images

> An independent researcher cracked Google's SynthID image watermark using only FFT and a Stable Diffusion VAE, bypassing the detector with visually lossless output

[reverse-SynthID](https://github.com/aloshdenny/reverse-SynthID) is an open-source project that does exactly what its name suggests: it reverse-engineers, detects, and surgically removes the invisible watermark that Google DeepMind bakes into every image generated by Gemini. Built by independent researcher Alosh Denny using nothing but signal processing and a borrowed Stable Diffusion VAE, the project has accumulated over 4,400 GitHub stars and sparked a serious conversation about whether invisible watermarks can ever be a reliable foundation for AI content provenance.

## What SynthID actually does

SynthID is Google DeepMind's AI authentication technology that embeds invisible signals into content during generation, working across images, video, audio, and text. Unlike metadata-based watermarks that strip on re-encode, SynthID embeds the mark directly into the content itself , modulating pixel patterns in images, waveforms in audio, and token probabilities in text , producing a signal that survives most ordinary editing, transcoding, and compression. 

Google created SynthID to watermark AI-generated media, and by Google I/O the company reported over 10 billion pieces of content had been watermarked with the technology. The stakes got higher when OpenAI announced it would incorporate SynthID into images generated through ChatGPT and the OpenAI API, with SynthID providing an invisible watermarking layer that complements C2PA metadata-based approaches. In short: SynthID was becoming the industry's default provenance layer.

## The structural flaw that made this possible

The attack works because of one critical design choice: SynthID embeds carrier frequencies at different absolute positions depending on image resolution, and the watermark's phase template is identical across all images from the same Gemini model. That last part is the vulnerability. If the watermark phase is the same in every single image, you can average it out.

Researchers reverse-engineered SynthID by collecting images from Gemini, averaging their noise patterns, isolating the consistent frequency-domain signature, and inverting it , achieving a 91% phase coherence drop and 75% carrier energy reduction. The green channel carries the strongest watermark signal, and at 1024x1024 resolution, the top carrier bins show 100% phase coherence across all reference images. Once you know exactly where the watermark lives in frequency space, you can subtract it.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [aloshdenny/reverse-SynthID — GitHub](https://github.com/aloshdenny/reverse-SynthID)
- [How to Reverse SynthID (legally) — Aloshdenny on Medium](https://medium.com/@aloshdenny/how-to-reverse-synthid-legally-feafb1d85da2)
- [SynthID — Google DeepMind](https://deepmind.google/models/synthid/)
- [Advancing content provenance — OpenAI](https://openai.com/index/advancing-content-provenance/)
- [SynthID reverse-engineering — Lemma Critical Brief No.011](https://lemma.frame00.com/critical/briefs/011-synthid-watermark-reverse-engineering/)