---
created: 2026-08-08
github: https://github.com/rabbanitw/WAVES/tree/synthid-regen-kit
---
- [Thomas Mason](https://info.defcon.org/defcon34/people/67936 "Thomas Mason")
- [Tahseen Rabbani](https://info.defcon.org/defcon34/people/67916 "Tahseen Rabbani")

## Overview

The SynthID watermark was developed by Google to invisibly tag content generated by its models and agents (Nano Banana, Gemini, etc.). When asked to identify whether an image is AI-generated, Gemini will invoke a "Verify AI" tool to scan for the SynthID. We demonstrate two attack strategies to remove it. (1) The lesser-known regeneration attack of Zhao et al. 2023 removes SynthID identification by Gemini with 100% success rate on a held-out set of 104 photorealistic Nano-Banana images. (2) We build a surrogate detector using Apple's Pico-Banana-400K dataset. This dataset pairs Flickr images with a Nano-Banana edit, which automatically adds SynthID, thereby implicitly providing us with a large corpus of watermarked/clean image pairs which we use to fine-tune a pre-trained ResNet-18 into a SynthID discriminator. This surrogate detector can be used to test the presence of the watermark in an image in ~27.5 ms on a CPU, thereby allowing an adversary to rapidly test and optimize an attack. We demonstrate that the removal of the SynthID can induce hallucinations, whereby Gemini confidently makes assertions regarding its own simulated as if it were real. This, we propose, could have a variety of security implications, such as confused deputy attacks against agents, retrieval pipeline poisoning, and facial recognition bypasses. The full code, the test set, the pre-computed attack outputs, and the prompts used to generate every test image are released as a hands-on kit at [https://github.com/rabbanitw/WAVES/tree/synthid-regen-kit](https://github.com/rabbanitw/WAVES/tree/synthid-regen-kit)

## Notes

### Watermarks 101
- Watermarks are used to indicate the provenance of content
- Used as a stamp to know if it's real or generated
- The visible graphic/badge on an AI image isn't the watermark itself, just an indication that a watermark is used
- In-processing watermark: adds a key while the image is being generated
- "Post-hoc" method: applies the watermark afterward

### SynthID
- Google DeepMind product; a family of watermarks based on modality (text, image, speech)
- Is a post-hoc method
- Gemini has a SynthID checker

### Experiment
- Can we remove the SynthID?
- Tried:
	- Transformations: messing with colors (B&W), saturation, etc. — SynthID still detected it
	- Bordering: adding a border around the picture
	- Resizing
	- Rotating
	- Cropping
- Setup: used Nano Banana, a temp chat
- These simple methods weren't able to reliably remove a SynthID

### Technique 1: Screenshotting
- Taking a screenshot was a reliable bypass for SynthID
- Very simple method
- Screenshots are very common and would evade detection

### Technique 2: Regeneration
- Take an off-the-shelf diffusion model, add noise, then de-noise
	- Adding noise is the opposite step of the generation process, which normally removes noise to arrive at a clear image
- Used Stable Diffusion v1.4, N=10 steps
	- More steps drops the detection rate further, but introduces artifacts a human can detect
	- There's a tradeoff between steps and human vs. machine detection
- Detection dropped to 20%
- Testing yielded several interesting verbose errors, including portions of the system prompt

### Hallucination as a Byproduct
- When an image is AI-generated and the SynthID is removed, the model no longer knows it's probably not real
- The LLM won't be able to determine the exact location, but it's going to try since it thinks the image is real
- It changes the behavior of models and how they treat an image

### Building a SynthID Detector
- The real one from Google is a black box
- To do this we need pairs of images with and without watermarks, so the watermark signal can be learned
- Apple's Pico-Banana-400K dataset was used to build a discriminator to determine if a SynthID is present, using a convolutional neural network
	- Final test accuracy was 90%
- The pseudo-detector is more conservative than the real SynthID detector
- This works offline and doesn't feed your attacks to the system you're trying to fool

### Security Implications
- Google, OpenAI, ElevenLabs, Kakao use SynthID
- Proprietary watermarks can still be removed
- We assume there will be more improvements to the watermarks
- Off-the-shelf and older models make it possible to remove these watermarks
- Recommendations:
	- Use a standard
	- Open-source more components for more/better battle-testing
	- Defense in depth, paired with checks on metadata or secondary information
		- There's a metadata watermark standard emerging as well: C2PA
		- Use reasoning strategies to have the LLM look at the whole image to see if there are any obvious issues

### From the Repo
- Ships 104 SynthID-watermarked Nano-Banana images (512×512) with generation prompts, plus pre-rendered attacked versions at N=10/20/40/80 denoising steps, and 15 real/synthetic pairs from Pico-Banana-400K
- `regen/` implements the diffusive-regeneration attack with a custom resumable `ReSDPipeline`; `detector/` is the ResNet-18 surrogate classifier (89.8% accuracy)
- At N=80 steps, detection drops to 37.5% (from an 89.4% baseline) — deeper regeneration cracks the watermark further at the cost of more visible artifacts
- Surrogate detector runs in ~27.5 ms on a CPU, enabling fast local iteration before checking against the real deployed detector