This paper presents a reverse-engineering effort into Google's SynthID watermarking system, which is embedded in images generated by Google Gemini. The project aims to discover, detect, and surgically remove this AI watermark using signal processing and spectral analysis, without access to the proprietary encoder/decoder.

The core findings reveal that the SynthID watermark is resolution-dependent, meaning carrier frequencies are embedded at different absolute positions depending on the image resolution. For instance, at 1024x1024 resolution, top carriers are found at low-frequency coordinates like (9, 9) and (5, 5), while at 1536x2816, they appear at much higher frequencies such as (768, 704) and (672, 1056). Despite this resolution dependency, the watermark exhibits phase consistency: its phase template is identical across all images from the same Gemini model, with cross-image phase coherence at carriers exceeding 99.5%, particularly strong in the green channel.

The project developed three generations of bypass techniques, with V3 (Multi-resolution Spectral Bypass) being the most effective. Unlike brute-force methods like JPEG compression or noise injection, V3 leverages a SpectralCodebook, a collection of per-resolution watermark fingerprints. This codebook allows for surgical, frequency-bin-level removal of the watermark.

The V3 Pipeline operates as follows:

1. Input Image (any resolution): The process begins with an RGB image.
2. Codebook Resolution Selection: The system queries the SpectralCodebook with the image's dimensions (\(H, W\)).
   • If an exact match for the resolution profile is found in the codebook, it proceeds to a fast path of FFT-domain subtraction.
   • If no exact match exists, it falls back to a spatial-domain resize of the input image to the closest known resolution in the codebook, followed by subtraction.
3. Multi-pass Iterative Subtraction: The subtraction is performed iteratively, typically in an aggressive, moderate, then gentle schedule to catch residual watermark energy.
4. Anti-alias → Output: Finally, an anti-aliasing step is applied before outputting the processed image.

The SpectralCodebook is central to V3. It stores resolution-specific profiles, including carrier positions, magnitudes, and phases.

• 1024x1024 Profile: This profile is built from pure black and pure white reference images generated by Gemini. Black images (where the watermark forms almost the entire pixel content) and white images (inverted for cross-validation) are used to identify carriers. Cross-validation is performed using black/white agreement, calculated as \(|\cos(\text{phase\_diff})|\), to filter out generation biases and confirm true carriers.
• 1536x2816 Profile: This profile is derived from a dataset of diverse watermarked content images. The assumption is that image content averages out across multiple images, allowing the fixed watermark signal (primarily in its phase coherence) to be extracted. Watermark magnitude is estimated as avg_mag \(\times \text{coherence}^2\).

The V3 Subtraction Strategy is a direct known-signal subtraction method, not a Wiener filter. The confidence in each frequency bin's watermark presence is determined by:
$\text{Confidence} = \text{phase\_consistency} \times \text{cross\_validation\_agreement}$
Per-bin subtraction is then performed using the formula:
$\text{Per-bin subtraction} = \text{wm\_magnitude} \times \text{Confidence} \times \text{removal\_fraction} \times \text{channel\_weight}$
where:

• wm_magnitude is the estimated watermark magnitude at that bin.
• removal_fraction controls the strength of subtraction.
• channel_weight accounts for SynthID's embedding strength per channel (Green=1.0, Red=0.85, Blue=0.70).
• DC exclusion with a soft ramp suppresses low-frequency biases. A safety cap ensures subtraction never exceeds 90-95% of the image's energy at any bin.

The V3 bypass achieves significant results on 88 Gemini images (1536x2816 resolution) with aggressive strength:

• PSNR: 43.5 dB
• SSIM: 0.997
• Carrier energy drop: 75.8%
• Phase coherence drop (top-5 carriers): 91.4%

The quality across resolutions remains high, with 44.9 dB PSNR for exact 1536x2816 matches and 40.6 dB for fallback resolutions like 768x1024.

The reverse-engineered understanding of SynthID's internal workings suggests:

• Encoder: Selects resolution-dependent carrier frequencies, assigns fixed phase values to each carrier, and uses a neural encoder to add a learned imperceptible noise pattern spread across the spectrum.
• Decoder: Extracts noise residual (e.g., via wavelet denoising), performs an FFT, checks the phase at known carrier frequencies, and if phases match expected values, identifies the image as watermarked.

The project provides Python modules for building the SpectralCodebook, running the SynthIDBypass, and detecting watermarks using RobustSynthIDExtractor with a reported 90% accuracy.