Reverse Engineering Google's SynthID Watermark

In this project, I delve into the intricacies of Google's SynthID watermarking system, which invisibly marks images generated by Google Gemini. Through advanced signal processing and spectral analysis, I have reverse-engineered this system without access to Google's proprietary tools. The watermark's carrier frequency structure varies with image resolution, and I've built a detector that identifies these watermarks with 90% accuracy.

## Key Innovations

I've developed a multi-resolution spectral bypass, known as V3, which significantly reduces carrier energy and phase coherence across various image resolutions. This bypass uses a SpectralCodebook—a collection of watermark fingerprints for different resolutions stored in a single file. This allows for precise frequency-bin-level removal of the watermark, unlike traditional methods like JPEG compression or noise injection.

## Contributions and Community Involvement

I am actively seeking contributors to expand the codebook by generating pure black and white images using Nano Banana Pro. These images are crucial for improving the detection and removal of watermarks across different resolutions. Even a small batch of 150-200 images can enhance the system's robustness.

## Technical Insights

The SynthID watermark is resolution-dependent, embedding carrier frequencies at different positions based on the image size. For instance, a codebook built at 1024x1024 cannot directly remove a watermark from a 1536x2816 image. The watermark's phase template remains consistent across images from the same Gemini model, with the green channel carrying the strongest signal.

## Bypass Architecture

The V3 bypass pipeline involves a multi-pass iterative subtraction process that adapts to the image resolution. It begins with a fast path for exact matches and a fallback path for spatial-domain resizing. The process includes anti-aliasing to ensure the output image quality remains high.

## Results and Performance

Testing on 88 Gemini images shows that the V3 bypass achieves a PSNR of 43.5 dB and a phase coherence drop of over 91% for the top-5 carriers. The system performs well across different resolutions, maintaining high image quality and watermark removal effectiveness.

## Getting Started

To use this project, clone the repository, set up a virtual environment, and install the necessary dependencies. Build the multi-resolution codebook using provided scripts, and run the V3 bypass on any image resolution. The project structure is well-organized, with modules for extraction, detection, and analysis.

## Ethical Considerations

This project is intended for research and educational purposes, focusing on watermarking robustness and security analysis of AI-generated content. It should not be used to misrepresent AI-generated images as human-created.