AI Content Watermarking and Provenance (Offense/Defense + Strategy)

Bottom line in one sentence:Invisible AI watermarks are a "provenance tool for honest users", not an "ironclad anti-forgery guarantee". People with signal processing capabilities can remove them without any loss of image quality. Products that make AI content should not treat "whether content carries a watermark" as a hard basis for compliance or risk control.

First, build the mental model: what is an invisible AI watermark (using SynthID as an example)

Google stamps an invisible seal on images generated by Gemini —not a visible logo in the bottom-right corner, but a specific pattern directly blended into the pixel values. It is invisible to the naked eye, but Google's detector can immediately tell "this is AI-generated" when it scans the image.

Everyday analogy: it is like writing a secret message on paper with colorless fluorescent ink — invisible under normal conditions, it only appears under ultraviolet light.

Technically, SynthID uses resolution-dependent carrier frequencies + fixed phase: for all images produced by the same model, the watermark is locked to the same set of frequencies and the same phase. This "fixed" property is precisely its fatal weakness — fixed = patterned = can be statistically reverse-engineered.

Essence of the cat-and-mouse game: watermarks whose patterns can be derived via spectral analysis vs. signal processing

This is the most important judgment to remember in the entire article. The project github.com/aloshdenny/reverse-SynthID proves that:

As long as a watermark is a deterministic pattern of "fixed frequency + fixed phase", it can absolutely be statistically extracted and removed using pure signal processing, without any access to Google's internal encoder/decoder.

It works in two stages —first reverse-engineer to find the watermark, then attack to remove it.

Stage 1: Reverse-engineering to find the watermark (phase consistency is the primary weapon)

Stack a batch (~250) of Gemini images and perform spectral analysis to find "things that are consistent across images":

• Phase consistency: after performing FFT on each image, treat the phase as a complex number e^{iφ} and accumulate it.
  • Natural photos: the phase of each image is random → when stacked together they cancel each other out → approaching 0.
  • Watermark frequency bins: every image is locked to the same phase → in-phase superposition → approaching 1.

Everyday analogy: 250 people clapping randomly = sounds like noise (cancellation); but if some of those 250 people clap precisely locked to the same beat, you can immediately pick out that beat from the noise.The watermark is exactly that artificial beat that gets "heard".

Auxiliary methods (cross-validation to rule out coincidence): LSB bit planes, wavelet denoising residuals, DCT coefficients, cross-image correlation.

The output is a .npz codebook: for each "model × resolution" tier, three maps are stored — average magnitude, consistent phase, and consistency. This is the fingerprint database of the watermark.

Stage 2: Removing the watermark (V3 pure frequency domain → V4 seven-step combination attack)

V4's design philosophy is critical:It does not brute-force remove the watermark; instead, it applies a mild version of each "user operation that Gemini's own documentation states will cause detection failure", stopping each step at the sweet spot where it "just evades detection without harming image quality" (each step has a PSNR gate; if quality drops too much, it automatically rolls back). The seven steps:

1. VAE round-trip — re-encode using Stable Diffusion, pull the image back to the "natural image manifold", and erase the mid-frequency watermark band
2. Elastic deformation ⭐ — apply an independent sub-pixel shift to each ~64px neighborhood. Globally it looks like natural perspective, but the position of every carrier is offset, so the detector cannot perform phase consensus aggregation. The author calls this "simulating collage fragmentation", which directly hits the self-admitted Achilles' heel of Gemini
3. Geometric combination (slight rotation + scaling)
4. Scale squeezing (downsample then upsample) — targets the "resize failure" case
5. Slight color and contrast adjustment — targets the "color adjustment failure" case
6. Residual phase FFT subtraction — with amplitude mag_cap capping, to prevent over-subtraction
7. JPEG compression chain + noise + bilateral filtering — targets the "recompression failure" case

⭐ Elastic deformation is V4's deciding move: it turns the known Gemini defect that "collages destroy watermarks" into a version that is imperceptible to the naked eye.

Local real-world testing and verification (2026-05-31)

To avoid relying solely on the author's claims, the core steps were run locally (lightweight dependencies installed, did not install torch+diffusers, because the VAE step requires a GPU and downloading several hundred MB of model):

Honest boundary: what can be proven = "the watermark objectively exists + it can be subtracted losslessly"; what cannot be proven = "after subtraction it can truly fool Google's detector". The author claims the latter succeeded on two models, but there is no local oracle to reproduce it.

Two pitfalls (don't repeat them next time you reproduce):

• The values stored in the consistency field cons in the codebook are accumulated values (maximum ≈ reference image count 253), not 0–1. Getting normalization wrong will chop off the entire spectrum, crashing PSNR to 6.7.
• The crude method of directly zeroing out an image's own frequency components will delete the image content along with it. The real method is to use the codebook's magnitude + phase to reconstruct a complex estimate of the watermark, then subtract that small portion with amplitude capping — that is exactly why mag_cap amplitude capping exists.

So, how should products making AI content set strategy

Map the offense and defense sides to their roles, and the conclusions are completely different:

If you are the party that "wants to label your own content" (proactive provenance)

• Watermarks are suitable for provenance for honest users: normal users will not remove them, and watermarks can help you prove "this is/is not generated by our AI".
• But they cannot serve as legal-grade ironclad evidence or the sole anti-forgery measure — a slightly motivated adversary (even a single script) can remove them.
• Takeaway: pixel-level watermarks = single point of failure. They must be layered with other signals — accounts, timestamps, server-side generation logs, C2PA metadata signatures (Content Credentials, an open standard that records "who, with what tool, generated it when").

If you are the party that "uses third-party models to produce images and worries about being blocked by platform watermarks" (the labeled party)

• Current situation is actually favorable: the AI detection/watermarking path itself is fragile and prone to false positives, so it is very hard for platforms to use it for precise hard bans.
• Normal post-processing is enough to weaken fragile watermarks — editing, transcoding, adding subtitles, compression (VAE re-encoding / resize / recompression) naturally destroy watermarks, no dedicated "watermark removal" action is required.
• Do not proactively remove watermarks: once platform rules define "removing watermarks" itself as a violation, the risk escalates from a technical problem to an account/compliance problem.
• A more stable approach is proactively labeling content as "AI-generated" + adding C2PA metadata, shifting from "passively being detected" to "proactive compliance".

One-sentence decision point (for PMs)

Any plan that bets product compliance/risk control on "the watermark must be present / must be verifiable" must keep a plan B. The direction of watermarks that are truly hard to remove is "random per image + deeply bound to image content", but that sacrifices robustness — so this is a cat-and-mouse game with no perfect solution.