Post-hoc or ad-hoc？

[llCurious]

hi @allenk nice work. I am also studying how SynthID adds watermarks to images.

Recently, I read the paper: https://arxiv.org/pdf/2510.09263 and it clearly states that the used algorithm is post-hoc and model-independent. It seems to be contradictory to your research findings. I also noticed some discussions on how to erase synthid watermarks (claimed to be overlays).

Do you think the current deployed algorithm is different from that described in the white paper?

[allenk]

Hi @llCurious,

First of all, thank you for sharing this paper. This is exactly the kind of feedback that improves the quality of this research, and I really appreciate you bringing it up.

You are right: after reading "SynthID-Image: Image watermarking at internet scale" (Gowal et al., 2025), I agree that my original
mechanism description needs to be revised.

When I wrote my SynthID research note, this paper was not available to me. My analysis was based on black-box experiments, reverse engineering, and inference from related watermarking work. In hindsight, I was mixing concepts from different SynthID modalities:

• SynthID-Text appears to be ad-hoc / generation-time, based on token sampling.
• SynthID-Image, according to this paper, is post-hoc and model-independent.
• SynthID-Audio / Video may use different designs again, and public technical details are still limited.

So yes , the paper corrects an important part of my original explanation.

One clarification I would make is that "SynthID" seems to be more of a family / brand of watermarking technologies rather than a single unified algorithm. That distinction explains why public discussions can become confusing when people compare SynthID-Text, SynthID-Image, and SynthID-Video as if they were implemented the same way.

Regarding your question:

Do you think the current deployed algorithm is different from that
described in the white paper?

My current view: I don't have enough evidence to claim that Gemini's production deployment is different from the paper. The paper states that SynthID-Image has been deployed across Google's services, while the detailed benchmark focuses on SynthID-O, described as an external variant available through partnerships. So I would be careful and say:

• The production Gemini system is likely in the same general family.
• But I cannot confirm whether it is identical to SynthID-O.
• Without an independent verifier, it is difficult to distinguish architecture differences from configuration / threshold / model-version differences.

Also, to avoid confusion: my tool primarily targets the visible Gemini watermark overlay. SynthID is the invisible provenance
watermark, which is a separate mechanism.

That said, I still think some of the experimental observations in my original report remain useful, even though the theoretical explanation needs correction. For example, the paper itself discusses robustness against common image transformations and identifies stronger transformation / regeneration-style attacks as relevant threat-model concerns. My experiments should therefore be reframed as empirical observations about possible attack behavior, not as proof of the internal mechanism.

Based on this discussion, I plan to:

1. Update report/synthid_research.md to correctly describe SynthID-Image as a post-hoc, model-independent encoder-decoder approach.
2. Add a correction notice to the Medium article.
3. Cite Gowal et al. as the authoritative technical reference.
4. Reframe my experimental results as black-box observations rather than mechanism discovery.

Thanks again for the thoughtful correction. This is genuinely helpful.

If you are also researching SynthID, I would be very interested to hear whether you have found:

• any independent verification method,
• evidence about differences between SynthID-O and Gemini production deployment,
• or additional attack vectors worth testing.

[llCurious]

Thx for your quick response! Really appreciate your effort on this research topic.
I am currently focusing on how invisible watermark is embedded into image/videos, and hope to find discussions on the technical details.

Regarding details of SynthID, unfortunately, I also fail to find any paper/blog that discuss details of SynthID-Image/Video officially. Yet I found some discussions on Github: https://github.com/aloshdenny/reverse-SynthID