Every image generated by GPT-Image-2 (ChatGPT's image model) carries SynthID — an imperceptible provenance watermark. By design it survives JPEG, resizing, cropping, blur, and noise; you can't see it, and simple signal-processing filters can't find it.
So we asked one narrow, honest question:
If the signal is really in there, can a small model learn to see it?
Turns out — yes, and cheaply. We fine-tuned a 3-model CNN ensemble (ResNet-18 + ResNet-34 + EfficientNet-B0) on a few hundred watermarked/clean image pairs, on a single Apple-silicon laptop, in minutes. It separates the two classes at ~0.97 validation accuracy — and the part we didn't expect: its verdicts match OpenAI's own public verifier even on watermark-altering techniques it never saw during training.
A small network, trained on a handful of examples, generalizes to an internet-scale watermark.
This is a detectability study and a content-provenance tool: it helps you identify whether an image likely came from GPT-Image-2. It is not a watermark remover — there is no evasion or stripping code in this repo, by design. Detection supports provenance; that's the side of the line this project lives on.
- 🧠 Tiny + fast — fine-tunes pretrained CNNs in minutes on a laptop (MPS/CUDA/CPU).
- 🎯 0.97 separation — clean vs. watermarked, on held-out validation.
- 🔬 Generalizes — agrees with the official detector on regeneration methods it never trained on.
- 🛡️ Anti-shortcut by design — shared augmentation forces the net onto the watermark, not incidental quality/texture cues (we include the probe that proves it).
- 🪟 Honest failure modes — we document exactly where a learned probe breaks (out-of-distribution inputs and adversarial perturbations fool it). Detectability has limits.
| Stage | What happens |
|---|---|
| Data | Pairs of (watermarked, clean) images of the same content, kept in the same train/val split so the model can't memorize content. Clean = a watermark-free counterpart (e.g. a light image-to-image regeneration pass). |
| Augmentation | Heavy shared augmentation (random JPEG, blur, color-jitter, crops) applied to both classes. The watermark survives these by design, while incidental quality differences get washed out — so the net is forced to learn the watermark signal itself. |
| Model | Fine-tune pretrained ResNet-18 / ResNet-34 / EfficientNet-B0 (1-logit head, BCE loss). |
| Probe | A confound check: degrade watermarked images in watermark-preserving ways (heavy JPEG, mild warp) and confirm the net still flags them. If degradation alone flips it, it learned a shortcut. Ours passes. |
pip install -r requirements.txt
# Score an image: probability it carries the GPT-Image-2 watermark
python detect.py path/to/image.png
# Train your own ensemble on ./dataset/{positives,negatives}/
python train.py resnet18
python train.py resnet34
python train.py efficientnet_b0
# Verify the model learned the watermark (not a shortcut)
python probe.py resnet18Pretrained weights for all three models live in weights/.
dataset/positives/ — images straight from GPT-Image-2 (watermarked).
dataset/negatives/ — watermark-free counterparts of the same images. The cleanest way to
get a paired negative is a light image-to-image regeneration of each positive (a model
re-synthesizing the pixels drops the off-manifold watermark while keeping the content). Match
filenames between the two folders. Raw datasets are not shipped here.
clean positives P=0.98 detected 100% ✓
clean negatives P=0.01 detected 0% ✓
positives + heavy JPEG detected 100% ✓ (survived compression)
positives + spatial warp detected 100% ✓ (survived desync)
class separation (pos−neg): 0.97
A learned probe is a surrogate, not the official decoder. It is reliable on in-distribution images and standard regenerations, but it can be fooled by out-of-distribution inputs (aggressive frequency filtering) and adversarial perturbations crafted against it — in those cases it under-detects. We surface these failure modes deliberately; the interesting science is as much about where detectability breaks as where it works.
PolyForm Noncommercial License 1.0.0 — free for research, education, and other non-commercial use; commercial use is not permitted. See LICENSE.
Built as an exploration of learned watermark detectability. SynthID is a trademark of Google DeepMind; this project is independent and for research/provenance purposes.