"No watermark detected" doesn't mean an image is real

Reality Defender AI Research · a controlled test of the SynthID detector and one other provider's watermark

No. A watermark detector is a presence test, and a null result from one isn't evidence of authenticity. When it returns nothing, that output is identical for a scrubbed synthetic image, for output from a generator that never participated in the scheme, and for a photograph taken on a camera.

We ran a controlled test to show what that looks like in practice. Every image in our reference set was confirmed watermark-positive by the verification tool its own provider publishes. After two publicly available removal workflows, not one still read as watermarked, including at the SynthID detector, which had cleared the Google-generated half minutes earlier.

SynthID is Google DeepMind's watermarking system for generated media. Per DeepMind's SynthID announcement in August 2023, it embeds an imperceptible signal into an image's pixel data, and a paired detector reads that signal back to indicate the content came from a Google model.

Three limits before anything else. Causality isn't fully isolated, so removal is established but the mechanism isn't. Fidelity varies with intervention strength, and I report it as a measured quantity rather than an impression. And this is a snapshot in time, against tool versions and detector versions that move.

What happens when watermarked images go through publicly available tools?

The reference set was 20 images. Ten from gpt-image, ten from Nano Banana 2. KYC-style synthetic selfies, chosen because identity verification is where a provenance signal would carry the most weight if it held. Every image passed its originating provider's own verification tool before anything touched it.

Three arms.

A0, original and untouched. The positive control. A0 must read watermark-positive at the verifier or the row is void. Without it you can't separate a removal from a verifier that was never reading the sample correctly to begin with. All 20 cleared A0.

A2, the intervention. Two variants. One paid hosted service, one free workflow run locally. Resolution preserved, no resize on the image path.

Across both arms, every image in the set stopped being detected by the same verifiers that had confirmed it. That includes the SynthID detector on the Nano Banana 2 half.

The cost asymmetry is the part I wouldn't have predicted. One path is a paid hosted service. You upload a file, you download a file, and no step asks anything of you. The other is a download, free, running entirely on a laptop with nothing leaving the machine, under two minutes per image on consumer hardware after a one-time setup cost. That's the finding with more weight than the removal itself.

Neither path is a single exploit that a version bump closes. Re-encoding and regeneration are general operations, not a bug in one tool. Expect the capability to persist.

What I can't tell you is which operation in the pipeline destroys the signal. We know it stops reading. Causality isn't isolated. Until it is, removal is established but the mechanism is not.

What does the SynthID detector actually detect?

Two different things get called a watermark, and the distinction does most of the work here.

One is a metadata assertion, an EXIF line reading, in effect, "Applied imperceptible SynthID watermark." That's a string in a file header. Stripping it takes milliseconds and no GPU. It's a label about a watermark, not a watermark.

The other is a signal in the pixel data itself. This is the primary way Google embeds SynthID into its generations, and it was a real advance, because it survives ordinary handling that destroys metadata. Cropping, screenshots, recompression, platform re-encoding. Readers conflate the two. So do some tools.

Our A1 arm exists partly for this reason. A decode-and-re-encode drops metadata and leaves pixel data intact, and watermark status held through it. The A2 result is about pixel space.

Granted, no watermarking scheme claims to be tamper-proof, and Google has never said otherwise. The problem isn't that SynthID under-delivers against what it promises.

The problem is structural. A watermark detector is a presence test. It has one class, present. It has no negative class and can't construct one. When it returns nothing, it can't distinguish absence-because-never-embedded from absence-because-degraded from absence-because-removed. And it returns the identical output for a photograph taken on a camera.

No watermark is the expected result for the entire authentic world.

3 reasons a missing watermark is not evidence of authenticity

The first two are structural. The third is active.

1. Most real images never carried one. Cameras, scanners, screenshots and every pre-2023 file return the same empty result as a scrubbed synthetic.
2. Ordinary handling degrades embedded signals. Recompression, resizing and platform pipelines strip provenance with no adversary involved.
3. Removal is accessible. In our set, a free local workflow cleared every sample in under two minutes per image on consumer hardware.

How does SynthID compare with C2PA content credentials?

They solve adjacent problems and share one assumption. Per the C2PA specification [TK: version and publication date], content credentials attach a signed manifest recording origin and edit history at the point of capture.

Both provenance systems assume a cooperative chain. That assumption holds in a newsroom. It fails in adversarial workflows.

In KYC and identity verification, the attacker has no incentive to preserve provenance. They strip metadata, re-encode, screenshot and re-upload, compress, route through platforms that rewrite files by default. When the goal is to defeat a system, the provenance signal is the first thing to go, often before anyone is even trying.

Provenance asks whether a file can prove where it came from. Detection asks whether the content looks generated. In an adversarial workflow, only the second question stays answerable.

What should a team do when a file carries no watermark?

Treat it as no information. Log it, don't score it. A null is not a pass.

Keep verification where the chain is cooperative. Watermarking and content credentials do real work in publishing, platform and archival workflows, and a positive read still tells you something true.

Don't let verification carry decisions it wasn't built to carry. Where a file arrives from someone with a reason to deceive, you need a system that reads the content rather than the file's claims about itself. Reality Defender is detection-only, on purpose.

The risky framing is no watermark, therefore real.

The evidence-based framing is no watermark, therefore unknown. Run the next check.

Objections

How does SynthID work? Google DeepMind embeds an imperceptible pattern into the pixel data of media generated by its models, and a paired detector reads that pattern back. Because the signal sits in the pixels rather than the metadata, it survives cropping, screenshots and recompression that would strip a file header. That's a real engineering achievement, and nothing here is a claim that it isn't.

Does SynthID work on images from other AI models? No. It reads content watermarked by Google's own systems. An image from another generator returns the same empty result as an untouched photograph. Google has never claimed otherwise, and the limit is inherent to any scheme that depends on the generator participating.

If there is no watermark, does that mean the image is real? No. A watermark detector is a presence test with no negative class. Absence is a null result, and it's the expected result for cameras, scanners and every unwatermarked generator.

Did every image in your set carry SynthID? No, only the 10 Nano Banana 2 images. The 10 gpt-image samples carried their own provider's provenance marking and were checked with that provider's tool. A fair reading is that this makes the SynthID finding a 10-image result rather than a 20-image one. It does. Both halves were verified positive before processing and failed the same verifiers after, which is the pattern worth reporting.

Should teams stop checking watermarks? A fair reading of this is that watermarking isn't worth the effort. I don't think that follows. Keep checking. A positive read is real evidence. Just stop treating the absence of one as evidence of anything.

Run as an internal red-team exercise against our own reference set, on tools anyone can access. We aren't publishing tool names, versions, the regeneration stack, calibration values or commands, and we won't. The point is where the boundary sits, not how to cross it.