What information is included in the metadata or SynthID? How many bits can be encoded in a SynthID?

Can it be used to create something like nutritional labels for synthetic content? 10% synthetic text, 30 synthetic images.

Your reality was 15% synthetic today (75% mega corp, 25% open-weight neocloud).

▲

big_toast 21 days ago | parent | next [-]

I guess the SynthID-Image paper from Oct 2025[0] was an encoder-decoder for which they tested checking a flag or a 136 bit payload in 512x512 images and the watermark's robustness after various transformations.

Presumably the deployed version is meaningfully different.

[0]:https://arxiv.org/html/2510.09263v1

▲

echelon 21 days ago | parent [-]

This is very similar to audiowmark

https://github.com/swesterfeld/audiowmark

You can stuff per-item database unique IDs, user IDs, geohashes, and other nefarious things inside.

We need to protest this LOUDLY.

Our devices are being locked down, we're having attestation and trusted computing forced on us, the internet all over the world is undergoing age verification with full ID verification.

Just because this is on "ai images" today doesn't mean it won't be on all images - screenshots, your camera reel, etc. - in the fullness of time.

This is scary.

These are the tools of 1984. They've been boiling the water slowly, but in the last year things have really started to pick up pace. Please push back. Loudly.

Everyone at Google and OpenAI working on this: WHAT THE FUCK ARE YOU DOING. STOP.

We have laws and mechanisms to prevent revenge porn, CSAM, defamation, etc. They are robust and can be made even stronger. We do not need to sacrifice the security of our privacy and our speech to fight imagined harms when the real danger is turning into an authoritarian society.

▲

tadfisher 21 days ago | parent | next [-]

The point of SynthID is to make generated images identifiable, in an attempt to prevent 1984-esque situations where you can't believe your eyes and ears. Applying it to screenshots and camera output defeats its only purpose.

If the powers-that-be want to enforce age verification, watermarking camera output is not the correct technology to do so. It would be something like HDCP, where camera manufacturers are given keys and a whole trusted media path is built so that the relying party can cryptographically enforce that a trusted camera is being used to capture live images.

▲

raron 21 days ago | parent | next [-]

> The point of SynthID is to make generated images identifiable, in an attempt to prevent 1984-esque situations where you can't believe your eyes and ears.

You can still use traditional methods to manipulate images, too, so I don't think a "does not contain SynthID watermark" means you can trust that image more. In the other hand, encoding a lot of personal and other information in the watermark (136 bit is a lot) that can not be easily removed and most of the people are unaware of it seems really an 1984-like dystopia.

▲

fc417fc802 21 days ago | parent | prev [-]

You have missed the point by such a wide margin that I have to wonder if it wasn't intentional.

The same techniques used here can be applied in other domains for other purposes. That would not "defeat its only purpose". The danger is the normalization of watermarking for [ insert good reason here ] with regulation eventually making it mandatory once everyone is accustomed to it. Rinse and repeat to gradually boil the frog.

We live in a world where nearly all printers already watermark everything they print with their serial number. It wouldn't be at all surprising if the next modernized variant of that technology encoded personal and contextual data tied to the user.

▲

throawayonthe 21 days ago | parent [-]

you're the one missing the point: why would this technique be used for any of those? the comment you're replying to describes both the incentives to not do that and existing technology that would be more effective for what you imagine

and yeah exactly printers already watermark, why would they need synthid

	▲	fc417fc802 21 days ago \| parent [-]
		> describes both the incentives to not do that It's a bogus claim (as I previously stated). Applying the same technique in another domain or for a different purpose does not defeat the original purpose for which a technique was developed. People can do both things. No one said anything about printers using synthid. The modernized variant (at least one of them) would apply to digital media produced by the end user. Although since you asked, if the synthid watermarking scheme is more resilient to transformations and conversions than the current one then switching might prove useful.

▲

21 days ago | parent | prev | next [-]

[deleted]

▲

Extropy_ 21 days ago | parent | prev | next [-]

Most cameras already produce metadata. You can remove this metadata. Can you not also detect and remove watermarks?

	▲	alterom 21 days ago \| parent \| next [-]
		The metadata is kept separately from the original data, and is, by design, modifiable and removable. Watermark, by design, irreversibly modifies the original data, and is, by design, hard to remove without producing detectable artifacts (or rendering the data useless altogether). In short, the answer is no.
	▲	big_toast 21 days ago \| parent \| prev [-]
		The paper references some threat models they considered. They suggest someone might "possess paired information (both original and watermarked content)" and therefore be able to undo watermarking. Presumably it's fairly easy to get identity operations out of image APIs that would result in this situation. I'm not sure that addresses echelon's main concerns though.

▲

Dylan16807 21 days ago | parent | prev [-]

I'm going to save my protests for anyone trying to watermark real images.

Zero watermarks is a lot worse than semi-effective AI watermarks.

▲

fc417fc802 21 days ago | parent [-]

Is it? Given local models this delays the current cutting edge at any given time by what, 6 to 12 months at best?

▲

Dylan16807 21 days ago | parent [-]

Well the person I replied to seems to think it'll be at least semi-effective.

▲

fc417fc802 21 days ago | parent [-]

How effective something is as an authoritarian tool (or whatever arbitrary purpose) can be (and very often is) completely unrelated to its effectiveness for some other unrelated purpose. It isn't clear to me why even highly effective AI image watermarks would be better than zero watermarks given what I pointed out about local models.

	▲	21 days ago \| parent [-]
		[deleted]

▲

gumby271 21 days ago | parent | prev | next [-]

Or perhaps a user id or fingerprint to an individual. We added that to printers long ago, this would easily enable that for every photo and image you generate too.

▲

janalsncm 21 days ago | parent | prev [-]

Don’t think that would be possible. If I paste a synthetic piece into an otherwise organic image, the synth id isn’t going to know that.

	▲	animal_spirits 21 days ago \| parent [-]
		Synth ID can detect parts of images with the watermark.