Files
remove-ai-watermarks/docs/synthid-removal-research.md
T

13 KiB

SynthID mark removal research

Research archive for pixel-only SynthID removal, not diffusion regeneration. Not a statement of current product capability. Shipped invisible removal is lossy regeneration: known limitations.

Sister pages: SynthID local detector, classifier models, mechanism reference.

Result

The quality-preserving OpenAI SynthID remover hunt closed 2026-08-20. Bayer, VNG demosaic, upscale-then-Bayer, barrel distortion, scanline jitter, and a 2 px shift closed 2026-08-22 on s1/s2 and 2026-08-23 on s3 and fish: they leave the official oracle detected.

Working residual kills on photographs cost about 19-24 dB:

  • 16-32 px phase scramble (s1 24.6 dB, fish 24.3 dB, s2 19.0 dB)
  • Gaussian blur sigma 7 (23.8 dB), holds 3/3 versus sigma 6
  • Additive 16-32 jam only at a=24 / 18.6 dB, worse than scramble

JPEG q5, noise sigma 16, grayscale, rot90, flip, 5°, downscale 0.20x, median 7, posterize 4, VAE round-trip, and white pad to 40% linear stay detected. Elastic warp is not a stable kill (s3 still detected at 22.0 dB).

The product remainder is diffusion regeneration (qwen-zimage / sdxl-zimage), which does not decode and delete a payload. Defeating the verifier does not restore forensic deniability; see synthid.md.

Official not_detected on collage, photo-pad, and two-panel layouts is a presentation gate, not residual damage. Those rungs are in detector research.

Closed quiet removers

Attack Close Notes
Quality-preserving photo remover 2026-08-20 Every residual not_detected that is not a collage is below usable quality
Additive in-band jam as a quiet remover 2026-08-21 Fish flips only at 18.6 dB; 4-8 px at the same PSNR stays detected
Bayer bilinear / VNG / upscale-Bayer 2026-08-23 s1/s2/s3 and fish still detected. s3 bilinear 37.1 dB, fish 34.7 dB. VNG on s2 is dirtier than scramble (18.5 vs 19.0 dB) and the mark remains
Barrel k1=0.06, scanline ±0.8 px, and shift 2 px 2026-08-23 s1/s2/s3/fish detected even at 14-20 dB barrel. Fish scanline 32.5 dB and shift 22.7 dB still detected
TrustMark-style micro-warp 2026-08-21 0.25 px / 32 dB still 100% detect on TrustMark P; OpenAI elastic ~21 dB unreplicated
OKLab random-codeword replacement as a quiet wipe 2026-08-15 On four public Google-oracle positives, replacing the period-16 tile at 0.95 dropped the local lattice score below 0.173 at ~54 dB. Gemini pixel verify never accepted the candidates (Connecting to Verify AI). Local-score intervention, not an official wipe
PRC-style OKLab a/b noise plus spectral peak cleaning 2026-08-15 Independent high-pass OKLab noise at 32.6 dB moved the median local score by only -0.0219. Comb suppression moved one of four below threshold at 58 dB. Not a quiet official kill
Add unmarked context (frame, pad, hstack, collage) 2026-08-19 Official not_detected is a presentation gate. White pad 40% linear stays detected; photo fill at the same geometry is not_detected. See detector identity/layout
cebeuq/Synthid-Bypass diffusion reconstruction 2026-08-13 12 public pairs. Lattice and Gemini Verify go quiet on the after images because the image was redrawn, not because a payload was deleted. Faces and text are a quality claim for regeneration, not a local wipe

Oracle: verify_openai_synthid after AI-metadata strip. Seeds s1, s2, s3 as in detector research. Raw files: .local-eval/synthid/prc-oklab-attack-2026-08-15/.

Band that actually carries the mark

Phase-randomize one octave at a time, preserve energy (E2, s1, replicated p16_32 on s2 and s3):

Octave (period px) Verdict
2-4 detected
4-8 detected
8-16 detected
16-32 not_detected
32-64 detected
64-128 detected

Destroying only 16-32 px periods silences the official decoder. The lattice band 8-16 px does not. On a marked gray flat the same scramble is 51.1 dB not_detected because the band is almost empty. On a photograph the band holds the scene (24.3 dB). Replacing native 16-32 with a 2x-pyramid prediction is 48.4 dB and still detected.

Fish additive jam, luma RMS a:

Band a PSNR Verdict
16-32 0.06-4.0 51.2-33.6 detected
16-32 8 27.7 detected
16-32 16 21.9 detected
16-32 24 18.6 not_detected
4-8 16 21.9 detected
4-8 24 18.6 detected

Preregistered close a*_photo < 0.53 failed (a* > 16).

Bayer and geometry (2026-08-22)

Frozen one-pass batch. Lattice scores on these OpenAI sources are already indeterminate and are not the label.

Attack s1 s2 s3 fish
source detected detected detected detected
Bayer bilinear 32.7 detected 28.4 detected 37.1 detected 34.7 detected
Bayer VNG 25.0 detected 18.5 detected 26.4 detected 25.4 detected
upscale 1.15 then Bayer 33.9 detected 29.8 detected 38.4 detected 36.0 detected
barrel k1=0.06 19.9 detected 14.2 detected 20.2 detected 18.5 detected
scanline ±0.8 px 31.5 detected 26.7 detected 35.7 detected 32.5 detected
shift 2 px 23.1 detected 15.9 detected 24.7 detected 22.7 detected
16-32 phase scramble 24.6 not_detected 19.0 not_detected 25.2 not_detected 23.2 not_detected

Camera pipeline and mild geometry do not hit the decoder basis. A 2 px shift, which kills pipeline_lattice, left s1/s2/s3/fish detected. Scramble remains the residual kill on 4/4 sources. .local-eval/synthid/prc-oklab-attack-2026-08-15/bayer-geometry-2026-08-22/. Manifest status is oracle_complete (2026-08-22 22:07).

Attack ladders (OpenAI oracle)

Pilot 2026-08-17 (n=3): JPEG q40, 0.5x, noise8+jpeg85, 0.35x+jpeg50 all detected (s2 0.35x+jpeg50 at 20.1 dB still detected).

Kill and flip (s1), then replication 3/3:

Rung s1 s2 s3
blur sigma 6 detected detected detected
blur sigma 7 not_detected not_detected not_detected
keep 0.50 linear detected detected detected
keep 0.40 linear not_detected not_detected not_detected
elastic ~24 dB detected 24.6 detected 17.9 detected 26.1
elastic ~21 dB not_detected 20.8 not_detected 14.8 detected 22.0
pad white 40% linear detected detected detected
hstack with photo not_detected not_detected not_detected
blend 25% marked detected detected detected
inset native 1:1 on 2x photo not_detected not_detected not_detected
JPEG q5 detected detected detected

Holds on 3/3: blur 6 vs 7, crop keep 0.50 vs 0.40, white pad 40% detected, hstack not_detected, blend 25% detected, JPEG q5 detected. Elastic at ~21 dB does not hold. Crop keep-0.40 and hstack are presentation or support, not a quiet residual wipe.

Surround: photo fill at the white-pad geometries is not_detected on 3/3; white pad at those sizes was detected. Unmarked photo strip flips between 25% width (detected) and 35% (not_detected). Photo frame 15% each side is not_detected on 3/3; 12% does not hold.

Wild removers, oracle not yet run (2026-08-23)

Prepared on s1. PSNR only. Bayer fish is complete. Submit these when the rate limit allows, not as a new training loop against the verifier.

Attack PSNR Note
Replace 16-32 with a COCO photo's 16-32 25.2 Band transplant. If this ever reads not_detected near 25 dB it is the quietest residual kill so far; if detected, the mark is not a replaceable additive layer in that annulus
Polar phase scramble of 16-32 25.6 Same band as the cartesian scramble (24.6 dB not_detected). Tests circular / Fourier-Mellin / polar-harmonic families: energy stays, angle dies
64-color median-cut palette 35.6 Quieter than scramble. Posterize-4 already stayed detected; this is a smarter quantizer
PIL RGB to CMYK to RGB inf No-op on this PNG. Not an attack

Files: .local-eval/synthid/prc-oklab-attack-2026-08-15/wild-attacks-2026-08-23/.

Also untested: seam carving of the mid band, CMYK via a real ICC printer profile, HEIF/AV1 round-trip, background-only 16-32 scramble (face mask), print-scan.

External literature (surveyed 2026-08-23)

Primary sources. Detector papers live in detector research. Forensic stealth of regeneration is already in synthid.md.

Source Attack Against SynthID? Map to this campaign
Zhao et al., arXiv:2306.01953 (NeurIPS 2024) Add noise, then denoise or regenerate (VAE / diffusion). Pixel-level invisible marks are provably removable. Semantic watermarks proposed as the alternative Open post-hoc schemes, not production SynthID This is the family our product uses (qwen-zimage / sdxl-zimage). Gowal trains SynthID-O against weak VAE regeneration. Our foreign-VAE round-trip at 22.3 dB stayed detected. Regeneration works when it redraws, not when it is a light codec
Liu et al., arXiv:2410.05470 (CtrlRegen, ICLR 2025) Controllable diffusion from clean noise, with a knob on how many noise steps to add SOTA open watermarks Same family. Goonatilake later finds CtrlRegen+ the most forensically detectable remover (AUROC 0.9999)
Kassis and Hengartner, arXiv:2405.08363 (UnMarker, IEEE S&P 2025) No decoder feedback. Two adversarial spectral optimizations. Breaks even some semantic watermarks (best remaining detection 43%) Not production SynthID Spectral disruption without an oracle is the honest analog of our 16-32 scramble, except UnMarker is optimized and we used a one-octave phase shuffle. Goonatilake: UnMarker TPR 98.28% at 0.1% FPR as a forensic leftover
Tallam et al., arXiv:2505.08234 (SemanticRegen) Partial, label-free regeneration of main objects Tree-Ring, StegaStamp, StableSig, DWT/DCT. Not SynthID Partial redraw. Our collage / photo-pad not_detected is a presentation gate, not this attack
Cao et al., arXiv:2608.10166 (MarkNull, USENIX Security 2026) On-manifold latent decorrelation via a public diffusion proxy. Claims 100% on 20 Imagen-3 Gemini-verify images. PSNR 25.36 dB, SSIM 0.80 Small Gemini-verify set Independent evidence that a no-box latent reconstruction can confuse Gemini. Does not meet this project's 40 dB / 0.99 SSIM release gate. Still generation, not a pixel-only wipe
Goonatilake and Ateniese, arXiv:2605.09203 Six removers all leave a forensic residue a ResNet-50 sees at >98% TPR @ 1% FPR Applies to UnMarker, Zhao's WatermarkAttacker, CtrlRegen+ Defeating verify-openai-synthid is not deniability. This is the product remainder
An et al., arXiv:2401.08573 (WAVES, ICML 2024) 26 attacks on StegaStamp, Stable Signature, Tree-Ring. Regeneration, not JPEG, is the attack that matters. StegaStamp TPR@1%FPR 1.00 to 0.01; Tree-Ring 0.99 to 0.12 Open watermarks Protocol. Our blur-sigma-7 and 16-32 scramble are closer to WAVES "distortion" than to regeneration
Wen et al., arXiv:2305.20030 (Tree-Ring) In-generation Fourier pattern in initial noise Not SynthID Kill is DDIM inversion plus latent wipe, not a pixel scramble. Lin and Juarez arXiv:2506.10502 (USENIX 2025) remove it from public knowledge
Fernandez et al., Stable Signature, ICCV 2023 Fine-tuned VAE decoder Not SynthID Regeneration that replaces the decoder is in-family. Our foreign VAE at 22.3 dB did not kill OpenAI SynthID, which is the expected mismatch
Google to The Verge, 2026-04-14 reverse-SynthID does not systematically remove SynthID Google spokesperson on the spectral bypass Agrees with our V4 audit and with Bypass: reconstruction or decoder confusion, not a payload delete

Quiet pixel-only removal is not a published result on production OpenAI or Google SynthID. Every paper that "beats" a watermark either redraws the image, attacks an open encoder, or reports PSNR in the same 19-25 dB band as our 16-32 scramble.

Product remainder for removal

Invisible removal in this package regenerates through qwen-zimage or sdxl-zimage. It is lossy. There is no shipped pixel-only OpenAI or Google SynthID wipe. Do not add Bayer or geometry as remover arms.