SynthID removal is a pip install now. "No watermark found" proves nothing.

An open-source utility with 5.1k GitHub stars removes Google's SynthID markers from AI-edited images, and its paid tier charges for exactly one thing: killing the invisible watermark that's supposed to survive edits. If your review workflow treats a negative watermark result as exculpatory, that assumption is now a liability, and the exploit is a pip install.

The removal toolchain is a product, not a weekend project

wiltodelta/remove-ai-watermarks is a Python library and CLI with 5.1k stars and 473 commits of iteration behind it. It handles images and video, and its target list names SynthID alongside C2PA, EXIF, IPTC, and XMP. The feature split shows where the engineering effort goes: stripping metadata and visible badges is the free, easy part, while removing the invisible watermark takes diffusion regeneration on a CUDA GPU. The hosted version charges only for the invisible layer. That pricing tells you where demand sits, on the part marketed as durable.

Around the repo sit browser-based removers that run client-side with no uploads, one capping files at 50MB, another shipping batch processing aimed at social uploads.

SynthID's survival claims answer the wrong question

SynthID embeds its signal in frequency-domain patterns spread across the whole frame, which is why it survives cropping and JPEG compression. I believe those claims. I also think they're benchmarked against the wrong enemy. A JPEG encoder doesn't know the watermark exists. A removal tool does, and it gets to choose the attack.

Two attack classes are in circulation. The first is aimed perturbation: tiny structured changes, 0.0005 to 0.003 of the pixel value range, targeted at the frequency bands where SynthID lives, dragging the detector's correlation below threshold while the image looks identical. Whether that beats Google's production detector is unverifiable, and both remover sites quoting the identical range reads like shared marketing copy.

The second attack is the one I'd bet on: diffusion regeneration. Push the image through a generative model, resample it, keep the content, lose the fingerprint. Nobody locates the watermark. The pixels carrying it get replaced wholesale, which beats any pixel-domain scheme by construction. The only cost is fidelity, and the tooling exposes that as a dial: one service ships a denoise range of 0.08 to 0.15 with four sampler steps, plus a rebuild pass for faces since that's where people notice drift. The whole tuning exercise is changing the image just enough to break the signal and no more.

And nobody outside Google can check the scoreboard. SynthID detectors aren't public, so no remover can prove success and no newsroom can audit either direction. If Google opens the detector, it becomes the oracle every remover optimizes against overnight.

Fix the verdict logic today

These signals fall in layers. Metadata goes in seconds (exiftool -all= image.jpg), visible badges are a free-tier feature, and pixel watermarks now require a GPU or a browser tab. So your review queue should work like this:

verdict = NEUTRAL
if c2pa_signature_valid:  verdict = STRONG_PROVENANCE
if synthid_detected:      verdict = AI_ORIGIN_LIKELY
if no_watermark_found:    verdict = NEUTRAL    # never "probably human"

A detection or a valid signature moves the needle. Silence moves nothing. Any workflow that reads "no watermark found" as "probably human-made" was always wrong. The removal ecosystem just made exploiting the mistake cheap.

What to change this week:

• Rewrite the SOP line: a negative watermark result routes to NEUTRAL, full stop.
• Treat a valid C2PA signature as the only strong signal, and remember it testifies to nothing once stripped (plenty of platforms re-encode uploads and discard it by default).
• Assume hostile images in your queue have already been through regeneration, and screen for img2img artifacts instead of relying on watermark absence.

Is pixel watermarking worth defending at all, or should provenance budgets go all-in on capture-side signing? Curious where people running review queues land.

Longer writeup with the full argument: https://axeploit.com/blog/no-watermark-detected-tells-you-nothing-the-synthid-removal-toolchain-is-why