ML Security PapersSynthID-Image: Image watermarking at internet scale
Sven Gowal , Rudy Bunel , Florian Stimberg , David Stutz , Guillermo Ortiz-Jimenez , Christina Kouridi , Mel Vecerik , Jamie Hayes , Sylvestre-Alvise Rebuffi , Paul Bernard , Chris Gamble , Miklós Z. Horváth , Fabian Kaczmarczyck , Alex Kaskasoli , Aleksandar Petrov , Ilia Shumailov , Meghana Thotakuri , Olivia Wiles , Jessica Yung , Zahra Ahmed , Victor Martin , Simon Rosen , Christopher Savčak , Armin Senoner , Nidhi Vyas , Pushmeet Kohli
Published on arXiv
2510.09263
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
SynthID-O achieves state-of-the-art performance in both visual quality and robustness to common image perturbations compared to other post-hoc watermarking methods, deployed at over 10 billion images/video frames across Google services.
SynthID-Image
Novel technique introduced
We introduce SynthID-Image, a deep learning-based system for invisibly watermarking AI-generated imagery. This paper documents the technical desiderata, threat models, and practical challenges of deploying such a system at internet scale, addressing key requirements of effectiveness, fidelity, robustness, and security. SynthID-Image has been used to watermark over ten billion images and video frames across Google's services and its corresponding verification service is available to trusted testers. For completeness, we present an experimental evaluation of an external model variant, SynthID-O, which is available through partnerships. We benchmark SynthID-O against other post-hoc watermarking methods from the literature, demonstrating state-of-the-art performance in both visual quality and robustness to common image perturbations. While this work centers on visual media, the conclusions on deployment, constraints, and threat modeling generalize to other modalities, including audio. This paper provides a comprehensive documentation for the large-scale deployment of deep learning-based media provenance systems.
Key Contributions
- Deep learning-based invisible image watermarking system (SynthID-Image) deployed at internet scale across Google services, watermarking over 10 billion images and video frames
- Comprehensive threat modeling and security analysis for large-scale media provenance systems, covering effectiveness, fidelity, robustness, and adversarial attacks on watermarks
- Benchmarking of SynthID-O against post-hoc watermarking methods, demonstrating state-of-the-art visual quality and robustness to common image perturbations
🛡️ Threat Analysis
SynthID-Image embeds invisible watermarks in AI-generated image outputs to trace content provenance and verify authenticity — this is output integrity and content watermarking. The paper also explicitly addresses threat models including watermark removal and circumvention attacks.