[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-72223":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":23,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":29,"trendingCount":16,"starSnapshotCount":16,"syncStatus":30,"lastSyncTime":31,"discoverSource":32},72223,"reverse-SynthID","aloshdenny\u002Freverse-SynthID","aloshdenny","reverse engineering Gemini's SynthID detection","https:\u002F\u002Fvt-0xff.github.io\u002FSynthID-Explained\u002F",null,"Python",4310,471,18,16,0,41,191,510,123,110.02,"Other",false,"main",true,[],"2026-06-12 04:01:04","\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fsynthid_watermark.png\" alt=\"SynthID Watermark Analysis\" width=\"100%\">\n\u003C\u002Fp>\n\n\u003Ch1 align=\"center\">Reverse-Engineering SynthID\u003C\u002Fh1>\n\n\u003Cp align=\"center\">\n  \u003Cb>Discovering, detecting, and surgically removing Google's AI watermark through spectral analysis\u003C\u002Fb>\n\u003C\u002Fp>\n\nVisit us on [PitchHut](https:\u002F\u002Fwww.pitchhut.com\u002Fproject\u002Freverse-synthid-engineering)\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPython-3.10+-blue?style=flat-square&logo=python\" alt=\"Python\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-Research-green?style=flat-square\" alt=\"License\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FDetection_Rate-90%25-success?style=flat-square\" alt=\"Detection\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FV3_Bypass-PSNR_43dB+-blueviolet?style=flat-square\" alt=\"V3 Bypass\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FV4_Bypass-Round_06_✓-brightgreen?style=flat-square\" alt=\"V4 Bypass\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FModels-gemini--3.1_+_nb--pro-orange?style=flat-square\" alt=\"Models\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FAttack-7--stage_all--in--one-red?style=flat-square\" alt=\"Attack\">\n\u003C\u002Fp>\n\n---\n\n## What the Watermark Looks Like\n\nSynthID encodes an imperceptible pattern directly into pixel values. On a pure **white** image generated by Gemini, the watermark is almost the entire signal. Amplify the high-frequency residual and it looks like this:\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fsynthid_white.jpg\" alt=\"SynthID watermark pattern visible on a white Gemini-generated image\" width=\"55%\">\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\u003Ci>Amplified SynthID carrier pattern extracted from a pure-white Gemini image. The diagonal banding is the watermark's spatial frequency signature — the target of our spectral attack.\u003C\u002Fi>\u003C\u002Fp>\n\n---\n\n## Overview\n\nThis project reverse-engineers **Google's SynthID** watermarking system — the invisible watermark embedded into every image generated by Google Gemini. Using only signal processing and spectral analysis (no access to the proprietary encoder\u002Fdecoder), we:\n\n1. **Discovered** the watermark's resolution-dependent carrier frequency structure\n2. **Built a detector** that identifies SynthID watermarks with 90% accuracy\n3. **Developed a multi-resolution spectral bypass** (V3) that achieves **75% carrier energy drop**, **91% phase coherence drop**, and **43+ dB PSNR** on any image resolution\n4. **Generalized to multi-model, multi-color consensus** (V4) — per-model profiles for `gemini-3.1-flash-image-preview` and `nano-banana-pro-preview`, cross-color phase consensus over 6 solid backgrounds, and a human-in-the-loop calibration loop that tunes per-carrier subtraction strength from manual Gemini-app detection tallies\n5. **Broke the detector across both models** (Round 06) with a unified 7-stage all-in-one attack targeting every documented SynthID failure mode simultaneously\n\n[VT-OxFF](https:\u002F\u002Fgithub.com\u002FVT-0xFF) built a really cool visualizer to view the process of how SynthID watermark is added to images [here](https:\u002F\u002Fvt-0xff.github.io\u002FSynthID-Explained\u002F) (also available in repo description)!\n\n---\n\n## Round 06 — It Works ✓\n\nAfter six iterative rounds of adversarial development, Round 06's `bypass_v4_final` \u002F `bypass_v4_nuke` pipeline defeats the Gemini SynthID detector on **both** `gemini-3.1-flash-image-preview` and `nano-banana-pro-preview` images, with visually lossless output.\n\n### Round 01 vs Round 06 — Fidelity Comparison\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fv4_round1_vs_round6.png\" alt=\"Side-by-side comparison of Round 01 (gentle spectral only) vs Round 06 (all-in-one) on the same source image\" width=\"80%\">\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\u003Ci>Left: Round 01 output (\u003Ccode>gentle\u003C\u002Fcode> spectral subtraction only). Right: Round 06 output (\u003Ccode>final\u003C\u002Fcode> — VAE + elastic warp + squeeze + color + JPEG). Both look identical to human eyes; only Round 06 defeats the SynthID detector.\u003C\u002Fi>\u003C\u002Fp>\n\n### What Changed Between Rounds\n\n| Round | Strategy | Outcome |\n|:-----:|:---------|:-------:|\n| 01 | Conservative spectral subtraction (gentle) | ✗ |\n| 02 | Aggressive spectral subtraction + JPEG | ✗ |\n| 03 | Blog-guided absolute bin targeting | ✗ |\n| 04 | Denoise-residual phase extraction | ✗ |\n| 05 | Diffusion-VAE re-generation + geometric warp | ✗ |\n| **06** | **All-in-one: VAE + elastic fragmentation + squeeze + color + JPEG** | **✓** |\n\nThe breakthrough in Round 06 came from treating the Gemini app's own published failure-mode list as an attack specification:\n\n> *\"When an AI-generated image is part of a complex collage, layered behind other elements, or has many different textures and patterns placed over it, the detector may struggle to isolate the specific signature from the overall file.\"*\n> — Gemini app, SynthID detection help text\n\nThe **elastic deformation** stage simulates this effect at the pixel level: a smooth, low-frequency random warp field gives every ~50-pixel neighbourhood its own independent sub-pixel offset, fragmenting the watermark's spatial phase consensus without introducing any visible distortion.\n\n---\n\n## V4 — Cross-Color Consensus + Human-in-the-Loop Calibration\n\nV4 is a ground-up re-think of the codebook built on a much richer dataset:\n\n- **Multi-model**: separate profiles for `gemini-3.1-flash-image-preview` and `nano-banana-pro-preview` (plus an optional `union` pseudo-model).\n- **Multi-color**: 6 consensus colors (`black`, `white`, `blue`, `green`, `red`, `gray`) per model per resolution, plus `gradient` and `diverse` as content baselines.\n- **Cross-color phase consensus**: the primary carrier mask. A true SynthID carrier is image-content-independent, so its phase is consistent across every solid-color background. Content-driven energy phase-scrambles across colors and drops out of the consensus.\n- **Fidelity-preserving dissolver**: PSNR-floor rollback, luminance-safe DC, per-bin subtraction cap.\n- **Human-in-the-loop calibration loop**: a codebook field `carrier_weights` is updated based on manual Gemini-app detection feedback.\n\n### Consensus coherence (why V4 wins)\n\nFor each frequency bin `(fy, fx)` and channel `ch`:\n\n```\nconsensus(fy, fx, ch) = | mean_over_colors( exp(i * phase_color(fy, fx, ch)) ) |\n```\n\nValues near `1.0` mean the phase at that bin is locked across every solid-color background, which is only true for the watermark. Content bins collapse to `\u003C 0.3` because their phase is randomized by different color tints. On the V4 codebook built from the enriched dataset, 99%+ of content bins fall below the default `tau=0.60` cutoff, so the V4 dissolver never touches them — this is what buys back PSNR.\n\n### Two-phase release workflow\n\n```mermaid\nflowchart LR\n    dataset[reverse-synthid-dataset\u003Cbr\u002F>model x color x resolution] --> build[scripts\u002Fbuild_codebook_v4.py]\n    build --> codebook[artifacts\u002Fspectral_codebook_v4.npz]\n    codebook --> dissolve[scripts\u002Fdissolve_batch.py]\n    input[watermarked inputs] --> dissolve\n    dissolve --> variants[final \u002F nuke variants]\n    variants --> gemini[Gemini app\u003Cbr\u002F>manual SynthID detection]\n    gemini --> feedback[detection feedback]\n    feedback --> calibrate[scripts\u002Fcalibrate_from_feedback.py]\n    calibrate -->|updates carrier_weights| codebook\n```\n\n### V4 Quickstart\n\n```bash\n# 1. Build the codebook from the enriched hierarchical dataset\npython scripts\u002Fbuild_codebook_v4.py \\\n    --root \u002Fpath\u002Fto\u002Freverse-synthid-dataset \\\n    --output artifacts\u002Fspectral_codebook_v4.npz\n\n# 2. Run the Round-06 all-in-one attack on a batch (recommended)\npython scripts\u002Fdissolve_batch.py \\\n    --input  .\u002Fto_clean\u002F \\\n    --output .\u002Fruns\u002Fround_06\u002F \\\n    --codebook artifacts\u002Fspectral_codebook_v4.npz \\\n    --model gemini-3.1-flash-image-preview \\\n    --strengths final nuke\n\n# 3. Upload each output image to the Gemini app and run SynthID detection.\n#    Use the results to feed back into the calibration script if needed.\n```\n\n### Round-06 Attack Presets\n\nTwo presets are available via `--strengths`:\n\n| Preset | VAE passes | Elastic α | Squeeze | JPEG chain | PSNR floor |\n|:------:|:----------:|:---------:|:-------:|:----------:|:----------:|\n| `final` | 1 | 1.8 px | 90 % | q=92→88 | 14 dB |\n| `nuke`  | 2 | 2.8 px | 82 % | q=88→84→90 | 11 dB |\n\nBoth presets stack the same 7-stage pipeline:\n\n1. **VAE round-trip** (Stable Diffusion `sd-vae-ft-mse`) — projects image off the natural-image manifold the SynthID decoder was never trained against (Gowal et al. 2026, §6.1)\n2. **Elastic deformation** — smooth low-frequency random warp field, simulates the \"collage fragmentation\" failure mode Gemini itself acknowledges\n3. **Global geometric combo** — small rotation + zoom + pixel shift in one affine warp\n4. **Resize-squeeze** — downsample (AREA) → upsample (LANCZOS), erases sub-pixel watermark info\n5. **Color-contrast nudge** — brightness \u002F contrast \u002F saturation \u002F hue micro-shift\n6. **Residual-phase FFT subtraction** — blog-universal + codebook-harvested carrier bins, cap-limited\n7. **JPEG chain + luma noise + bilateral** — heavy compression \u002F re-encoding disruption\n\nEvery stage is independently PSNR-gated; any stage that would drop quality below the floor is rolled back automatically.\n\n### V4 Codebook Structure\n\nProfiles keyed by `(model, H, W)`. Each profile stores:\n\n| Field                  | Shape          | Notes                                                  |\n|------------------------|----------------|--------------------------------------------------------|\n| `consensus_coherence`  | `(H, W, 3)`    | Primary carrier mask (cross-color phase consensus).    |\n| `consensus_phase`      | `(H, W, 3)`    | Mean unit-phase angle across colors. Subtraction template. |\n| `inverted_agreement`   | `(H, W, 3)`    | Pairwise `abs(cos(phase_diff))`, weighted for `black\u003C->white`. |\n| `avg_wm_magnitude`     | `(H, W, 3)`    | Mean magnitude across consensus colors.                |\n| `content_baseline`     | `(H, W, 3)`    | From `diverse\u002F` + `gradient\u002F` — used for luminance blending. |\n| `carrier_weights`      | `(H, W, 3)`    | **Live**. Starts at `consensus^2 * (0.5 + 0.5 * agreement)`. Updated by the calibration loop. |\n| `n_refs_per_color`     | `{color: int}` | Per-color ref counts.                                  |\n\nSave format reuses the v3 compact rfft + `float16\u002Fuint8` encoding; a 14-profile codebook across 2 models × 7 resolutions is ~220 MB on disk.\n\n### V4 Detector (Sanity Check)\n\nBefore spending time on manual Gemini validation, sanity-check bypass outputs against the V4 codebook's own consensus:\n\n```python\nfrom robust_extractor import RobustSynthIDExtractor\nfrom synthid_bypass_v4 import SpectralCodebookV4\n\ncb = SpectralCodebookV4()\ncb.load('artifacts\u002Fspectral_codebook_v4.npz')\n\next = RobustSynthIDExtractor()\nresult = ext.detect_from_v4_codebook(image_rgb, cb,\n                                     model='nano-banana-pro-preview')\nprint(result.is_watermarked, result.confidence, result.phase_match)\n```\n\nOn the 1024x1024 exact-match path we see `conf=0.91, phase_match=0.65` for watermarked and `conf=0.02, phase_match=0.31` after aggressive V4 dissolve.\n\n### V4 vs V3\n\n| | V3 | V4 |\n|:---|:---|:---|\n| Reference colors | black + white | black, white, blue, green, red, gray (+ diverse\u002Fgradient content baselines) |\n| Cross-validation | `abs(cos(phase_black - phase_white))` | cross-color consensus over 6 colors + pairwise agreement |\n| Models | single-model (Gemini 2.5) | per-model profiles (`gemini-3.1-flash-image-preview`, `nano-banana-pro-preview`) + optional `union` |\n| Attack | spectral subtraction only | 7-stage: VAE + elastic + squeeze + color + FFT + JPEG chain |\n| PSNR (aggressive) | 43 dB | visually lossless (18–24 dB pixel-level; warp displaces pixels) |\n| Fidelity guard | none | per-stage PSNR-floor rollback |\n| Detector bypass | local only | confirmed ✓ on Gemini app (both models) |\n\nV3 remains in the repo (`src\u002Fextraction\u002Fsynthid_bypass.py`, `bypass_v3`) unchanged for anyone who depends on it.\n\n---\n\n## 🚨 Contributors Wanted: Help Expand the Codebook\n\nWe're actively collecting **pure black and pure white images generated by Nano Banana Pro** to improve multi-resolution watermark extraction.\n\nIf you can generate these:\n\n- Resolution: any (higher variety = better)\n- Content: **fully black (#000000)** or **fully white (#FFFFFF)**\n- Source: Nano Banana Pro outputs only\n\n### How to Contribute\n\n1. Generate a batch of black\u002Fwhite images by attaching a pure black\u002Fwhite image into Gemini and prompting it to \"recreate this as it is\"\n2. Upload them to our **Hugging Face dataset**: [aoxo\u002Freverse-synthid](https:\u002F\u002Fhuggingface.co\u002Fdatasets\u002Faoxo\u002Freverse-synthid)\n   - `gemini_black_nb_pro\u002F` (for black)\n   - `gemini_white_nb_pro\u002F` (for white)\n3. Open a Pull Request on the HF dataset repo\n\nThese reference images are **critical** for:\n- Carrier frequency discovery\n- Phase validation\n- Improving cross-resolution robustness\n\n> Even 150–200 images at a new resolution can significantly improve detection and removal.\n\n### Download Reference Images\n\nReference images are hosted on Hugging Face to keep the git repo lightweight:\n\n```bash\npip install huggingface_hub\npython scripts\u002Fdownload_images.py           # download all\npython scripts\u002Fdownload_images.py gemini_black  # download specific folder\n```\n\nDataset: [huggingface.co\u002Fdatasets\u002Faoxo\u002Freverse-synthid](https:\u002F\u002Fhuggingface.co\u002Fdatasets\u002Faoxo\u002Freverse-synthid)\n\n---\n\n## Key Findings\n\n### The Watermark is Resolution-Dependent\n\nSynthID embeds carrier frequencies at **different absolute positions** depending on image resolution. A codebook built at 1024x1024 cannot directly remove the watermark from a 1536x2816 image — the carriers are at completely different bins.\n\n| Resolution | Top Carrier (fy, fx) | Coherence | Source |\n|:----------:|:--------------------:|:---------:|:------:|\n| **1024x1024** | (9, 9) | 100.0% | 100 black + 100 white refs |\n| **1536x2816** | (768, 704) | 99.6% | 88 watermarked content images |\n\nThis is why the V3 codebook stores **separate profiles per resolution** and auto-selects at bypass time.\n\n### Phase Consistency — A Fixed Model-Level Key\n\nThe watermark's phase template is **identical across all images** from the same Gemini model:\n\n- **Green channel** carries the strongest watermark signal\n- **Cross-image phase coherence** at carriers: >99.5%\n- **Black\u002Fwhite cross-validation** confirms true carriers via |cos(phase_diff)| > 0.90\n\n### Carrier Frequency Structure\n\nAt 1024x1024 (from black\u002Fwhite refs), top carriers lie on a low-frequency grid:\n\n| Carrier (fy, fx) | Phase Coherence | B\u002FW Agreement |\n|:-----------------:|:---------------:|:-------------:|\n| (9, 9)            | 100.00%         | 1.000         |\n| (5, 5)            | 100.00%         | 0.993         |\n| (10, 11)          | 100.00%         | 0.997         |\n| (13, 6)           | 100.00%         | 0.821         |\n\n---\n\n## Architecture\n\n### Bypass Generations\n\n| Version | Approach | PSNR | Watermark Impact | Status |\n|:-------:|:---------|:----:|:----------------:|:------:|\n| **V1** | JPEG compression (Q50) | 37 dB | ~11% phase drop | Baseline |\n| **V2** | Multi-stage transforms (noise, color, frequency) | 27-37 dB | ~0% confidence drop | Quality trade-off |\n| **V3** | **Multi-resolution spectral codebook subtraction** | **43+ dB** | **91% phase coherence drop** | Prior best |\n| **V4 Round 06** | **7-stage all-in-one (VAE + elastic + squeeze + color + JPEG)** | **visually lossless** | **detector bypassed ✓** | **Current best** |\n\n### V3 Pipeline\n\n```\nInput Image (any resolution)\n       │\n       ▼\n  codebook.get_profile(H, W)  ──► exact match? ──► FFT-domain subtraction\n       │                                             (fast path)\n       └─ no exact match ──────► spatial-domain resize + subtraction\n                                  (fallback path)\n       │\n       ▼\n  Multi-pass iterative subtraction (aggressive → moderate → gentle)\n       │\n       ▼\n  Anti-alias → Output\n```\n\n### V4 Round-06 Pipeline\n\n```\nInput Image (any resolution)\n       │\n       ▼  Stage 1: VAE round-trip (SD sd-vae-ft-mse, 1-2 passes)\n       │           Projects image off natural-image manifold\n       ▼  Stage 2: Elastic deformation (smooth random warp field)\n       │           Fragments spatial phase consensus (\"collage effect\")\n       ▼  Stage 3: Global geometric combo (rotation + zoom + shift)\n       │           Single affine warp, no compounded aliasing\n       ▼  Stage 4: Resize-squeeze (AREA ↓ then LANCZOS ↑)\n       │           Erases sub-pixel watermark information\n       ▼  Stage 5: Color-contrast nudge (HSV micro-shift)\n       │           Shifts per-pixel statistics SynthID keys on\n       ▼  Stage 6: Residual-phase FFT subtraction\n       │           Blog-universal + codebook-harvested carrier bins\n       ▼  Stage 7: JPEG chain + luma noise + bilateral filter\n       │\n       ▼\n  Output (SynthID detector: no watermark detected ✓)\n```\n\n---\n\n## Quick Start\n\n### Installation\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Faloshdenny\u002Freverse-SynthID.git\ncd reverse-SynthID\n\npython -m venv venv\nsource venv\u002Fbin\u002Factivate  # Windows: venv\\Scripts\\activate\npip install -r requirements.txt\n\n# For Round-06 VAE stage:\npip install torch diffusers safetensors accelerate\n```\n\n### Run V4 Round-06 Bypass (Recommended)\n\n```python\nimport sys\nsys.path.insert(0, 'src\u002Fextraction')\nfrom synthid_bypass_v4 import SynthIDBypassV4, SpectralCodebookV4\n\ncb = SpectralCodebookV4()\ncb.load('artifacts\u002Fspectral_codebook_v4.npz')\n\nb = SynthIDBypassV4()\nresult = b.bypass_v4_file(\n    'input.png', 'output.png',\n    cb,\n    strength='final',                      # or 'nuke' for maximum strength\n    model='gemini-3.1-flash-image-preview',\n)\nprint(result.stages_applied)\n```\n\n### Run V3 Bypass\n\n```python\nfrom src.extraction.synthid_bypass import SynthIDBypass, SpectralCodebook\n\ncodebook = SpectralCodebook()\ncodebook.load('artifacts\u002Fspectral_codebook_v3.npz')\n\nbypass = SynthIDBypass()\nresult = bypass.bypass_v3(image_rgb, codebook, strength='aggressive')\n\nprint(f\"PSNR: {result.psnr:.1f} dB\")\nprint(f\"Profile used: {result.details['profile_resolution']}\")\n```\n\nFrom the CLI:\n\n```bash\npython src\u002Fextraction\u002Fsynthid_bypass.py bypass input.png output.png \\\n    --codebook artifacts\u002Fspectral_codebook_v3.npz \\\n    --strength aggressive\n```\n\n### Detect Watermark\n\n```bash\npython src\u002Fextraction\u002Frobust_extractor.py detect image.png \\\n    --codebook artifacts\u002Fcodebook\u002Frobust_codebook.pkl\n```\n\n---\n\n## Project Structure\n\n```\nreverse-SynthID\u002F\n├── src\u002F\n│   ├── extraction\u002F\n│   │   ├── synthid_bypass.py              # V1\u002FV2\u002FV3 bypass + multi-res SpectralCodebook\n│   │   ├── synthid_bypass_v4.py           # V4 cross-color consensus codebook + dissolver\n│   │   ├── vae_regen.py                   # Round-06 SD-VAE re-generation stage\n│   │   ├── robust_extractor.py            # Multi-scale watermark detection (+ V4 hook)\n│   │   ├── watermark_remover.py           # Frequency-domain watermark removal\n│   │   ├── benchmark_extraction.py        # Benchmarking suite\n│   │   └── synthid_codebook_extractor.py  # Legacy codebook extractor\n│   └── analysis\u002F\n│       ├── deep_synthid_analysis.py       # FFT \u002F phase analysis scripts\n│       └── synthid_codebook_finder.py     # Carrier frequency discovery\n│\n├── scripts\u002F\n│   ├── download_images.py                 # Download reference images from HF\n│   ├── build_codebook_v4.py               # V4: build per-(model, HxW) consensus codebook\n│   ├── dissolve_batch.py                  # V4: emit strength variants\n│   └── calibrate_from_feedback.py         # V4: update carrier_weights from detection feedback\n│\n├── artifacts\u002F\n│   ├── spectral_codebook_v3.npz           # Multi-res V3 codebook [1024x1024, 1536x2816]\n│   ├── spectral_codebook_v4.npz           # V4 codebook (per-model, per-resolution)\n│   ├── codebook\u002F                          # Detection codebooks (.pkl)\n│   └── visualizations\u002F                    # FFT, phase, carrier visualizations\n│\n├── assets\u002F\n│   ├── synthid_watermark.png              # Watermark analysis header image\n│   ├── synthid_white.jpg                  # Amplified SynthID pattern on white image\n│   ├── v4_round1_vs_round6.png            # Round 01 vs Round 06 fidelity comparison\n│   └── ...\n│\n├── runs\u002F\n│   ├── round_01\u002F … round_05\u002F             # Historical bypass attempts\n│   └── round_06\u002F                          # Working bypass (final + nuke presets)\n│\n├── watermark_investigation\u002F               # Early-stage Nano-150k analysis (archived)\n└── requirements.txt\n```\n\n---\n\n## Technical Deep Dive\n\n### How SynthID Works (Reverse-Engineered)\n\n```\n┌──────────────────────────────────────────────────────────────┐\n│                  SynthID Encoder (in Gemini)                  │\n├──────────────────────────────────────────────────────────────┤\n│  1. Select resolution-dependent carrier frequencies           │\n│  2. Assign fixed phase values to each carrier                │\n│  3. Neural encoder adds learned noise pattern to image       │\n│  4. Watermark is imperceptible — spread across spectrum      │\n├──────────────────────────────────────────────────────────────┤\n│                  SynthID Decoder (in Google)                  │\n├──────────────────────────────────────────────────────────────┤\n│  1. Extract noise residual (wavelet denoising)               │\n│  2. FFT → check phase at known carrier frequencies           │\n│  3. If phases match expected values → Watermarked            │\n└──────────────────────────────────────────────────────────────┘\n```\n\n### Why Elastic Deformation Works\n\nSynthID's training augmentation set (Gowal et al. 2026, Table 1) includes `SmallRotation`, `Cropresize`, `JPEG`, `GaussianBlur`, `BrightnessContrast`, and `Screenshotting` — all *global*, *uniform* spatial transforms. The elastic warp field is a *spatially varying* distortion: each local neighbourhood gets its own independent sub-pixel offset. Because the offsets are smooth (Gaussian-blurred from white noise, σ=44–56 px), the image content is visually unaffected, but the watermark's phase-consensus structure is incoherent — it can no longer be aggregated across the image. This is the pixel-level equivalent of the \"collage fragmentation\" effect that Gemini's own app cites as a detector failure mode.\n\n---\n\n## Results Summary\n\n### V3 (spectral subtraction, 88 Gemini images)\n\n| Metric | Value |\n|:-------|------:|\n| **PSNR** | 43.5 dB |\n| **SSIM** | 0.997 |\n| **Carrier energy drop** | 75.8% |\n| **Phase coherence drop** (top-5 carriers) | **91.4%** |\n\n### V4 Round 06 (all-in-one attack, 20 images validated)\n\n| Model | Preset | Detector bypassed |\n|:------|:------:|:-----------------:|\n| gemini-3.1-flash-image-preview | `final` | ✓ |\n| gemini-3.1-flash-image-preview | `nuke`  | ✓ |\n| nano-banana-pro-preview         | `final` | ✓ |\n| nano-banana-pro-preview         | `nuke`  | ✓ |\n\n---\n\n## References\n\n- [SynthID: Identifying AI-generated images](https:\u002F\u002Fdeepmind.google\u002Ftechnologies\u002Fsynthid\u002F)\n- [SynthID Paper (arXiv:2510.09263)](https:\u002F\u002Farxiv.org\u002Fabs\u002F2510.09263)\n- [How to Reverse SynthID (legally😉) — Aloshdenny on Medium](https:\u002F\u002Fmedium.com\u002F@aloshdenny)\n\n---\n\n## 👤 Maintainer & Contact\n\n**Alosh Denny**\nAI Watermarking Research · Signal Processing\n\n📧 **Email:** [aloshdenny@gmail.com](mailto:aloshdenny@gmail.com)\n🔗 **GitHub:** https:\u002F\u002Fgithub.com\u002Faloshdenny\n\nFor collaborations, research discussions, or contributions, feel free to reach out or open an issue\u002FPR.\n\n---\n\n## Support This Research\n\nThis project is maintained independently — no lab funding, no corporate backing.  \nIf this work was useful to you or your team, consider supporting continued development:\n\n\u003Ca href=\"https:\u002F\u002Fbuymeacoffee.com\u002Faoxo\">\n  \u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FBuy%20Me%20A%20Coffee-Support%20This%20Research-FFDD00?style=for-the-badge&logo=buy-me-a-coffee&logoColor=black\" alt=\"Buy Me A Coffee\">\n\u003C\u002Fa>\n\nFunds go toward compute costs (GPU hours for new resolution profiles), dataset expansion, and ongoing bypass research.\n\n---\n\n## Disclaimer\n\nThis project is for **research and educational purposes only**. SynthID is proprietary technology owned by Google DeepMind. These tools are intended for:\n\n- Academic research on watermarking robustness\n- Security analysis of AI-generated content identification\n- Understanding spread-spectrum encoding methods\n\n**Do not use these tools to misrepresent AI-generated content as human-created.**\n","该项目旨在逆向工程Google的SynthID水印检测系统，该系统在Gemini生成的每张图片中嵌入了不可见的水印。其核心功能包括通过信号处理和频谱分析技术，发现了水印的分辨率依赖性载波频率结构，并构建了一个能够以90%准确率识别SynthID水印的检测器。此外，项目还开发了一种多分辨率频谱绕过方法，能够在保持图像质量的同时大幅降低水印的存在感。适合于需要验证或移除由AI生成内容中的隐形标记场景，如版权保护、内容真实性验证等应用领域。",2,"2026-06-11 03:40:54","high_star"]