SynthID-Image: Image watermarking at internet scale

TL;DR

This paper presents SynthID-Image, a post-hoc, model-independent invisible watermarking system designed for AI-generated imagery at internet scale. It formalizes the desiderata—quality, robustness, payload capacity, security, efficiency, and deployment—and develops a robust training-and-evaluation pipeline to optimize the trade-offs among them, including explicit focus on transformations and adversarial threats. The authors report state-of-the-art performance on both visual quality and robustness through extensive internal and external evaluations, including the external SynthID-O variant, and demonstrate deployment across Google's AI-generated content with a verification service for trusted testers. They also discuss integration with metadata standards like C2PA and fingerprinting-based approaches, emphasizing the need for an ecosystem of provenance tools, scalable decision-making, and versioning to reach large-scale, real-world impact. Overall, SynthID-Image advances practical, scalable provenance for AI-generated media, while acknowledging remaining challenges in security, open-model deployment, and cross-platform interoperability.

Abstract

We introduce SynthID-Image, a deep learning-based system for invisibly watermarking AI-generated imagery. This paper documents the technical desiderata, threat models, and practical challenges of deploying such a system at internet scale, addressing key requirements of effectiveness, fidelity, robustness, and security. SynthID-Image has been used to watermark over ten billion images and video frames across Google's services and its corresponding verification service is available to trusted testers. For completeness, we present an experimental evaluation of an external model variant, SynthID-O, which is available through partnerships. We benchmark SynthID-O against other post-hoc watermarking methods from the literature, demonstrating state-of-the-art performance in both visual quality and robustness to common image perturbations. While this work centers on visual media, the conclusions on deployment, constraints, and threat modeling generalize to other modalities, including audio. This paper provides a comprehensive documentation for the large-scale deployment of deep learning-based media provenance systems.

Figures (4)

• Figure 1: Quality as evaluated by human raters against FNR at 0.1% FPR averaged across various image transformations. Each model is calibrated to obtain 0.1% FPR (more details to follow in Section \ref{['sec:results']}). The quality is measured on the y-axis by looking at the difference in artifact rates between watermarked and non-watermarked content. SynthID-O (our external variant of SynthID-Image available via partnerships) achieves the highest quality (i.e., lowest perceptibility) and robustness (i.e., lowest brittleness) compared to other baselines.
• Figure 2: Illustrative images generated using Imagen for different categories of prompt. These images (either watermarked or not) are shown to external human raters and include corner-case images such as grayscale photographs, sketches or close-to-uniform color images.
• Figure 3: Illustrative examples of the 30 "basic" transformations used in our evaluation (alphabetically listed).
• Figure 4: Quality metrics for all methods computed on 1,000 watermarked and unwatermarked images. The top-left panel shows the average difference in identified artifact rate between watermarked and non-watermarked samples (lower is better). A 5 percent point increase indicates that the watermarking method creates visible artifacts in 5% of the images. For FID, CMMD and LPIPS the lower is better and for PSNR and SSIM the higher is better. Overall, we see little correlation between computational metrics and human ratings.