How to remove SynthID watermarks (and why nobody can promise 100%)

SynthID is Google DeepMind's watermarking system for AI-generated images, audio, video, and text. Unlike a visible logo, it embeds a statistical signal into the content itself — engineered to survive cropping, compression, color shifts, and screenshots. That durability is exactly why removing it is hard and why any tool promising “100% removal” is selling you a claim it cannot keep.

What SynthID actually is

SynthID modifies pixels (or tokens, for text) in a pattern a matching detector can later recognize with confidence, while staying invisible to a human viewer. Because the signal is spread across the whole image rather than stored in one place, you cannot “find and delete” it the way you strip an EXIF field. Editing pixels weakens it probabilistically — you are lowering a detector's confidence, not deleting a record.

What does not reliably work

• Stripping metadata only — SynthID lives in the pixels, so a clean EXIF/C2PA pass does nothing to the embedded signal.
• A single screenshot or re-save — often weakens but rarely clears a robust watermark.
• Light JPEG compression — designed-in robustness means the signal frequently survives.
• Any tool that shows you a “clean / 0% detected” badge without saying which detector, at what threshold, on your specific file.

What genuinely helps (best-effort)

Meaningfully disrupting a spread-spectrum watermark means changing the pixel statistics enough to fall below a detector's confidence, ideally without visibly degrading the image. In practice that means controlled regeneration rather than a filter:

1. Strip the container firstRemove EXIF, XMP, IPTC, and C2PA so provenance metadata is not doing the detector's job for it.
2. Regenerate, don't just filterA low-strength diffusion pass repaints the image from noise, disturbing the embedded pattern far more than a blur or resize would.
3. Keep strength proportionalHigher strength disrupts more signal but drifts further from the original. The right setting is the lowest one that meaningfully moves the needle.
4. Verify and record residual riskRe-check for known signals and keep an honest note of what remains uncertain — because a single detector passing is not proof the next one will.

How AI Stripped approaches it

AI Stripped runs the container strip deterministically, then routes embedded-signal work to a GPU regeneration stage when model weights are available — with a Node re-encode fallback when they are not. Every run returns an action report that separates what changed from what remains uncertain. We never present a result as guaranteed or permanently undetectable, because that is not a claim any honest tool can make.