# SynthID-Image: Image watermarking at internet scale

arXiv: https://arxiv.org/abs/2510.09263 · HTML: https://mlsanity.com/paper/2510.09263/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Builds on 67 of its 122 references that are in the map.
- First posted on arXiv 10 Oct 2025.

## Builds on (most cited first, 30 of 67)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [LLaMA: Open and Efficient Foundation Language Models](https://mlsanity.com/paper/2302.13971/) (2023)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Benchmarking Neural Network Robustness to Common Corruptions and Perturbations](https://mlsanity.com/paper/1903.12261/) (2019)
- [BLOOM: A 176B-Parameter Open-Access Multilingual Language Model](https://mlsanity.com/paper/2211.05100/) (2022)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Ethical and social risks of harm from Language Models](https://mlsanity.com/paper/2112.04359/) (2021)
- [Deep Anomaly Detection with Outlier Exposure](https://mlsanity.com/paper/1812.04606/) (2018)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [A Watermark for Large Language Models](https://mlsanity.com/paper/2301.10226/) (2023)
- [Evasion Attacks against Machine Learning at Test Time](https://mlsanity.com/paper/1708.06131/) (2017)
- [Stealing Machine Learning Models via Prediction APIs](https://mlsanity.com/paper/1609.02943/) (2016)
- [Defending Against Neural Fake News](https://mlsanity.com/paper/1905.12616/) (2019)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Rethinking FID: Towards a Better Evaluation Metric for Image Generation](https://mlsanity.com/paper/2401.09603/) (2023)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [Knockoff Nets: Stealing Functionality of Black-Box Models](https://mlsanity.com/paper/1812.02766/) (2018)
- [Undetectable Watermarks for Language Models](https://mlsanity.com/paper/2306.09194/) (2023)
- [Towards Stable and Efficient Training of Verifiably Robust Neural Networks](https://mlsanity.com/paper/1906.06316/) (2019)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust](https://mlsanity.com/paper/2305.20030/) (2023)

## Built on by (most cited first, 30 of 31)

- [Pixel Seal: Adversarial-only training for invisible image and video watermarking](https://mlsanity.com/paper/2512.16874/) (2025)
- [A Survey on Evaluating Quality and Trustworthiness in LLM-Generated Data](https://mlsanity.com/paper/2601.17717/) (2026)
- [Authenticated Contradictions from Desynchronized Provenance and Watermarking](https://mlsanity.com/paper/2603.02378/) (2026)
- [RAVEN: Erasing Invisible Watermarks via Novel View Synthesis](https://mlsanity.com/paper/2601.08832/) (2026)
- [Origin Lens: A Privacy-First Mobile Framework for Cryptographic Image Provenance and AI Detection](https://mlsanity.com/paper/2602.03423/) (2026)
- [Who Gets Flagged? The Pluralistic Evaluation Gap in AI Content Watermarking](https://mlsanity.com/paper/2604.13776/) (2026)
- [Ideal Attribution and Faithful Watermarks for Language Models](https://mlsanity.com/paper/2512.07038/) (2025)
- [Banana100: Breaking NR-IQA Metrics by 100 Iterative Image Replications with Nano Banana Pro](https://mlsanity.com/paper/2604.03400/) (2026)
- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [SynCred-Bench: Benchmarking Synthetic Credibility in AI-Generated Visual Misinformation](https://mlsanity.com/paper/2606.03348/) (2026)
- [MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation](https://mlsanity.com/paper/2608.10166/) (2026)
- [Luminark: Training-free, Probabilistically-Certified Watermarking for General Vision Generative Models](https://mlsanity.com/paper/2601.01085/) (2026)
- [MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation](https://mlsanity.com/paper/2602.01513/) (2026)
- [AWPD: Frequency Shield Network for Agnostic Watermark Presence Detection](https://mlsanity.com/paper/2603.06723/) (2026)
- [Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking](https://mlsanity.com/paper/2603.12949/) (2026)
- [ExpressEdit: Fast Editing of Stylized Facial Expressions with Diffusion Models in Photoshop](https://mlsanity.com/paper/2604.03448/) (2026)
- [Can You Trust What You See? Human and AI Detection of Synthetic Legal Evidence](https://mlsanity.com/paper/2606.07613/) (2026)
- [Position: Preventing AI-Generated CSAM Necessitates New Approaches to AI Safety](https://mlsanity.com/paper/2607.05407/) (2026)
- [Abductive Corroboration of Probabilistic AI Models for Forensic Synthetic Media Detection](https://mlsanity.com/paper/2607.05434/) (2026)
- [VendorBench-100: A Unified Cross-Paradigm Benchmark for Deepfake Image Detection](https://mlsanity.com/paper/2607.06254/) (2026)
- [Beyond AI-Generated Labels: Watermarking, Co-Creation, and Conflation of AI-Generation with Disinformation](https://mlsanity.com/paper/2607.13082/) (2026)
- [Understanding Security and Privacy Perceptions of Content Creators Regarding AI Labels of AI-Generated Content](https://mlsanity.com/paper/2608.08129/) (2026)
- [Minimax bounds for watermarked and masked recursive discrete distribution estimation](https://mlsanity.com/paper/2608.31091/) (2026)
- [FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators](https://mlsanity.com/paper/2609.30982/) (2026)
- [Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition](https://mlsanity.com/paper/2609.31693/) (2026)
- [Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal](https://mlsanity.com/paper/2609.31722/) (2026)
- [Fusion Under Component Failure: Negative Results and Failure Modes in Ensemble AI-Generated Image Detection](https://mlsanity.com/paper/2609.31749/) (2026)
- [Trustworthy synthetic visual media: Evidence across the media lifecycle](https://mlsanity.com/paper/2609.34232/) (2026)
- [Optimizing and Securing the Modern Watermarking Channel for Images](https://mlsanity.com/paper/2609.34744/) (2026)
- [Diffusion Meta-Prompting and Steering for Generalizable Foundation Model Adaptation](https://mlsanity.com/paper/2610.11067/) (2026)

## Abstract (arXiv)

We introduce SynthID-Image, a deep learning-based system for invisibly watermarking AI-generated imagery. This paper documents the technical desiderata, threat models, and practical challenges of deploying such a system at internet scale, addressing key requirements of effectiveness, fidelity, robustness, and security. SynthID-Image has been used to watermark over ten billion images and video frames across Google's services and its corresponding verification service is available to trusted testers. For completeness, we present an experimental evaluation of an external model variant, SynthID-O, which is available through partnerships. We benchmark SynthID-O against other post-hoc watermarking methods from the literature, demonstrating state-of-the-art performance in both visual quality and robustness to common image perturbations. While this work centers on visual media, the conclusions on deployment, constraints, and threat modeling generalize to other modalities, including audio. This paper provides a comprehensive documentation for the large-scale deployment of deep learning-based media provenance systems.