Attempting model extraction of Google DeepMind SynthID (Image) Watermark Detector and exploring adversarial machine learning attacks against SynthID – fyx(me)

CTRL K

articles

Attempting model extraction of Google DeepMind SynthID (Image) Watermark Detector and exploring adversarial machine learning attacks against SynthID

What sort of watermarks or identifiers are added to each image?

Removing the basic identifiers

Looking into adversarial attacks

Simple adversarial attacks

Regeneration Attacks

Surrogate models

Conclusion

References

Appendix

NVIDIA Exploring Adversarial Machine Learning (Course Review)

Exploring Autonomous LLM Agents for Capture The Flag problem solving using Prompt Engineering, RAG and Open Source LLMs

ISP Default WiFi Passwords Are Costlier to Keep Than to Crack (Value optimised Cloud GPU password cracking)

Creating a Havoc Module to run commands on all agents at once and map out an environment passively

Replicating Cobalt Strike's Port Scanner BOF for Open-Source C2 | Fast OPSEC-Aware Ping & TCP Connect Scanning in C

OffSec Experienced Penetration Tester (OSEP) Exam Review

minis

Benchmarking Python PCAP Parsers: dpkt vs scapy vs pyshark and finding 100x Speed Improvements

Reverse Engineering "Free VPN" Applications

Reverse Engineering onemillionchessboards.com Frontend with DevTools to Build a Bot

Building a Flask Blog in 3 prompts with AI Coding Tools: Using Cline & MCP Servers in VSCode

Leveraging AI to Automate SEO Metadata Generation for Web Content

AI overthinking more than me with insomnia at 3 am

Creating Lightweight Windows Virtual Machines for your Personal Lab Environment

Create Infinite Email aliases using Cloudflare Email Routing

Improving functionality of Open Source BOFs

Hack The Box: Take It Easy Dare [Easy month] writeups and post-mortem

Hacky Holidays Space Race CTF Competition post-mortem

bazaar

Windows

Active Directory

Lateral Movement

AD Enumeration

MSSQL

Privilege Escalation

Post Exploitation & Looting

Defence Evasion

Misc Snippets

Forensics

Outlook Exchange Server

Linux

Other Commands

Reverse Shells

System Hardening

Phishing

Web Exploitation

PHP

C2 and Red Team Tools

Havoc

Malware Droppers

Vpn, Routing and Tunneling

++ cyber cheatsheets

Ai

Agents

Ai Code Review

Ai Open Source Clients

Inference Providers

Inspecting MC P Servers

Computer Science & Programming

Ai Tools

Dependency Visualisation

Docker

File Synchronisation

Git

Image Modifications

Latex

Orchestration (Workflows)

Qemu Vm Disk Resize Guide

Versioning

VPN

Web Dev Cheatsheet

Web Proxies

Website Design

Wifi

Other

Android

Networking

Password Cracking

Screen Recording

Bottom text

🦧

LightDark

articles

Attempting model extraction of Google DeepMind SynthID (Image) Watermark Detector and exploring adversarial machine learning attacks against SynthID

Attempting model extraction of Google DeepMind SynthID (Image) Watermark Detector and exploring adversarial machine learning attacks against SynthID

February 8, 2026·<br>fyx(me)

Some time ago, prior to taking the NVIDIA Exploring Adversarial Machine Learning course, I read about Google DeepMind&rsquo;s Synth-ID, an interesting technology that aims to add invisible watermarks to generative AI text and images. I was intrigued about the Image watermarking aspect since it claimed to be invisible and could resist certain image modifications like adding filters, changing colours, and saving with various lossy compression schemes. This reminded me of the steganography CTF challenges which basically are challenges that hide data inside images by modifying the least significant bits of an image (ie. the bits that have the little effect on each pixel). By doing so, you can hide data inside images without any visible modifications on the image itself.

I was also speculating that given enough data, you could probably recreate a local model to do the validation. At the time I didn&rsquo;t know where to find the data and I didn&rsquo;t know about offline model attacks in Adversarial Machine Learning (AML) which I learned during the NVIDIA course.

After the course, I knew a lot more about it and was even more interested. I thought it would be epic to create a surrogate model to attempt attacks against it and see if they are effective against the real Synth-ID model. If you want to skip straight there, skip to the Surrogate Model section. Here&rsquo;s a quick taste of what&rsquo;s to come:

Before we get to the surrogate model, I&rsquo;ll start by exploring and recreating some of the attacks against Synth-ID.

What sort of watermarks or identifiers are added to each image?

The visible watermark

The first watermark we all know about is the little Gemini Star placed in the bottom right corner of the image. It&rsquo;s very easily identifiable:

This watermark means two things, you generated the image with Gemini/Nano banana AND you generated the image via the web interface. API generated images do...