SynthID is Google DeepMind's family of watermarking systems. The image and video variant does not write a string into a header. It modifies the content itself, at generation time, so that a detector holding the same secret key can recover a statistical signal from the pixels.
The embedding, in plain terms
At a high level the embedder perturbs coefficients in a transform domain — typically a block transform or a frequency decomposition — by amounts chosen to sit below the human contrast threshold. The perturbation pattern is keyed. Without the key you cannot read the message; with it, you correlate the observed coefficients against the expected pattern and get a score.
That design explains the properties people notice in practice:
- It survives cropping and resizing. The signal is distributed across thousands of blocks, so removing some of them leaves most of the evidence.
- It survives re-saving. Lossy compression disturbs coefficients, but the perturbation was chosen to be robust to exactly that kind of disturbance.
- You cannot see it. Two images look identical while only one carries a detectable pattern.
What a remover can do
There are four honest routes:
- Container removal. Delete C2PA, EXIF and XMP. Deterministic, verifiable, and it does nothing to the pixel signal.
- Coefficient rewrite. Add a bounded, seeded perturbation to the same class of coefficients the embedder uses. The detector's correlation drops because the observation no longer matches the expected pattern.
- Geometric resampling. Shift by a fraction of a pixel and resample. Cheap, effective against block-aligned patterns, and it costs a little sharpness.
- Regeneration. Run the image through an image-to-image model. Highest disruption, highest visual change, and it is no longer your original image.
Removal is a probability shift, not a switch. C2PA is a switch.
Why "pixel-identical" is a lie
Any coefficient rewrite changes pixel values. ghostframe measures the change as PSNR against the decoded source and reports it. At standard strength the figure is around 43.9 dB; at subtle, around 49 dB. Both are below the threshold where anyone notices in normal viewing, and both are measurable, so we print the number instead of claiming perfection.
The part nobody controls
Detectors evolve. A pattern that scores low against today's checker may score differently after a model update. That is why a clean container plus a bounded rewrite is the right combination: the part that is deterministic is deterministic, and the part that is statistical is measured rather than promised.