Google's SynthID watermark survived 300 rounds of compression in testing, but adoption is the real bottleneck

SynthID Survived 300 Rounds of Compression. Adoption Is the Real Problem.

Google's SynthID watermark survived 300 rounds of aggressive compression and resizing in Ars Technica's stress test, remaining detectable on both fully AI-generated images and AI-edited photos. That is a durability result that would have seemed unlikely a year ago. It is also almost beside the point.

The technology passed its exam. The harder question is whether the exam covers the subject that matters.

A Watermark Built to Survive the Internet

Ars Technica's Ryan Whitwam wrote a Python script using the Pillow library to simulate the data loss images accumulate as they get screenshotted, re-compressed, and reshared across platforms. The script applied random compression and resizing values in successive iterations, then fed each degraded output back as the input for the next round. Whitwam ran the process 300 times on test images created by Google's Nano Banana Pro model 1.

After 300 generations, the full-frame images were barely recognizable blobs. The SynthID watermark was still intact on both the fully generated image and the AI-edited photo. Even taking a screenshot of the degraded image preserved detection, because SynthID's signature lives in the pixels themselves rather than in metadata that a save operation can strip 1.

The watermark did eventually break, but only under a compound attack: 300 compression cycles combined with a 20 percent crop rendered SynthID undetectable on both image types. A larger 50 percent crop broke detection at around 250 iterations, slightly earlier. By either threshold the images were so degraded that nobody would share them in good faith 1.

Compare that to what happened to Meta's Content Seal. A Reuters analysis found that Meta's detection tool failed to verify 55 percent of images generated by its Muse Image model after they were cropped to roughly one-third to one-half of their original size. No 300-round torture test. No compound attack. Just cropping 2.

The gap between the two systems tells you something about where the industry actually stands. SynthID and Content Seal are both invisible watermarks, both backed by companies with billions of users, both pitched as tools to help people identify AI-generated content. One survives 300 compression cycles. The other fails a casual crop. The industry is not converging on a single standard. It is splitting apart.

The Problem SynthID Was Never Built to Solve

Durability is not the same as security. The original SynthID research paper states the watermark was not designed to withstand adversarial attacks, meaning someone actively and deliberately trying to strip it 1.

Google DeepMind scientist Pushmeet Kohli told Ars that the team assumed during development that the technology would be attacked and built the detector to withstand common transformations like filters and crops 1. Some people have already claimed to have cracked SynthID, though Ars could not confirm those claims and Google says it has been unable to reproduce the supposed workarounds 1.

SynthID is not broken. But the original paper already concedes the security boundary, and that boundary gets tested harder every time adoption grows and the incentive to defeat it rises.

Why the Technical Win Does Not Close the Loop

This is where the story pivots from a durability test to a structural problem.

SynthID only labels content from participating AI providers. Google has expanded adoption: OpenAI, Nvidia, Runway, and others have begun using the technology 1. At Google I/O this spring, the company said its tools had produced more than 100 billion AI images and videos in a couple of years 1.

But open-weight image models, whose weights are freely downloadable and runnable by anyone, generate vast quantities of unlabeled content. No mechanism forces their users to embed SynthID or any comparable watermark. A person generating synthetic images with an open-weight model has no obligation to opt in and no technical barrier preventing them from opting out.

This is not a minor leak. Starling Lab, a research collaboration between Stanford University and the University of Southern California, estimates that it took from the invention of the camera until 1975 for humanity to produce 1.5 billion images. Generative AI matched that output in 18 months 1. A labeling system that only catches participating providers covers a fraction of total output, and that fraction shrinks as the open-weight ecosystem grows.

The EU is attempting to close the gap from the regulatory side. Starting August 2, 2026, providers of generative AI systems operating in the EU must mark their outputs in a machine-readable format 3. But a regulation that compels cooperation from providers who are already cooperating does not reach the open-weight models hosted outside EU jurisdiction, run by individuals with no corporate reputation to protect.

What the Stress Test Actually Proves

The Ars Technica experiment proves SynthID is technically excellent at surviving the most common forms of image degradation on the open internet. That is not nothing. C2PA, the competing cryptographic metadata standard, can be stripped out simply by editing and saving an image or taking a screenshot 1. SynthID survives all of that and more.

What the experiment does not prove is that watermarking can solve AI provenance at scale. For that, you need every image generator on the planet to participate, including the ones with every incentive not to. The technology passed its exam. The exam just does not cover the subject that matters most.