Google launches public SynthID Detector

SynthID's core trick is embedding a signal directly into the content rather than attaching it as removable metadata: for images the signature is encoded across pixel values, for video every frame carries its own mark, and for audio the file is converted to a spectrogram and watermarked there before being converted back to sound. Text watermarking works differently again, nudging next-token probability choices in a way that detectors can later count without degrading output quality. Since the technology's 2023 beta, Google says it has watermarked over 180 billion images and videos and roughly 240,000 years' worth of audio content, with built-in checks now folded into Search, the Gemini app, and Chrome handling more than 1 million verification requests a day ^[1].

That scale is the pitch for going public: a detector that already sits quietly inside Google's own products is now exposed as a standalone website anyone can use, and the partner list has grown to include OpenAI, NVIDIA, and Kakao, with Apple Intelligence-generated images set to carry the mark soon ^[3][5]. The underlying claim is that this kind of embedded signal survives ordinary handling, cropping, compression, and filtering, better than a visible logo or caption ever could, which is why Google is positioning it as the default disclosure layer across its entire generative stack rather than a one-off feature.

Google is unusually blunt about the tool's limits, stating plainly that "this is not a general AI detector" ^[2]. SynthID Detector can only recognize watermarks from the companies that have actually adopted the standard, Google, OpenAI, NVIDIA, and Kakao today, Apple soon ^[3][5], which means content generated by any other model maker passes through with no verdict at all. Critically, a negative result does not mean a file is real or unaltered; it only means no recognized watermark was found ^[2], a distinction that is easy to lose in a headline but decisive in practice.

That gap stopped being theoretical almost immediately. A Reddit discussion dissecting the tool pointed out that Google's checker and OpenAI's own detector each only recognize their own respective company's watermark, so running an OpenAI-made image through SynthID Detector, or a Google-made one through OpenAI's tool, returns a clean result that proves nothing about the file's actual origin. The same thread raised a second worry: legitimate human edits layered on top of AI-assisted work, grammar polishing, simple upscaling, risk being flagged as fully AI-generated once a watermark from an earlier editing step is detected, muddying the very trust signal the tool is meant to provide.

Google frames the global rollout as a response to AI content becoming harder for ordinary users to evaluate on sight, but the timing lines up closely with regulation. The EU AI Act's Article 50 transparency requirements took effect on August 2, 2026, and Google signed the EU Code of Practice on July 24, 2026, committing to two machine-readable marking layers ahead of a conformity deadline of December 2, 2026 ^[2]. A detector that works across multiple major model providers, not just Google's own, is a much stronger answer to that kind of regulatory requirement than a single-vendor tool would be.

The launch also lands inside a real commercial tension. An NYU Stern study cited by the IAB found that labeling content as AI-generated cut click-through rates by roughly 31.5 percent ^[2], meaning the same transparency infrastructure that satisfies regulators and builds public trust can simultaneously cost publishers and platforms engagement. That friction, not just altruism, is part of why a standardized, cross-vendor detection layer matters more now than it did at the limited 2025 pilot stage ^[4].

Public availability invites public circumvention, and that cycle is already underway. One Reddit poster built an open tool specifically to strip SynthID watermarks from images, citing concern that the marks can be unique per user, even on paid accounts, and therefore function as a quiet tracking layer rather than a pure provenance signal; the resulting discussion split roughly between people who saw it as legitimate anti-tracking tooling and people who saw it as enabling misinformation. A separate post went further, claiming that a simple screenshot, with an optional upscale, is enough to strip the watermark, though at least one commenter argued this isn't really a deliberate bypass so much as the signal naturally degrading under lossy re-encoding, a fragility rather than an exploit.

Google's own terms of service suggest the company is already bracing for this adversarial dynamic: the service explicitly bans reverse-engineering or black-box attacks against the detector, bulk or automated queries, and quota evasion through multiple accounts, with violations enforced by immediate account suspension ^[2]. Moving from a research pilot to a tool fielding over a million checks a day ^[1]only raises the incentive to find and share ways around it, which makes the current skepticism less a side conversation than a preview of the tool's next hard problem.