Hacker News Reader

Comment by CSMastermind | Hacker News Reader

Aren't these kinds of watermarks easy to remove or distort? Seems like they're only helpful as long as people are relying on them sparingly so it's not worth the effort to circumvent.

If social media platforms started banning images with these watermarks seems like they'd be stripped out overnight.

View on HN

No, they are very resistant to modification that can be done easily. That being said I doubt it is impossible

I’m surprised! I guess I’m being naive but I would imagine you could pass an image to an image model without synthid and have it reconstruct the image in a net new way without the markers. I guess I’m wrong? That’s cool if the watermarks are so deeply ingrained that they persist

As I understand it, they modify the image by applying a special Gaussian noise filter which affects each pixel in the image in subtle (possibly not reversible) ways. The detecting service will look for this noise pattern to flag it, so even a part of the image is enough to know it was generated by AI.

Yes, Gemini can actually say how much of the image is AI generated.

Yeah cropping, color shifting, resizing and compression don’t remove it. That said, there’s pretty well known workarounds:

https://github.com/wiltodelta/remove-ai-watermarks

The sort of people that generate AI images that need a watermark are not exactly the kind of people prone for this sort of effort.

Define easily. There is an approach that apparently works and is based on spectral analysis of the images.

https://github.com/aloshdenny/reverse-SynthID

FWIW there are a few people in the issues saying that the tool is giving false negatives and the output image gets flagged by the actual Gemini API as having SynthID. Most recently 3 weeks ago without a response.

I still don't think there's a single GitHub repo that actually removes real SynthID watermarks from Nano Banana 2/NBPro outputs. Most of them are just some research projects that haven't achieved this. The only methods so far I've seen are weird tricks with transparency/overlaying the original image if you're using edits, and also using a diffusion model to regenerate the NB-generated image at low noise levels, but this also modifies the original.

Right I think that’s why you probably need to start with very low levels of denoising and experiment with different approaches.

Set up as a ComfyUI workflow that does a few things: it tries SDXL, Flux, and a couple of different denoising methods at the lowest possible strength (progressively incrementing) to avoid changing the image too much, while also running a SynthID check each time, and repeating this in a loop until the watermark is essentially gone.

At the same time, you’d probably want to add some kind of threshold based on a perceptual hash aka the maximum perceptual quality difference you’re willing to accept.

This one was released a few years ago and still seems unbroken. I'm sure it will be broken at some point, but if you have to wait a year or two from when you make a deepfake until you can post it on Facebook, maybe that's enough. Maybe even a month is enough.

I imagine the technique of having AI recreate the image from scratch based on a very detailed description might work.

That'd not work with today's technology. No open model's prompt adherence is anywhere remotely close to ChatGPT/NanoBanana. 'remotely' here is a funny understatement, as I don't have a strong enough word in my vocabulary to describe how far the open models are behind the closed ones.

Writing a more detailed description does not make the models stick to it more.

Definitely. I run an entire site built around a series of benchmarks that focus on prompts of increasingly difficult complexity with a focus on adherence, and even the state-of-the-art local models are probably only about thirty percent as good as proprietary models like Gemini 3.1 Flash Image and GPT Image 2.

Comparing Qwen-Image, Flux.2, ZiT, NB2, and gpt-image-2

https://genai-showdown.specr.net/?models=qi,nbp3,f2d,g2,zt

Reply on news.ycombinator.com