Testing SynthID: Is Detection Still Accurate After Screenshots and Metadata Removal?

Google DeepMind's SynthID watermark now covers over 18 billion images and videos, and its detection portal, SynthID Detector, is open to the public. But how reliable is the watermark really? The author tested Gemini-generated images across scenarios like screenshots, metadata stripping, and embedding into real photographs, and the results reveal a number of boundaries worth paying attention to.

SynthID and C2PA: Two Sets of Markers in One Image

Images generated by Gemini actually carry two independent sets of markers. One is C2PA Content Credentials, which are signed metadata recording the creator, tools, and editing history, weighing about 6 KB; the other is SynthID, embedded directly into the pixels.

The two have very different fates. After the author resaved the image as a 1080px JPEG, the C2PA manifest completely disappeared, while the SynthID watermark remained. This means any decode-then-reencode operation—thumbnails, format conversion, resizing—will discard C2PA, but SynthID survived in the author's tests.

Reading C2PA is straightforward: using c2pa-python (version 0.38.0), you can parse out the issuer as Google LLC, the action as c2pa.created, and the digital source type as trainedAlgorithmicMedia—the IPTC standard classification for generative model media. If you don't want to write code, contentcredentials.org/verify can also show the same manifest in the browser.

But SynthID can only be read through Google's own tools, which is precisely its closed nature.

C2PA (Coalition for Content Provenance and Authenticity) is an open standard initiated by Adobe, Microsoft, BBC, Truepic, and others, aiming to provide verifiable provenance information for digital content. It writes data such as creator, tools, and editing history into an encrypted signed structure called a "manifest," typically embedded in the file's metadata region. Because the signature binds to the file's byte stream, any decode-then-reencode operation invalidates the signature, so C2PA's strength lies in "intact delivery" scenarios, such as news organizations publishing original images.

SynthID, on the other hand, is a pixel-level watermarking scheme developed by Google DeepMind. It doesn't rely on the file container; instead, during image generation, a deep learning model directly embeds statistical signals into pixel values, so that the watermark can still be extracted by a dedicated detector even after slight transformations (such as lossy compression, cropping, scaling). The trade-off is limited watermark capacity—it can only answer the binary question "was this generated by a certain partner?" and cannot carry rich provenance information. The two markers complement rather than exclude each other: C2PA provides detailed history but is fragile, while SynthID is robust but carries minimal information and has a closed ecosystem.

Can It Still Be Detected After a Screenshot?

The author opened a Gemini-generated image in Chrome, saved a screenshot as a 2048×1523 PNG, and uploaded it for detection. In two runs, Gemini answered that "all or most of this image was edited or generated by Google AI." The second answer also specifically noted that "no reliable C2PA content credentials were detected," indicating the detection signal came from the pixel watermark, not metadata.

However, not all screenshot tests were consistent. Digital Information World's screenshot test on the SynthID Detector website—the same image was flagged as a standalone file, but not flagged as a screenshot. The two sets of tests used different tools (the Gemini app vs the Detector website), so they shouldn't be directly compared. But the author also acknowledges that a screenshot itself undergoes scaling, browser re-rendering, and format conversion, making it a weaker test condition than the original file.

Google's official description of SynthID image watermarks is also fairly measured: the design goal is to withstand cropping, adding filters, changing frame rates, and lossy compression—screenshots are not on that list.

Actual Results from Six Test Files

The author generated two 2400×1792 pixel photorealistic images, then constructed six test files. The core findings are as follows:

Original Gemini image (with metadata): Gemini read from the C2PA metadata that it was "created with AI by Google LLC, then edited with AI tools," with no mention of SynthID at all.

File with metadata removed, pixels unchanged: Gemini answered both times that "all or most of this image was edited or generated by Google AI," with the signal coming from SynthID.

Screenshot file (PNG): Also flagged, same as above.

NASA real photograph (Kennedy Space Center, 2023): Returned "no reliable signal detected," no false positive.

Real photo with sky modified by Gemini: Gemini read the newly added C2PA signature from the modification, identifying it as "generative AI creation edited with generative AI tools."

AI image shrunk and pasted into the corner of a real photo: Returned "no reliable signal detected"—a miss. Digital Information World also observed a similar phenomenon: when an AI image covers more than half of a new image, the Detector website judged it as "unlikely to come from a SynthID partner."

What a Negative Result Means

The author's core conclusion is: positive results have high credibility, but negative results can only be treated as "unknown."

There are three reasons. First, SynthID only recognizes partners: Google lists itself, OpenAI, NVIDIA, and Kakao, with Apple joining soon. Images produced by Midjourney, Stable Diffusion, or any generator that doesn't embed SynthID will always return "no watermark detected," but that doesn't mean the image is real.

Second, composites and local edits are prone to missed detection. The scenario of a shrunk AI image embedded into a real photo has been proven to fail.

Third, the detection tool itself has had problems. Lead Stories found that within the same conversation, Gemini would repeat the first file's judgment for the second file, affecting both images and videos. Google subsequently stated that a fix had been rolled out globally, but the author still insists on starting a new conversation for each file to avoid residual effects.

The author also found that the way the question is asked affects the result. When initially asking "Was this image created or edited by Google AI? Please check the SynthID watermark," Gemini answered that it couldn't check the watermark for the metadata-stripped file; after switching to Google's suggested phrasing, "Is this AI-generated?", it successfully detected the watermark both times.

False positives and false negatives are key to understanding watermark reliability. A false positive means the detector incorrectly flags content created by humans or generated by non-partner AI as "generated by a SynthID partner," while a false negative means a genuinely watermarked image fails to be detected due to transformations, being too small, being occluded, and so on.

In machine learning evaluation, these two error rates usually need to be reported together, but SynthID's detection side does not disclose its thresholds or training distribution, so outsiders can only estimate through black-box testing. From the author's and Digital Information World's tests, the risk of false negatives is clearly higher than false positives—a shrunk AI image embedded in a real photo or a screenshot uploaded to a website may both be missed. False positive cases are extremely rare, and Google also emphasizes that its detector has strict false-positive controls. This asymmetry means: when a watermark is detected, you can be almost certain the image comes from a partner; when it is not detected, you cannot infer anything about the image's authenticity, because there are too many paths to a miss. Interpreting "not detected" as "real" is a common logical fallacy and the biggest cognitive trap for watermark systems in forensic scenarios.

Practical Detection Advice

For ordinary users, the author gives a clear inspection path: open a new conversation in the Gemini app, upload the image, and ask "Is this AI-generated?"—when C2PA is present it reads the metadata, and when it isn't it reads the SynthID watermark. When you need to cover partner watermarks or see which regions of an image are most likely to carry a watermark, use the Detector at synthid.com. To view signature history, use contentcredentials.org/verify.

For developers building image processing pipelines, there is an easily overlooked pitfall: any decode-then-reencode step will lose the C2PA manifest. If a product needs provenance information, it should actively pass the manifest through a C2PA SDK rather than relying on the watermark as the sole safeguard. Although SynthID withstood resaving and screenshots in these tests, only Google's tools can read it.

As for text watermarking, SynthID Text is open source and has been integrated into Hugging Face Transformers 4.46 and later, passed as a watermarking config to generate(), with a Bayesian detector. But text detection is probabilistic, and the author did not test it.

The principle most worth remembering: a clean result should be read as "unknown," not "real."

For developers who need to handle image provenance in production environments, C2PA provides official SDK support, such as the Rust implementation c2pa-rs and its Python binding c2pa-python, as well as @contentauth/c2pa-node for Node.js. These libraries allow signature verification during the read phase and re-signing and manifest embedding during the write phase, thereby actively preserving provenance information in decode/encode pipelines rather than passively relying on pixel watermarks.

In practice, a "dual-track" strategy is recommended: for high-value assets (such as news images and official releases), re-sign with the C2PA SDK after each processing step to ensure the metadata chain remains intact; for user uploads or images forwarded on social platforms, since metadata has usually been stripped, you can only rely on pixel watermarks such as SynthID as a last weak signal. It is worth noting that the C2PA specification itself is also evolving, and version 2.x adds explicit labeling fields for AI-generated content (for example, in addition to trainedAlgorithmicMedia, it also supports compositeWithTrainedAlgorithmicMedia, etc.). Developers should pay attention to version compatibility when designing pipelines to avoid old manifests becoming unverifiable due to specification upgrades.

One-line Summary

Google's SynthID watermark remains detectable after screenshots and metadata removal, but misses occur and negative results only mean unknown.

Paragraph Summary

The article tests the reliability of Google's SynthID watermark and C2PA metadata. Gemini-generated images carry both C2PA signed metadata and the SynthID pixel watermark. After resaving or screenshotting, C2PA is completely lost, while SynthID can still be detected by Gemini in most scenarios. However, detection fails when a shrunk AI image is embedded into a real photo. SynthID only recognizes content from Google and partners such as OpenAI, NVIDIA, and Kakao; images from other generators always return not detected. Question phrasing also affects results. The core conclusion is: positive results are credible, but negative results can only be treated as "unknown" and cannot be used to infer that an image is real. Developers should note that decode-then-reencode loses C2PA, and should actively pass manifests through SDKs.