watermarking.media
Ownership

How to check if an image has SynthID (and what the check can't see)

By The watermarking.media team
• 5 min read
Contents

To check an image for SynthID you upload it to a reader built for that exact mark, either Google’s SynthID Detector portal or OpenAI’s Verify tool, but as of this writing there is no frictionless public scanner for an arbitrary image, and a clean result never proves the image is not AI. SynthID is an invisible, in-pixel watermark, so there is nothing to see by eye and no metadata field to inspect. The only way to know is to run the file through a reader that can score that specific signal. This is a guide to the readers that exist, what a hit actually tells you, and the much larger set of things the check cannot see.

What SynthID is, in one line

SynthID is Google DeepMind’s invisible watermark: a post-hoc, model-independent spectral mark added on top of finished AI pixels and read back by a matching decoder that scores a 136-bit payload with a conformal p-value test, with each model calibrated to a 0.1 percent false-positive rate (Gowal, Bunel & Stimberg, 2025). The full mechanism is in What is SynthID?. The point for checking is that the mark is statistical and keyed, so you cannot eyeball it and no generic scanner will surface it.

The readers that actually exist today

Two readers can report SynthID as of this writing, and neither is an open, general-purpose scanner.

Google’s SynthID Detector is the first-party portal. Its pitch is simple, “Just upload an image, video or audio file”, and it covers all three media (Google DeepMind, 2026). The catch is availability: Google says it is “currently collaborating with journalists and media professionals to test the portal”, so access runs through an early-tester waitlist rather than an open page. An ordinary user cannot yet freely run it on any image.

OpenAI’s Verify tool is publicly accessible and reads both Content Credentials and SynthID from an uploaded file (OpenAI, 2026). The important limit is scope: Verify is built to confirm whether an image came from OpenAI’s own tools, ChatGPT, the OpenAI API, or Codex, so it is the right reader for an image you think came from ChatGPT, not a universal SynthID scanner for, say, a Google-generated picture. Between the two, there is no open reader that will answer “does any SynthID mark live in this arbitrary file” for everyone today.

What a positive actually means

A SynthID hit is strong but narrow evidence: it means a SynthID-enabled model produced or processed the image (Gowal, Bunel & Stimberg, 2025). Until 2026 that meant a Google model. It no longer does. Since OpenAI adopted SynthID, a hit now means “a SynthID-adopting provider made this”, and that list is a growing one that includes both Google and OpenAI. So read a positive as “made by one of the providers that embeds SynthID”, not “made by Google”.

What the check cannot see

This is where most people over-read the result. A negative is weak. The SynthID design is scoped to make black-box attacks “computationally infeasible at scale” rather than to defeat “a determined white-box adversary” (Gowal, Bunel & Stimberg, 2025), and the decoder is meant to run across “the majority of content that is shared on the web” at a 0.1 percent false-positive rate. That tuning tells you what absence means: the overwhelming majority of images never passed through a SynthID-enabled model, so no-mark is the default state of almost everything, AI or not. A clean result is not a certificate that the image is real or human-made.

Absence can also mean the mark was there and is gone. Research has shown the class of pixel-additive marks SynthID belongs to is removable: Zhao, Zhang & Wang (NeurIPS 2024) prove such watermarks are removable by generative regeneration, diffusion purification strips low-perturbation marks “by applying minimal changes to images” (Saberi, Sadasivan & Rezaei, ICLR 2024), and research has separately shown SynthID’s own spectral notch can be located with roughly 90 percent accuracy. None of that is a procedure this site will hand you; it is simply the reason a clean reader is not proof of anything.

And a SynthID reader only reads SynthID. Point it at a different watermark scheme and it returns nothing, because invisible-watermark detectors are scheme-specific, not universal. For what other readers exist, see Invisible watermark detectors: what actually exists.

Check for C2PA at the same time

Because SynthID is only half the provenance picture, check the metadata layer in the same pass. Many AI images also carry C2PA Content Credentials, a signed manifest that records the generating model. OpenAI Verify reads both signals at once; for C2PA specifically you can also use Content Credentials Verify (CAI Verify), the C2PA bundle’s own verifier (Content Credentials Technical Whitepaper, 2025). A file can carry a C2PA manifest and no SynthID, a SynthID mark and no manifest, both, or neither, so a single reader is never the whole answer.

A SynthID check can confirm origin when it fires, but it cannot rule origin out. For the “which mark am I even looking for” question, see Is my AI image watermarked?, and for what ChatGPT specifically embeds, see Does ChatGPT watermark its images?.

Sources

#synthid#watermarking#detection#ai-images#provenance