Google's Public SynthID Detector Tests the File, Not the Story

A missing watermark is an easy result to overread. A person checking a disputed photograph wants to know whether the scene happened. A watermark detector answers a narrower question about the file. Google's decision to open SynthID detection to the public makes that distinction more consequential: more people can consult the tool, including people who have never needed to think about the difference between an image's production history and the truth of its caption.

Google's October 7 announcement says the new detector is available globally in English. It accepts images, video and audio, with support for content from Google, OpenAI, NVIDIA and Kakao. Apple support is described as coming, not already available. This is a material access and interoperability change. It is not a claim that Google can recognize every synthetic file made by every system. The announcement establishes the launch; it does not provide an independently measured error rate for the public service.

The useful starting point is the watermark itself. In its original August 2023 explanation, DeepMind described two jointly trained learning systems: one embeds a signal in an image's pixels, and the other detects it. That is different from putting a visible stamp in a corner. It is also different from relying entirely on a file's accompanying metadata, which can disappear when the file is edited. The engineering objective is to preserve a detectable signal without making the image visibly worse. DeepMind said common transformations could leave the mark detectable, while explicitly warning that extreme manipulation could defeat it.

That design creates a practical asymmetry. Finding an intentionally embedded signal can provide evidence about a production process. Failing to find one leaves several possibilities open, including a file that never carried the supported mark. Consider a hypothetical product listing: a seller submits a fabricated photograph produced outside the supported ecosystem. A negative SynthID result would not test whether the pictured product exists. A marketplace that treated that result as approval would have changed the question halfway through its review.

SynthID also covers several kinds of media, but they should not be flattened into one technical mechanism. Google's product documentation describes image and video watermarking, an inaudible signal in generated audio, and a separate text approach that adjusts token probabilities. The current public launch names images, video and audio. It should not be read as a simultaneous announcement of a public detector for arbitrary written passages. For a builder specifying a review process, the first requirement is therefore mundane: identify the exact medium and supported operation before selecting the verification step.

The historical rollout explains why the new access matters. In May 2025, Google introduced a detector portal for early testers, including journalists, media professionals and researchers. That announcement described highlighting likely watermarked regions of images and segments of audio, alongside work to extend the partner ecosystem. A restricted tester portal gives specialists access; a public destination lets a much wider audience ask the question. Neither availability model, by itself, establishes how well people interpret the answer. More accessible verification still needs a carefully bounded explanation of what was verified.

Ars Technica's October 7 reporting adds an operational constraint: users need an account, and Google describes an approximate daily quota of ten checks. Ars also reports less localized detail than the internal tool provides. These are reported service characteristics, not measurements from our own upload tests.

The public welcome screen supplies an even firmer boundary for integration plans. Its terms prohibit programmatic bulk verification through the frontend, quota evasion and attacks on the watermarking system. A team should not treat the availability of a website as permission to turn it into an undocumented API. If a business needs continuous screening of submitted media, the unresolved requirement is an authorized service arrangement appropriate to that volume. A browser form intended for individual checks does not establish the throughput, support or integration rights that such a business would need.

This is where a seemingly small product release reaches operating design. Imagine a newsroom receiving a large batch of images during a breaking event. It could reserve limited checks for files whose provenance would materially affect a publication decision, rather than spend them indiscriminately. It should record which file was checked and the precise result, without silently extending that result to every derivative or neighboring image. That is a proposed workflow, not evidence that a particular newsroom has adopted it. The point is to make the scarce verification step answer a defined editorial question.

Privacy deserves its own reading, separate from detection quality. The portal notice says original uploaded media is deleted after results are returned. It also says a digital signature tied to the user's identifier is kept for anti-abuse purposes and deleted after 24 hours. Third-party sign-in identifiers are processed and retained for authentication and abuse prevention. Those statements describe different records with different treatment. They should not be compressed into a claim that nothing associated with a check is retained.

For sensitive work, the resulting decision comes before the upload. A company investigating a leaked design, or an editor handling a confidential source's photograph, should establish whether sending that material to the service is permitted. A promise about deletion after processing does not answer whether the initial disclosure is acceptable. Nor does a watermark result resolve the underlying confidentiality issue. Verification policy and information-handling policy need to meet at the same decision, rather than one being discovered after the other has already sent the file.

There is independent evidence that the watermark can survive substantial degradation, with important limits. In July, Ars tested one fully generated image and one AI-edited photograph through repeated resizing and compression. The marks remained detectable after severe degradation; further cropping eventually caused detection to fail. That is a useful test of those examples, not a representative accuracy study across all media, transformations or partner systems. It also predates the new public detector. The defensible conclusion is that durability can be demonstrated in particular conditions without becoming a promise of universal persistence.

A serious evaluation should preserve that distinction in its design. For example, an organization could assemble media it is authorized to test, with known creation histories and routine edits representative of its own publishing chain. It should keep an unmarked control set as well as supported marked examples. The question is not whether it can produce one dramatic success or failure. It is whether the resulting evidence is useful at the point where staff actually make a decision. Such evaluation must respect the service's terms and should not become an attempt to optimize watermark removal.

Watermarks are only one part of provenance. The C2PA Content Credentials explainer describes a digitally signed structure that binds assertions about an asset's history to the asset. It explicitly distinguishes integrity from factual truth. A credential can help establish who signed a record and whether it was altered; it does not establish that the depicted event happened as claimed. C2PA also describes optional, potentially incomplete histories and ways to recover externally stored credentials through soft bindings, including watermarking or fingerprint lookup. That is the standard's architecture, not a claim that the new SynthID website exposes all those functions.

This distinction matters in an ordinary editorial example. Suppose a genuine camera photograph carries intact provenance but is attached to a false account of where it was taken. The provenance evidence may remain useful while the caption remains wrong. Conversely, an older family photograph without a credential is not automatically synthetic. The correct response is to investigate the claim being made about the image, using the available history as evidence. A single badge should not be asked to decide authorship, accuracy, consent and publication suitability at once.

For product teams, those separate questions suggest separate records. One field could preserve a watermark finding. Another could hold provenance information supplied with the asset. A human review could record why the content was accepted or rejected for a particular use. This is an architectural recommendation, not a description of Google's implementation. Its advantage is traceability: if the policy changes, the organization can reconsider a decision without pretending that an earlier technical observation meant something it never established.

The strongest counterargument is practical: a limited check may still be substantially better than having no accessible check at all. That is a reasonable case for this launch. Someone evaluating a suspicious file now has a more direct place to seek a supported watermark signal. Demanding perfect coverage before using any evidence would throw away useful information. The appropriate safeguard is not to discard the tool, but to keep uncertainty attached to the result when it moves into a moderation decision, an investigation or a published account.

The next meaningful measure is therefore not simply how many files people check. It is whether those checks improve decisions without giving unsupported confidence to unmarked material. Google has broadened access to a specific kind of evidence. Builders can make that evidence more useful by stating its scope, respecting the access conditions and preserving the other facts needed for a decision. A detector can shorten one part of the investigation. The person publishing the picture still owes the reader an account of what it shows.

LaunchPad positionKeep watermark findings separate from factual verification, upload permissions and publication decisions.