SynthID and invisible watermarks versus metadata
Watermarks live in the pixels, metadata in the file. What each can and cannot protect against, and why AuditImage only reads metadata.
Two different roads
There are two ways to mark AI content:
- Metadata: write a declaration into the file's metadata segments. C2PA, IPTC DigitalSourceType and the AIGC implicit label are all this. Readable, structured, signable, and gone the moment someone strips it.
- Invisible watermarks: embed a marker into the pixels themselves in a way the eye cannot see. Google's SynthID, Meta's Stable Signature and the Adobe / Digimarc schemes are this. They survive screenshots, crops and compression with some probability, but only whoever holds the detector can read them.
What SynthID is
SynthID is Google DeepMind's watermarking technology for images, video, audio and text from Imagen and Gemini. The image version nudges pixel values at generation time to embed a signal that is invisible to people and recognisable to Google's detector. In 2025 Google opened a SynthID Detector portal and built detection into Gemini and Google Search.
It is not metadata. No field in the file says "SynthID". Looking at an Imagen picture with exiftool or AuditImage shows only the C2PA or IPTC markers Google also writes (if they survived), never the watermark itself.
Weaknesses of each
Metadata: lost on any re-encode; forgeable unless signed; transplantable.
Invisible watermarks: only the company that owns the model can detect them, so third parties cannot verify; strong geometric transforms, repainting or adversarial attacks weaken them; different companies' watermarks are incompatible; they cannot express structured information like who, with what, and what was done.
Why they complement each other
The C2PA specification reserves a place for a "soft binding": the manifest can record a watermark ID, and if the manifest is stripped but the watermark survives, the ID can lead back to the manifest. Google, Adobe and Digimarc are all pushing this combination. The ideal is a signed manifest in the file and a watermark in the pixels, each pointing at the other.
What AuditImage does and does not do
AuditImage reads only the metadata segments: C2PA, EXIF, XMP, PNG text chunks, the AIGC label. It does no pixel-level analysis, so:
- It cannot detect SynthID or any invisible watermark.
- It does not make statistical "AI image classifier" guesses either.
An Imagen picture with its metadata stripped gets the verdict "No usable metadata" here. To check for a watermark, use Google's SynthID Detector. For a statistical guess, use a dedicated classifier and understand its error rate.
Advice for publishers
If you want your work to be recognisable by origin: export with a C2PA-capable tool and keep the original; if you use Google's or Adobe's generators they write both a watermark and a manifest; when publishing, prefer channels that preserve metadata.