Remove SynthID watermarks & C2PA metadata from AI images

What is SynthID?

SynthID is Google’s family of digital watermarks for AI-generated content. For images, it works in the frequency domain: the generator nudges the balance of low-amplitude frequency components across the picture, embedding a statistical signature that is invisible to the eye. Because the mark is spread throughout the image rather than stored in a corner or a header, it survives operations that destroy ordinary watermarks: cropping, resizing, JPEG re-compression, brightness and filter adjustments. Every image produced by Gemini, Imagen and Vertex AI carries it by default, which makes SynthID the de facto provenance layer for a large share of AI images on the web.

Why stripping C2PA metadata leaves SynthID untouched

C2PA Content Credentials are the other half of AI provenance: a signed, tamper-evident manifest embedded in the file itself that records how the image was made. They are metadata: EXIF, XMP and the C2PA manifest all live in the file’s headers, separate from the pixels. That is why metadata removal can be perfectly lossless: rewrite the container and the manifest is gone without touching a single pixel. But a SynthID watermark is not in the container. Deleting the metadata does not weaken it at all, and re-saving the file keeps it fully intact. Any tool that only strips metadata has done nothing to the pixel-level signal, however useful that is for the file-level “AI info” trigger.

How watermark removal actually works (and why invisible tweaks fail)

The naive ideas all fail against a frequency-domain mark. Cropping removes pixels but the signature survives in what remains. Screenshots and re-encodes re-quantize the image yet preserve the statistical pattern. Even deliberate “invisible” perturbations (a light blur, a subtle noise layer) leave the low-frequency structure of SynthID readable. What does work is regeneration: re-creating the image content with a diffusion model at a measured strength rewrites the image’s frequency content, so the embedded signature is disrupted rather than merely dented. The trade-off is mathematical and unavoidable: stronger disruption means larger changes to the image. That is why WipeTheAI reports an exact similarity score (SSIM) for every processed image instead of claiming the watermark is simply gone.

Limitations & responsible use

There is no public detector for production SynthID-Image, so no honest tool can prove removal. Our verification uses Google’s Gemini provenance check. The published recipe’s outputs were judged clean by that oracle, which is a classifier assessment, not Google’s production detector, and not a guarantee. Disrupted is not the same as provably removed, and a platform’s own server-side classifiers may label an image regardless of what its file says. Legally, cleaning images you created or are licensed to modify is generally fine; the line is misrepresentation. The EU AI Act’s transparency duties, phasing in through 2026, require AI-generated content to be labelled in many contexts, and platform terms typically require the same. Use WipeTheAI on your own content, for robustness research, and keep disclosing where the law or the platform asks you to.

Longer write-ups, with sources: how SynthID works, what a C2PA manifest records, what we tested against SynthID and the rest of the guides.

We can’t prove a watermark is gone, and our about page explains why, along with where we stand on who gets to remove it.