SynthID can't tell you who made it.

The workflow is genuinely four steps. Open Gemini, drop the image in, ask “is this made with AI?”, read the answer. There is no portal to log into, no file to upload to a forensics service, no waiting. For the first time the detection is sitting in the same place people already do their asking.

That placement matters more than the model behind it. I have watched plenty of good detection tools die because they lived one tab away from where the doubt actually happened. A check that fires inside the chat you already have open is a check people will use, and they are: Google says the Gemini verification flow has already been run around 50 million times. The friction was always the product, not the math.

Google is extending the same lookup beyond Gemini. At I/O 2026, Sundar Pichai said Google is expanding both Content Credentials and SynthID verification to Search and Chrome. The check is moving to where people already look at images, instead of asking them to carry a file off to a separate service to verify it.

SynthID embeds a statistical pattern into the content itself at generation time. For images and video, it nudges pixels in a way that survives common edits: cropping, filters, frame-rate changes, and lossy compression. For audio, it shifts the waveform in a band you can't hear, and Google says it holds up through MP3 compression, added noise, and speed changes. For text, it biases the token probabilities the model samples from, so the choice of words carries a faint signature.

The key word is signal. The mark is not a field you can read with a hex editor. It is spread across the content the way a watermark is spread across a banknote, which is why ordinary edits don't remove it and why the detector reports a confidence rather than a clean yes or no.

This is the first thing an engineer reaches for, and the answer reveals the whole design. exiftool edits metadata. SynthID does not live in metadata. So the obvious attack misses the target.

That is the cleaner way to see the landscape. There are three separate layers, and they fail to different attacks.

Notice the trade. SynthID is hard to strip because it is baked into the signal, but for the same reason it carries almost no information. It cannot tell you who, when, or on which model. C2PA can carry all of that, because it is a signed manifest, but a signed manifest is easy to drop. You strip C2PA by deleting it and the file is silently unsigned. The robust layer is dumb, and the rich layer is fragile. That tension is the real story.

If exiftool can't touch it, why does a screenshot defeat it? Because a screenshot is not an edit. It is a re-capture. The original signal gets rendered to a screen, recomposited by the operating system, and re-rasterized into a brand new file at a new resolution. Each of those steps adds noise, and the watermark is a faint signal trying to stay above a confidence threshold. Push it down far enough and the detector stops trusting it.

The second gap is simpler. The mark is only there if a participating model put it there. An image painted by a model that never adopted SynthID has nothing to detect, and the check comes back clean. So a negative result means “no mark found,” which is not the same as “a human made this.” The cleanest way to evade the check is not to attack the watermark at all. It is to generate with a tool that never wrote one.

Here is where the original framing needs a correction. The dream people describe is a single check that confirms an image is “true work by a real author” versus AI. SynthID does not do that, and by design it never will. It only sees its own ink. It is blind to a photo a human actually took, because there is no mark to find, and a clean result there proves nothing about authenticity.

The question of who made this and can I trust them is provenance, and provenance needs identity, not a watermark. That is the job C2PA Content Credentials are built for: a manifest signed by the camera, the editor, or the publisher, binding the file to an issuer you can verify. The asset says “Reuters captured me, then Photoshop edited me,” and a chain of signatures backs the claim. Content Credentials can also assert the opposite of synthetic, marking a frame as an unaltered original straight off a sensor.

Google is already shipping this side, not just the watermark. The Pixel 10 camera writes Content Credentials at capture, so a photo can carry a signed claim that it came off a real lens and was never edited. That signed-at-capture identity is the “authentic human work” signal SynthID structurally cannot give you, because a watermark only knows about its own ink and a real camera leaves none.

So the “central management with a user ID” instinct in the original note is the right instinct. It just isn't SynthID's job. You want two layers working together. A watermark to answer was a machine involved, and a signed provenance chain to answer who stands behind this. Neither one alone gets you to “authentic.”

A watermark scheme is only as useful as the share of content that carries it. On that front the figures are the real headline. In his I/O 2026 keynote, Sundar Pichai said SynthID has now watermarked over 100 billion images and videos, plus 60,000 years' worth of audio. That is the kind of volume that makes a positive result mean something.

The adoption list is the part I'd watch. At I/O 2026, Google named OpenAI, Kakao, and ElevenLabs as adopting SynthID too. If the model that generated an image wrote a SynthID mark regardless of vendor, the check stops being a Google-only feature and starts being closer to an industry baseline. A watermark that only one lab honors is a marketing line. A watermark that several major labs write is infrastructure.

The screenshot loophole is an image problem, and it mostly dissolves for video and audio. You can grab one frame of a clip, but you cannot screenshot motion or sound. The SynthID mark is carried across the temporal signal, re-stamped frame after frame and second after second, so capturing a usable copy means re-recording the stream, not snapping a still.

Re-recording is a much taller fence than a screenshot. Run a watermarked clip through a screen-and-mic recapture and you keep the temporal structure the detector keys on, while picking up new noise rather than cleanly erasing the mark. For audio especially, the watermark living in an inaudible band and surviving MP3 compression means the obvious laundering paths leave it intact.

This is the part of the original note I'd underline hardest. For static images, watermarking is a useful-but-leaky check. For synthetic video and voice, the very thing that makes deepfakes dangerous, the watermark has the most room to work, because the signal you'd have to destroy is spread across time and you can't grab it with a single frame.

I'd rather state the limits plainly than oversell the check. Here is what gets past SynthID right now.

None of this makes the check worthless. It makes it a filter, not a verdict. A filter that catches the lazy 90% of synthetic media is still enormously valuable, as long as nobody mistakes a clean result for proof of a human hand.

If the goal is “tell me whether to trust what I'm looking at,” no single watermark gets there. What I'd want is the two layers paired and verified together at the point of viewing.

Layer one is the statistical watermark, SynthID and its industry siblings, answering “did a machine make this” with a confidence. It's the robust, dumb layer that survives ordinary handling. Layer two is signed provenance, C2PA bound to a real issuer identity, answering “who captured or published this” with a verifiable signature. It's the rich, fragile layer that carries the meaning.

The viewer's job then becomes a single readout. Watermark present, so a model was involved. Signature present and valid, so a known publisher stands behind it. Both absent, so treat it as unverified and don't let it move you. That last state, unverified, is the one we're all sitting in for most of what we scroll past, and it's the honest default until provenance is the boring norm rather than the exception.

SynthID is the best AI-media check we have, and the five-second Gemini workflow is real. It lives in the signal, so exiftool can't strip it, but a screenshot or an unmarked model walks right past it.

It answers “did a machine make this,” not “who made this” or “is this authentic.” That second question needs signed provenance, and the two layers only get you to trust when they work together.

For images, treat a hit as strong and a miss as nearly meaningless. For video and voice, take it more seriously, because the mark rides the whole stream and you can't screenshot your way out. Check before you share. Just know exactly what the check did and didn't tell you.