forensics.media Subscribe

Invisible watermark check

Does this image carry a Stable Diffusion watermark?

Stable Diffusion, SDXL and FLUX quietly stamp a fixed invisible watermark into the pixels of the images they generate, using the open invisible-watermark library. That mark has a public decoder and no secret key, so this tool can read it back in your browser and, if it finds one, name the pipeline that made the image. It is a one-way signal: a hit is a confident yes, a miss is not a no.

Runs entirely in your browser. Your image is never uploaded or stored.

This teaches one basic forensic signal, read in isolation. It is a lead, not a verdict, and can be fooled on its own — real confidence comes from combining several independent signals and understanding the relationship between them.

What this reads, and what it can't

There are two families of invisible AI watermark. The first is open: the invisible-watermark library that Stable Diffusion, SDXL and FLUX use embeds a short, fixed bit-pattern into the image's chroma using a wavelet transform, and both the algorithm and the exact pattern are public. That is what this tool decodes, so a match tells you the image came out of one of those pipelines. The second family is proprietary — SynthID from Google and OpenAI, and the API-only watermarks from Amazon and others. Those have no public decoder, so this tool cannot read them from the pixels. SynthID can still be caught indirectly: a Gemini image usually gives itself away with its visible sparkle (see the visible AI mark finder), and Google and OpenAI attach a C2PA "made with AI" manifest you can read with the metadata viewer.

Why a miss is not a clean bill of health

The open mark is fragile. It lives in the chroma channel, which clamps to 8 bits on bright or flat images, so a valid watermark often fails to decode on exactly those pictures. It also does not survive a JPEG re-save, a resize, a crop or a screenshot. And plenty of AI images carry no open mark at all: re-hosted output, re-encoded exports, and generators like Midjourney embed nothing here. So a miss can mean the image is not from SD/SDXL/FLUX, or that it is but the mark was destroyed. To separate those, the tool runs a carrier check: it embeds a test watermark into your own image and reads it back. If the test survives, this picture could hold the mark, so a real miss is meaningful; if the test does not survive, the picture cannot hold the mark and a miss tells you nothing.

How to read the result

What you seeWhat it means
Open watermark found (SDXL / FLUX / SD 1.x)High confidence the image was generated by that pipeline. The pattern matched to within a few bits of an exact, known payload.
No watermark, carrier check strongNo open mark, and this image could have held one — so it is likely not pristine SD/SDXL/FLUX output. Still not proof it is real (it could carry SynthID, or be another generator).
No watermark, carrier check weakInconclusive. This image is too flat, bright or re-compressed to hold the mark, so the absence tells you nothing.

What fools it

Anything that re-encodes or resamples the pixels: saving as JPEG, resizing, cropping, or screenshotting all wipe the open mark, and the tool will then read a miss. It is also blind by design to SynthID and to any proprietary or API-only watermark. Treat a hit as a strong lead and a miss as unproven, and pair this with the metadata viewer (for C2PA "made with AI" provenance) and the diffusion detector before drawing a conclusion.

Sources

  • ShieldMnt / Stability AI, invisible-watermark (open-source library; the dwtDct DWT-chroma scheme decoded here). The reference decoder this tool ports.
  • An, R. et al. (2024). WMAdapter: Adding WaterMark Control to Latent Diffusion Models. arXiv:2406.08337. Measures DWT-DCT bit accuracy at ~0.79 on clean images, collapsing under JPEG/crop.
  • Saberi, M. et al. (2024). Robustness of AI-Image Detectors (WAVES benchmark). arXiv:2401.08573. Positions DWT-DCT among low-robustness watermark schemes.

Note: the decoder is ported faithfully from the reference library, but validating an exact bit-match against genuine generator output would need a pristine SD/SDXL/FLUX sample; the carrier check confirms the pipeline works on your image. Read a hit as high-confidence, never a miss as proof of a real photo.