# SynthID-Bypass: a ComfyUI workflow with an unverified watermark-removal claim

> SynthID-Bypass is a proof-of-concept ComfyUI workflow that redraws images and claims to evade SynthID detection. Its visual examples do not establish a detection failure rate, and the result needs independent testing.

**cebeuq/Synthid-Bypass** — Ai safety research showing a working bypass to Google's synthid on Nano Banana Pro

- Repository: https://github.com/cebeuq/Synthid-Bypass
- Stars: 1,014 · Forks: 142
- Language: Python
- License: not declared
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/cebeuq-synthid-bypass

## The deliverable is a ComfyUI graph, not a Python tool

The top level of this repository is unusual for a project that lists Python as its primary language. What sits at the root is `Synthid-Bypass-v2.0.json`, a ComfyUI workflow file, alongside a `V1/` archive of the earlier multi workflow release, a `comparison/` folder of before and after images, a `synthid_analysis/` folder of watermark analysis pictures, a `workflow_screenshots/` folder, a `custom_nodes/` directory and a single `__init__.py`. The README says it plainly: the current release is V2, a single ComfyUI workflow kept directly at the repository root, and V2 replaces the earlier split between general, portrait and GGUF workflow variants. So the thing you would actually run is a node graph that a ComfyUI installation loads, not a package you install with pip. The intended reader is a researcher or an engineer who wants to see, and reproduce, a specific attack on a specific watermark, which is why the repository ships proof images next to the graph and keeps the older release around for comparison.

## The watermark was found by remaking a blank image and turning up the exposure

The repository describes an experiment that modifies the exposure and contrast of a generated image and interprets the resulting patterns as evidence about a watermark. Those visual patterns alone do not identify the watermark or prove how it is encoded. Google describes SynthID image watermarks as imperceptible and detectable with its technology; the project’s interpretation and its proposed bypass remain hypotheses without independent detector-based evaluation.

## The V2 pipeline runs three passes over the source image

The current graph, `Synthid-Bypass-v2.0.json`, combines two model paths and moves through five stages. First, the workflow loads the source image, rescales where needed and computes a denoise target with the `Synthid-Bypass-AdaptiveDenoise` node, which derives the base denoise from the input resolution so the workflow scales more predictably across different image sizes. Second, a single low denoise `KSampler` redraws the image on the Qwen path while a Canny edge map is fed into `QwenImageDiffsynthControlnet` to lock the composition to the source. Third, faces are found with Ultralytics detection and MediaPipe face mesh, refined with SAM, and converted into SEGS masks so the boundaries stay clean. Fourth, the bundled `Synthid-Bypass-Facedetailer` node swaps to a second model for face only cleanup. Fifth, the updated SEGS regions are pasted back onto the main image and the result is written with `SaveImage`. The design point is that the global pass is deliberately weak, and the face pass is what keeps the human details intact.

## Two model paths, one graph, and the reason faces get their own

The model choices are specific enough to be worth listing, because they explain the shape of the workflow. The global redraw uses `qwen-image-2512-Q4_K_M.gguf`, a Qwen image VAE, a Qwen VL GGUF text encoder, a Qwen Image Lightning LoRA and a Qwen DiffSynth Canny controlnet, the last of which is what lets a very low denoise redraw follow the original layout. The face path uses `z_image_turbo-Q4_K_M.gguf`, `ae.safetensors` and a GGUF Qwen 3.4B text encoder, together with the custom face detailer node. V2 also adds a model swap face detailer with adaptive denoise controls, so a larger detected face can receive stronger detail repair without overprocessing a small one. The reasoning behind the split is that faces are the most salient content in most generated images and the part a viewer checks first, so a single global redraw distorts them, and a dedicated pass lets the authors apply more aggressive denoise where they can afford it and less where they cannot.

## What you have to assemble yourself before the graph runs

There is no install command in this project, and the README does not pretend otherwise. The starting point is a ComfyUI installation into which you import the workflow JSON, plus the custom node pack bundled at `custom_nodes/Comfyui-SynthidBypass/`, which supplies the adaptive denoise node, the face detailer node and the paste back stage that the graph references by name. The GGUF checkpoints, the VAE, the text encoders, the LoRA and the controlnet are local files that the workflow expects to find. The README names them but does not document where to place them, which ComfyUI node packages provide the sampler and controlnet, or which ComfyUI version the graph was authored against, so an engineer planning to reproduce the result is left to work that out from the JSON itself. The comparison workflow is simple to follow: drop input images into `comparison/before/`, run the graph, and put the outputs in `comparison/after/`, with example pairs already filed under the numbers 12 and 10.

## What the proof images do and do not establish

The repository argues its case with pictures rather than numbers, and the README presents it that way too. The V2 examples are before and after pairs, and the claim attached to the face path is that the renoised faces stay virtually one to one with the originals while still shifting enough pixels to break detection. There is no measurement attached to that claim anywhere in the documentation: no detector score, no detection rate, no image quality metric, and no count of how many outputs were tried. The V1 archive preserves the earlier workflows, screenshots and comparison assets, which is useful for tracking how the approach evolved, and the `synthid_analysis/` images document the discovery step, but neither is an evaluation. A reader should treat the project as a working hypothesis with visual evidence, not as a quantified result, and if the question is how reliably the bypass works across a large sample, this repository does not answer it.

## The open risks the disclaimer does not resolve

The README opens with a disclaimer that the project is for educational and AI safety research, that the techniques should not be used to circumvent copyright or to misrepresent the origin of digital content, and that the proof of concept is presented as is and without warranty. Those terms matter because the tool does exactly one thing: it removes a marker that tells you an image was generated. A watermark that is easy to strip with a redraw is a weak provenance signal, and a research interest in that is legitimate. The same property is also useful to anyone who wants to pass generated imagery off as something else, and the disclaimer does not remove that capability from the graph. Two further gaps are worth stating plainly. The licence field is unknown and no licence file appears in the tree listing, so reuse terms for the workflow and the custom nodes are unclear. And the repository publishes no GitHub releases, so there is no version history to cite beyond the V1 and V2 split inside the tree itself, with the last push dated 2026-09-20.

## Conclusion

SynthID-Bypass is worth reading for anyone who works on provenance for generated media, because it documents a concrete failure of pixel level watermarking rather than a theoretical one, and the analysis images in `synthid_analysis/` show how the pattern was found in the first place. It is not a production tool: the repository publishes no evaluation numbers, no comparison metric and no licence, the last push was on 2026-09-20, and the workflow depends on several local GGUF checkpoints that the README does not explain how to obtain. If you try it, check first that you can supply `qwen-image-2512-Q4_K_M.gguf` and `z_image_turbo-Q4_K_M.gguf`, that your ComfyUI install has the bundled `custom_nodes/Comfyui-SynthidBypass/` pack registered, and that the use you have in mind stays inside the disclaimer the README attaches to the project.

## FAQ

### What does SynthID-Bypass actually do?

It loads a source image into a ComfyUI workflow, computes a resolution aware denoise, redraws the whole image with a low denoise Qwen Image sampler guided by a Canny controlnet, then repairs detected faces on a separate Z-Image Turbo path before saving the composite. The aim is to replace the low level pixels that carry the SynthID watermark while keeping the composition.

### How do I run the SynthID-Bypass workflow?

There is no install command in the repository. You import `Synthid-Bypass-v2.0.json` into a ComfyUI installation, install the bundled `custom_nodes/Comfyui-SynthidBypass/` node pack, and make sure the named GGUF checkpoints and encoders are available locally. The README does not document where those files go or which ComfyUI version the graph targets.

### What is the difference between the V1 and V2 SynthID-Bypass releases?

V1 was split into general, portrait and GGUF workflow variants and is now archived under `V1/`. V2 collapses the main path and the face restoration path into one workflow at the repository root, adds resolution aware denoise through the `Synthid-Bypass-AdaptiveDenoise` node, and uses stricter face segmentation built on Ultralytics, MediaPipe, SAM and SEGS conversion.

### Is SynthID-Bypass legal to use?

The README states the project is intended for educational and AI safety research, and that the techniques should not be used to circumvent copyright or to misrepresent the origin of digital content. The licence field is unknown and no licence file is listed in the repository, so the terms for reuse are not stated there.

## Sources

- [cebeuq/Synthid-Bypass on GitHub](https://github.com/cebeuq/Synthid-Bypass)
- [Issues](https://github.com/cebeuq/Synthid-Bypass/issues)
- [README](https://github.com/cebeuq/Synthid-Bypass/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cebeuq-synthid-bypass