OpenAI's ChatGPT Images 2.5 Adds SynthID Watermarks — Deepfake Risk Remains
OpenAI's new image models generate faster, more realistic output and pair it with C2PA metadata plus a new SynthID watermark — but the company's own safety data shows the misuse rate isn't zero.
Key Takeaways
- OpenAI's new gpt-image-2.5-sunburst and gpt-image-2.5-flare API models cut generation latency by up to 50% versus Images 2.0 while improving multi-turn instruction-following and reference-photo subject preservation.
- Both models now attach Google DeepMind's SynthID invisible watermark alongside existing C2PA content-credential metadata, layering two independent provenance signals rather than relying on one.
- OpenAI's own system card names the trade-off directly: heightened realism could, absent safeguards, enable more convincing deepfakes of real people.
- OpenAI's adversarial testing reported unsafe-output rates of 1.09% (Sunburst) and 1.41% (Flare) versus 1.64% for the prior Images 2.0 model — an improvement, not a solved problem.
What OpenAI shipped
OpenAI has released ChatGPT Images 2.5, alongside two new API model IDs — gpt-image-2.5-sunburst and gpt-image-2.5-flare — as detailed in OpenAI's announcement and covered by Simon Willison. Flare targets fast, everyday generation; Sunburst trades speed for editing precision on detailed creative work. OpenAI says its image tools have now produced more than 3 billion images across ChatGPT Images and the GPT-Image API models combined, and that generation latency is down by up to 50% versus Images 2.0.
The part that matters to security teams: provenance and misuse
The functional upgrades — faster output, better multi-turn instruction-following, more faithful preservation of subjects from reference photos — are also the upgrades that make image-based social engineering and impersonation easier to execute convincingly. OpenAI addresses this directly in the model's deployment safety documentation.
Heightened realism that could, absent safeguards, allow more convincing deepfakes, including political, sexual, or otherwise sensitive imagery of real people.
— OpenAI, ChatGPT Images 2.5 system card
OpenAI's countermeasures for that risk are twofold. First, a layered safety stack: upstream LLM-based policy checks before generation starts, a downstream safety-reasoning model that inspects both text and image inputs, and combined analysis of input images plus prompts specifically to catch malicious edit requests. Second, provenance: OpenAI is layering Google DeepMind's SynthID invisible watermarking on top of its existing C2PA metadata commitment under the C2PA Conformance Program — two independent signals rather than one.
The numbers OpenAI published
In OpenAI's own adversarial safety evaluation, Sunburst presented an unsafe image to the user in 1.09% of test cases and Flare in 1.41%, against a 1.64% baseline for Images 2.0. Both are improvements. Neither is zero. OpenAI states neither model crosses the Bio High or Cyber High thresholds under its Preparedness Framework.
What this means in practice
- Watermarks are a signal, not proof. SynthID and C2PA metadata help platforms and detection tooling flag AI-generated images, but invisible watermarks can degrade under re-encoding, cropping, or screenshotting, and C2PA metadata is routinely stripped by re-saves and by platforms that don't preserve it — neither should be the sole check in a high-stakes verification workflow.
- A non-zero unsafe-output rate at this volume is not negligible. At billions of images generated, even a sub-2% miss rate produces a meaningful absolute number of images that clear the filter.
- Faster, more faithful subject preservation raises the bar for impersonation-based social engineering — executive photo misuse, fabricated "proof" images in fraud attempts, and manipulated reference-photo edits all get easier to produce convincingly and quickly.
None of this means the release is reckless — the layered filtering and dual-provenance approach is a reasonable design. It does mean organisations that depend on visual content for verification (KYC, fraud review, brand-impersonation monitoring, executive protection) should treat rising photorealism and generation speed as a moving baseline, not a one-time risk they've already accounted for.
Frequently Asked Questions
Does SynthID watermarking mean AI-generated images can always be detected?
No. SynthID is an invisible watermark layered on top of existing C2PA metadata, but both signals can be degraded — watermarks by re-encoding, cropping, or screenshotting, and C2PA metadata by re-saving or sharing through platforms that strip it. They're supplementary provenance signals, not a guaranteed detection mechanism.
What's the practical difference between gpt-image-2.5-sunburst and gpt-image-2.5-flare?
Sunburst is positioned for workflows where editing precision matters most and takes longer to generate; Flare is optimized for fast, high-quality everyday generation. OpenAI's own testing shows Sunburst also has a slightly lower unsafe-output rate (1.09% vs Flare's 1.41%) in adversarial evaluation.
Should security teams treat this release as a new deepfake threat?
It's an incremental escalation rather than a new category of risk: faster generation and better subject preservation from reference photos make convincing impersonation images easier to produce at scale, which is worth reflecting in social-engineering awareness training and image-verification processes for finance, HR, and executive-facing workflows.
Sources
- 1Introducing ChatGPT Images 2.5 — Simon Willison
- 2Introducing ChatGPT Images 2.5 — OpenAI
- 3ChatGPT Images 2.5 System Card — OpenAI Deployment Safety Hub