This is the best SynthID write-up I've found so far: https://fyx.me/articles/attempting-model-extraction-of-googl...
It covers how it actually works (probably), and how to train your own classifier for it, with some seemingly decent results.
"Excellent work acquiring that outlook data Anat, now let's cross check the defunct company emails against YouTube videos edited with Google PrivateEditAI™ to figure out what the social security number of this YouTube account is."
> classifying images in bulk or offline
You've described exactly the elements spammers and fraudsters need to be able to defeat this mechanism.
Most AI images are either extremely low-effort or not actively trying to be deceptive, so defenders can still catch the majority. If someone is actively circumventing they'll probably circumvent both, anyway.