Spymarks, Not Watermarks

There’s a sneaky new development of the “watermark”, let’s call it — the spymark.

A watermark is a apparent grade embedded in a bodily or digital average to verify authenticity or province ownership.

A spymark is a hidden indication that makes your activity traceable without your cognition or consent.

Spymarking is sneaking onto the internet

Google SynthID is a spymark that embeds concealed hidden signals “imperceptible to humans” (Google’s own words) into images, audio, text, and video. This indication can encode repository identifiers that map to your identity. Your person records, complete name, IP addresses, date of birth, bodily addresses, governmental gathering affiliation, and more.

Google’s SynthID-Image paper reports that its SynthID-O type can encode a 136-bit payload in a 512x512-pixel image. That is adequate area for a 64-bit repository identifier, alongside 72 bits remaining for error correction.

SynthID was not the archetypal spymark scheme designed, and it’s barely the lone one under energetic development. OpenAI and many another tech companies are evolving these systems at scale. These companies assertion spymarking can assistance acknowledge AI-generated content, yet they’ve gone beyond uncomplicated watermarking and built in sturdy tracking mechanisms. Social media, satisfied manufacturing tools, and smartphones may shortly discover themselves filled alongside spymarking algorithms that sneak these signals into everything you publish.

For example, images can be invisibly altered in their frequence domain to transport tracking data specified as repository IDs connected to users:

A smaller type of Mochi’s photo contains a genuine toy watermark: ID 173, encoded through subtle pixel changes. Compare the first and marked image, enliven the amplified differences, and decode the ID from the PNG. The connected author and timestamp are fictional.

Why provision it a new name?

“Watermark” has rotate into a catchall for historic marks of authenticity, banknote safety features, copyright overlays, and hidden tracking signals in our media. That final use obscures the privacy hazard that several forms of contemporary “watermarks” have become.

Most group tire of the conversation on privacy. It’s complex, repetitive, and seems irrelevant to the representative day-to-day regular of the average citizen. We can’t keep explaining the technicalities rearward statistical tracking tools all and all period we need to communicate these concepts to group and anticipate them to pay attention.

“To conversation the name is to authority the thing.” — Ursula K. Le Guin, The Rule of Names

With a uncomplicated alter of terminology we can put the privacy involvement up front, cementing this matter in the conversation forever:

• Spy- — clandestine surveillance, involuntary disclosure
• -mark — embedded signal

Now we get to disambiguate affable watermarks from concerning new innovation during leveraging the acquainted etymology. It collapses a specialized communication prominent and gains us a lot of dirt alongside fair one new word. It’s clear, coherent, and direct to the point.

No additional wasting energy establishing the essential facts. The privacy involvement is built into the word.

“Spymark” is a privacy Rumpelstiltskin.

More spymark examples

Here are a few additional forms of spymarks so you can improved familiarize yourself.

Audio spymarks run using principles akin to depiction spymarks, and they are typically inaudible. Some methods create infinitesimal changes to the audio waveform in the period domain; others modify features in the frequence domain, and several merge the two approaches. These methods can encode data, including identifiers connected to individual information:

Compare spectrograms of the identical LJ Speech excerpt unwatermarked and alongside Timbre, AudioSeal, WavMark, FSVC, Patchwork, or Norm-Space. The authors’ first parcels are connected below.

Spectrograms from Wen et al. (2025), SoK: How Robust is Audio Watermarking in Generative AI models? · Original samples. Plots keep the authors’ first scales.

These schemes are engineered to be robust. They can frequently last compression or re-encoding.

These tools are already proliferating, and in fact they predated generative AI and the shove to watermark generative media. The open origin spymarking tool audiowmark originated in 2018 and can conceal 128-bit payloads in audio and defend them alongside a concealed AES key, preventing users without the key from decoding them.

You can equal encode individual data invisibly into text! SynthID steers term choices to create a detectable statistical form that can encode a tracking payload:

An explanatory encoding: eight term choices portray eight bits. The binary value 10101101 gives repository ID 173, which can item to a document containing an author and timestamp. These are fictional examples, not a SynthID decoder.

Watermarks are benign, spymarks are not

Watermarks remain uncomplicated for the person to place and are typically not nefarious.

Sometimes watermarks deter counterfeiting:

Sometimes watermarks assertion ownership:

And sometimes they’re fair annoying:

But these watermarks don’t track you.

Printer tracking dots, on the another hand, are an first example of spymarks, courtship rear to the 1980s:

We need to be apparent that spymarks are a form of metadata you have constricted cognition of and authority over, and that their intent is entirely antagonistic to you.

Metadata specified as the EXIF tags in photos and the ID3 tags in MP3 records are standardized, well-documented fields. While EXIF can disclose delicate data specified as GPS coordinates, these standardized sectors can be inspected, edited, and removed from records you control.

Inspect editable EXIF and ID3 metadata in two tabs. EXIF shows fictional camera-maker, model, and author tags in a JPEG metadata segment; ID3 shows an MP3’s title, artist, and album. Hover or tap the bytes for explanations. These samples merge metadata only.

You can band norm metadata tags out of your files. Unfortunately, a spymark indication embedded in pixels, audio, or term choices is invisible to you and can remain in your records equal following you edit them.

Furthermore, whereas tags are helpful for maintaining data specified as opus titles or a photo’s visibility settings, spymarks encode user-tracking identifiers that are entirely opaque and useless to you. These signals can last metadata elimination and several edits, allowing marked copies to remain traceable as they circulate.

Keeping our records liberated of spying

It’s difficult to ideate the forthcoming anywhere we can’t equal rely our own files. And the sad item is that this has already started.

Spymarks are certainly not awesome for whistleblowers or anyone who doesn’t desire to be persecuted for their words or affiliations. No matter anywhere you remain on any issues, spymarks can be used against you and those you attention about.

Imagine a forthcoming anywhere all equipment is attested and all social media article carries an account-linked spymark. Where all document or article served to you for sharing has spymarks embedded within. Combined alongside document records and observations of anywhere copies appear, these identifiers can assistance rebuild how satisfied spreads. In this world, it would be dangerously uncomplicated to hunt downward anyone from a JPEG or a tweet. Or track the web of humans through which “dangerous ideas” flow.

That forthcoming lies midway between now and 1984. So let’s remain off that timeline, shall we?

Call a spymark what it is. A spy tool used to spy on you and everyone you engage with.

— Brandon Thomas

Usage