A watermark used to be a visible mark on paper or a file, meant to prove who made it. Now tech companies are building something different: watermarks that carry tracking information without your knowledge. Google’s SynthID is the clearest example.
The paper argues the term “watermark” has grown too fuzzy. It covers banknote security features, copyright overlays, and now hidden signals that track personal data. The author says the old word hides the privacy risk. The paper’s own term is spymark — a signal embedded in images, audio, text or video that makes your work traceable without your permission.
What SynthID Does
Google’s SynthID-Image paper describes a system that embeds imperceptible signals into images, audio, text and video. The signal can encode database identifiers tied to your identity. That includes your full name, IP addresses, date of birth, physical addresses, political party affiliation and more.
The paper reports SynthID-O, a variant of the system, can encode a 136-bit payload in a 512×512-pixel image. That leaves room for a 64-bit database identifier, with 72 bits left for error correction. The signal is “imperceptible to humans” in Google’s own words.
SynthID is not alone. The paper says OpenAI and many other tech companies are developing these systems at scale. They claim spymarking can help identify AI-generated content, but the systems also carry robust tracking mechanisms. Social media, content production tools and smartphones may soon be filled with these signals.
How Spymarks Work
Spymarks operate in the frequency domain of images, altering the signal without changing what the eye sees. Audio spymarks work similarly, making minute changes to the waveform or frequency domain that are typically inaudible.
The paper notes these schemes are engineered to be robust. They can often survive compression or re-encoding. An open-source spymarking tool called audiowmark dates back to 2018 and can hide 128-bit payloads in audio, protected by a secret AES key that prevents users without the key from decoding them.
Text is not safe either. SynthID steers word choices to create a detectable statistical pattern that can carry a tracking payload.
The Problem With the Word
“Watermark” has become a catchall. The paper argues the term obscures the privacy risk that some forms of modern “watermarks” have become. Most people tire of privacy discourse, the paper says, because it is complex, repetitive and seems irrelevant to daily life.
The paper’s proposed terms are simple:
- Spy- for clandestine surveillance, involuntary disclosure
- -mark for an embedded signal
The word “spymark” puts the privacy concern up front. The author calls it “a privacy Rumpelstiltskin” — to name something is to control it.
Not Every Tag Is A Spymark
Standardized metadata tags, like EXIF in photos or ID3 in MP3 files, are not spymarks. You can inspect, edit and remove them. Spymark signals, by contrast, are invisible to you and can survive editing.
The paper notes that printer tracking dots, dating back to the 1980s, are an early example of spymarks. The difference between a tag and a spymark is that tags are transparent — you can see them, edit them, strip them. A spymark is a form of metadata you have limited knowledge of and control over, and its purpose is entirely antagonistic to you.
Keeping Your Files Free Of Spying
The paper warns that spymarks are not great for whistleblowers or anyone who does not want to be persecuted for their words or affiliations. Spymarks can be used against you and those you care about, no matter where you stand on any issue.
The future the paper imagines is one where every device carries an attestable mark and every social media post carries an account-linked spymark. Where marked copies remain traceable even after editing.
The paper’s central claim is that naming the thing matters. The old word hid the privacy risk; a new word makes it clear. That is the move — one word, one privacy concern, one conversation forever changed.
Whether the word takes hold is beside the point. The technology exists. The signals are being embedded. And the naming of it is the point of the paper.
Source material: “Spymarks, Not Watermarks,” brand.io.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.