Spymarks, Not Watermarks

Imagine downloading a photograph from an AI image tool. It looks ordinary: no visible stamp, no warning, no strange pattern in the corners. Yet tiny changes may have been distributed through its pixels so software can later test whether the image came from a particular generator.

That hidden mark is not automatically surveillance. It might be a useful provenance signal, meaning a clue about where a file came from and how it was changed. The concern begins when the signal carries a stable identifier that can be matched against records held somewhere else. That is where the familiar word watermark starts to feel too gentle.

A watermark speaks to the viewer

A watermark is information embedded in a work to signal ownership, authenticity, or origin. It can be visible, like a stock-photo label, or invisible, like a machine-readable pattern woven into an image, recording, or document.

Modern provenance systems add another layer. The Coalition for Content Provenance and Authenticity, better known as C2PA, defines an open technical standard for attaching signed information about a file’s origin and editing history. These records are often called Content Credentials. They can travel as metadata, which is descriptive information stored alongside the media, or they can be connected to the media through a hidden signal. (spec.c2pa.org)

C2PA also describes an invisible watermark as a possible “soft binding.” In plain language, that means a hidden identifier can help a service find a provenance record after ordinary metadata has been stripped away. The mark does not need to contain a person’s name. It may contain a key that points to a record elsewhere.

That distinction matters. A mark that reports “created by Tool X” is a provenance label. A mark that quietly links every exported file to an account, device, or searchable history is something more consequential. Here, spymark is a privacy-focused label for that second pattern, not a formal industry standard.

How hidden marks get into media

Images are the easiest place to picture the technique. An encoder, meaning a program that inserts the signal, can make tiny adjustments to pixel values. More advanced systems work in the frequency domain, a mathematical representation of how much detail appears at different scales. The encoder spreads the mark across many parts of the image, then adds redundancy, or extra information that helps a decoder recover the signal after resizing, compression, or filtering.

Audio watermarking follows a similar path. A time-domain method changes the waveform samples directly. A frequency-domain method changes selected parts of the sound’s spectrum, where bass, treble, and other frequency ranges are represented. Some systems combine both approaches so the signal can survive common transformations such as noise, format conversion, or changes in playback speed. (airc.nist.gov)

Text is stranger because there are no pixels to adjust. A large language model, or LLM, produces text one token at a time; a token may be a whole word, part of a word, or punctuation. A text watermark can gently change the probability of choosing certain tokens, creating a statistical pattern that is hard to notice while the passage is being generated. Paraphrasing or translating the passage can weaken that pattern, which makes text provenance particularly difficult. (deepmind.google)

A toy version of the tracking idea looks like this:

signal = detect_hidden_signal(asset)
record = provenance_store.lookup(signal)

if record:
 print(record["origin"])

This code does not decode any real vendor’s system. It shows the important architectural difference: the hidden signal may be a key, not a dossier. Privacy enters when the lookup service connects that key to information about a person, account, device, or activity.

What current systems actually promise

By September 2026, Google publicly describes SynthID as a watermarking system for AI-generated images, audio, text, and video. Its image and video signals are designed to withstand changes such as cropping, filters, frame-rate changes, and lossy compression, while its text system works by adjusting token probabilities. A 2025 Google DeepMind paper reported that SynthID-Image had been used across more than ten billion images and video frames, and evaluated an external variant called SynthID-O that carries a 136-bit payload in a 512×512 image. (deepmind.google)

That number describes capacity, not the contents of every payload. A 136-bit space could hold a compact identifier, model code, version number, or other structured data. It does not prove that a person’s name, address, browsing history, or political affiliation is embedded in each generated image. Public documentation from OpenAI makes a similar boundary explicit: its verification tools can indicate that supported content carries OpenAI provenance signals, but they do not identify who created the content. A missing signal also does not prove that content was made by a human, because metadata and watermarks can be stripped or degraded. (help.openai.com)

The privacy question still remains. C2PA’s own guidance discusses invisible watermarks that point to manifest repositories and acknowledges that linking media back to earlier records can create privacy risks. Good intentions do not remove the need for disclosure, retention limits, access controls, and meaningful user choice. (spec.c2pa.org)

The printer already gave us a warning

Long before generative AI, color laser printers offered a physical example of the same idea. In the mid-2000s, researchers at the Electronic Frontier Foundation documented tiny yellow dot grids printed repeatedly across some Xerox DocuColor pages. Under magnification or blue light, the pattern became visible. Researchers could decode fields associated with the printer’s serial number, printing date, and time. (w2.eff.org)

The dots did not tell the person holding the page anything. They told a machine where to look next. The printer did not need to print the user’s name; investigators could combine the printer identifier with purchase, workplace, or access records. That is the shape of a spymark: a hidden mark whose real meaning appears only after it is joined to another database.

When should we say “spymark”?

Before giving a hidden signal that name, examine four details:

• Disclosure: Was the mark explained clearly before the file was created or shared?
• Payload: Does it identify only a tool or model, or does it carry a stable user-linked value?
• Lookup: Can a company, platform, or government service map the value to an outside record?
• Control: Can people decline the mark, remove it, or see what information it resolves to?

A hidden mark that only says “this image came from version 4 of a generator” may be privacy-light. A mark that silently follows a file through reposts and connects it to an account history deserves much closer scrutiny. The National Institute of Standards and Technology has warned that covert watermarks capable of carrying additional data can expose sensitive information without the user’s knowledge, and that their persistence can make privacy controls harder to enforce. (tsapps.nist.gov)

Can an invisible watermark identify you? Not by magic. It can contribute to identification when the hidden value is stable, readable, and joined to records held elsewhere. Calling every hidden signal a spymark would erase the value of honest provenance systems; calling every spymark a watermark hides the privacy decision inside a familiar, harmless-sounding word.

The useful boundary is straightforward: watermarks describe a work, while spymarks can make the work describe you.