There’s a sneaky new evolution of the “watermark”, let’s call it — the spymark.

A watermark is a visible mark embedded in a physical or digital medium to verify authenticity or assert ownership.

A spymark is a hidden signal that makes your work traceable without your knowledge or consent.

Spymarking is sneaking onto the internet

Google SynthID is a spymark that embeds secret hidden signals “imperceptible to humans” (Google’s own words) into images, audio, text, and video. This signal can encode database identifiers that map to your identity. Your user records, full name, IP addresses, date of birth, physical addresses, political party affiliation, and more.

Google’s SynthID-Image paper reports that its SynthID-O variant can encode a 136-bit payload in a 512x512-pixel image. That is enough room for a 64-bit database identifier, with 72 bits left for error correction.

SynthID was not the first spymark system designed, and it’s hardly the only one under active development. OpenAI and many other tech companies are developing these systems at scale. These companies claim spymarking can help identify AI-generated content, yet they’ve gone beyond simple watermarking and built in robust tracking mechanisms. Social media, content production tools, and smartphones may soon find themselves filled with spymarking algorithms that sneak these signals into everything you publish.

For example, images can be invisibly altered in their frequency domain to carry tracking information such as database IDs linked to users:

Why give it a new name?

“Watermark” has become a catchall for historical marks of authenticity, banknote security features, copyright overlays, and hidden tracking signals in our media. That last usage obscures the privacy risk that some forms of modern “watermarks” have become.

Most people tire of the discourse on privacy. It’s complex, repetitive, and seems irrelevant to the typical day-to-day routine of the average citizen. We can’t keep explaining the technicalities behind statistical tracking tools each and every time we need to communicate these concepts to people and expect them to pay attention.

“To speak the name is to control the thing.” — Ursula K. Le Guin, The Rule of Names

With a simple change of terminology we can put the privacy concern up front, cementing this issue in the conversation forever:

• Spy- — clandestine surveillance, involuntary disclosure
• -mark — embedded signal

Now we get to disambiguate friendly watermarks from concerning new technology while leveraging the familiar etymology. It collapses a technical communication salient and gains us a lot of ground with just one new word. It’s clear, coherent, and straight to the point.

No more wasting energy establishing the basic facts. The privacy concern is built into the word.

“Spymark” is a privacy Rumpelstiltskin.

More spymark examples

Here are a few more forms of spymarks so you can better familiarize yourself.

Audio spymarks operate using principles similar to image spymarks, and they are typically inaudible. Some methods make minute changes to the audio waveform in the time domain; others modify features in the frequency domain, and some combine both approaches. These methods can encode data, including identifiers linked to personal information:

Spectrograms from Wen et al. (2025), SoK: How Robust is Audio Watermarking in Generative AI models? · Original samples. Plots retain the authors’ original scales.

These schemes are engineered to be robust. They can often survive compression or re-encoding.

These tools are already proliferating, and in fact they predated generative AI and the push to watermark generative media. The open source spymarking tool audiowmark originated in 2018 and can hide 128-bit payloads in audio and protect them with a secret AES key, preventing users without the key from decoding them.

You can even encode personal information invisibly into text! SynthID steers word choices to create a detectable statistical pattern that can encode a tracking payload:

Watermarks are benign, spymarks are not

Watermarks remain easy for the user to spot and are typically not nefarious.

Sometimes watermarks deter counterfeiting:

Sometimes watermarks claim ownership:

And sometimes they’re just annoying:

But these watermarks don’t track you.

Printer tracking dots, on the other hand, are an early example of spymarks, dating back to the 1980s:

We need to be clear that spymarks are a form of metadata you have limited knowledge of and control over, and that their purpose is entirely antagonistic to you.

Metadata such as the EXIF tags in photos and the ID3 tags in MP3 files are standardized, well-documented fields. While EXIF can expose sensitive data such as GPS coordinates, these standardized fields can be inspected, edited, and removed from files you control.

You can strip standard metadata tags out of your files. Unfortunately, a spymark signal embedded in pixels, audio, or word choices is invisible to you and can remain in your files even after you edit them.

Furthermore, whereas tags are helpful for maintaining information such as song titles or a photo’s exposure settings, spymarks encode user-tracking identifiers that are entirely opaque and useless to you. These signals can survive metadata removal and some edits, allowing marked copies to remain traceable as they circulate.

Keeping our files free of spying

It’s hard to imagine the future where we can’t even trust our own files. And the sad thing is that this has already started.

Spymarks are certainly not great for whistleblowers or anyone who doesn’t want to be persecuted for their words or affiliations. No matter where you stand on whatever issues, spymarks can be used against you and those you care about.

Imagine a future where every device is attested and every social media post carries an account-linked spymark. Where every file or post served to you for sharing has spymarks embedded within. Combined with account records and observations of where copies appear, these identifiers can help reconstruct how content spreads. In this world, it would be dangerously easy to hunt down anyone from a JPEG or a tweet. Or track the web of humans through which “dangerous ideas” flow.

That future lies halfway between now and 1984. So let’s stay off that timeline, shall we?

Call a spymark what it is. A spy tool used to spy on you and everyone you interact with.

— Brandon Thomas

Usage

spy·mark /ˈspaɪmɑːrk/ noun

plural spymarks

A hidden signal embedded in media to trace its origin, tools, or distribution history without the user’s meaningful control.

“The spymarks tied each copy to a different recipient.”

spymark verb, transitive

spymarked; spymarking; spymarks

To embed a spymark in a file or piece of media.

“The social network spymarks every uploaded image.”

spymarking noun

The practice of embedding spymarks.

“The platform introduced spymarking without telling its users.”

spymarked adjective

Containing a spymark.

“Removing the file’s metadata still left the image spymarked.”