Your watermark is a spymark

Google’s SynthID-Image paper reports that its SynthID-O variant fits a 136-bit payload into a 512×512-pixel image. Budget 64 bits for a database identifier and you still have 72 left for error correction. A 64-bit number is more than enough to give every row in a user table its own value. That capacity is what changes a watermark into something else.

Brandon Thomas proposes a name for it: a spymark. A watermark is visible and asserts authenticity or ownership: a banknote feature, a copyright overlay, the logo stamped across a stock photo. A spymark is a hidden signal that makes a file traceable without the user’s knowledge or consent. It is also outside your control and meant to track you. A logo across your JPEG does not tell anyone which account uploaded it. A 64-bit identifier embedded in the pixels can.

SynthID embeds signals Google calls “imperceptible to humans” into images, audio, text, and video. For text, SynthID steers word choices so the output carries a statistical pattern that can encode a payload. Images, more broadly, can be invisibly altered in their frequency domain to carry tracking information like a database ID. Google and other companies building these systems, OpenAI among them, present them as a way to identify AI-generated content. The capacity is the problem. A label needs one bit, made by a machine or not. 136 bits is room for an identity.

Audio works the same way and predates the generative-AI push. The open-source tool audiowmark has existed since 2018; it hides a 128-bit payload in audio and protects it with a secret AES key, so anyone without the key cannot decode the mark. These schemes are built to hold up under handling. Wen et al. (2025), reviewing audio watermarking in generative models, document marks engineered to survive compression and re-encoding. That durability is useful for provenance and a problem for anyone who wants their file back.

The reflex is to strip the metadata, and that works for EXIF and ID3. Those are standardized, documented fields: you can inspect them, edit them, and remove them, GPS coordinates included. A spymark is not a field. It lives in the pixels, the waveform, or the word choices, so it is invisible to you and survives metadata removal and some edits. Re-save the image, re-encode the audio, clear the EXIF, and the identifier can still be there.

None of this is new as a technique. Printer tracking dots are an early example, dating to the 1980s: an identifier embedded in the output, outside the user’s control.

If you ship, host, or process user media, treat an embedded provenance signal as a data-handling question rather than a feature flag. A mark that encodes a per-user identifier is a record that travels with the file after it leaves your platform, invisible and opaque to the user, hard to remove, and able to survive some edits. The scenario Thomas points at, every post carrying an account-linked signal and copies traced back through account records to whoever first shared them, is bad for whistleblowers and for anyone who would rather their affiliations not be reconstructed from a tweet.

So ask the payload size before you adopt a watermarking SDK. One bit labels machine output. A hundred-odd bits, like SynthID’s 136, is room for an identifier, and the questions that follow are what goes into it, who holds the key to read it, and whether it is tied to a user account. If you handle sensitive uploads, assume the frequency-domain and linguistic marks survive your scrubbing pipeline, because EXIF stripping does nothing to a signal that lives in the pixels or the word choices.