⏱️ Lectura: 13 min
An image generated with Gemini can carry a hidden 64-bit identifier that points directly to a user account, invisible to the human eye and to any common photo editor. This type of signal already has its own name: spymark, a term coined to separate it from the traditional watermark.
📑 En este artículo
The distinction matters because SynthID, Google’s technology that marks AI-generated content in images, audio, text, and video, doesn’t just certify that something was made with AI: it can also carry an identifier that links that piece of content to an external database, something the user neither sees nor controls.
TL;DR
- Google SynthID hides invisible signals in AI-generated images, audio, text, and video, according to its own documentation.
- The SynthID-Image paper details that the SynthID-O variant encodes 136 bits in a 512×512 pixel image.
- Of those 136 bits, 64 are enough for a database identifier, and the remaining 72 are error correction.
- The open source tool audiowmark has been hiding 128-bit payloads in audio since 2018, protected with a secret AES key.
- Laser printer tracking dots, documented by the EFF, are an analog spymark that has existed since the 1980s.
- Unlike EXIF or ID3, a spymark isn’t a standard field: no one can inspect or remove it without specialized tools.
- OpenAI and other companies are developing covert marking systems similar to SynthID, at industrial scale.
- Separating “spymark” from “watermark” is the stated goal of the article that originated the term and the debate.
Introduction
The term was proposed by an article published on brand.io titled “Spymarks, not Watermarks”, and it starts from a simple idea: the word “watermark” already covers too many different things. It’s used for a central bank’s seal on a banknote, for the semi-transparent logo of a stock photo agency, and now also for a steganographic signal that a company embeds inside a file without telling the user. Mixing all of that into a single word dilutes the real risk.
The quote the author uses to justify the new term comes from Ursula K. Le Guin, in The Rule of Names: “to speak the name is to control the thing.” The bet is that if covert tracking has a distinct name from the benign watermark, the conversation about privacy stops starting from scratch every time a new case appears.
Google describes the SynthID signal as “imperceptible to humans”, according to its own official SynthID page. That phrase, taken literally, is almost the definition of a spymark: if the user can’t notice it or remove it without specialized tools, they’re not dealing with a watermark in the classic sense, but with a hidden layer of tracking.
What happened: the term “spymark” is born
The article that sparked the debate documents how easily these signals have already made their way into the everyday workflow of generative AI. SynthID isn’t experimental: Google integrates it into Gemini, Imagen, and other image, audio, text, and video generation tools. According to the analysis published on brand.io, the SynthID-Image technical paper describes how its SynthID-O variant can encode a 136-bit payload in a 512×512 pixel image: enough for a 64-bit database identifier, plus 72 bits reserved for error correction.
That database identifier doesn’t, by itself, say who generated the image. But the article’s central argument is that a company that controls both the generator and its own user base could link that number to account data: full name, IP address, date of birth, physical address, or political affiliation, if that data exists in its internal records. This is an interpretation of the risk, not a confirmation that Google uses the system this way today: the company doesn’t publish which fields, if any, it associates with each payload.
Google isn’t the only one building this type of system. OpenAI and other tech companies are developing covert marking mechanisms at a similar scale, according to the same article. The expectation is that social networks, content production tools, and even smartphone cameras will end up incorporating spymarking algorithms into everything the user publishes.
Context and history
Visible watermarks have gone centuries without generating controversy because they serve their function in plain sight. A banknote has a watermark to make counterfeiting harder. A stock photo agency like Getty overlays its logo to claim ownership of a photo, even one as historic as Dorothea Lange’s Migrant Mother, which is now in the public domain. None of those marks track the viewer: they only protect the object.
The spymark, by contrast, has a much less known analog precedent: laser printer tracking dots. Since the 1980s, a large share of color printers have printed a constellation of nearly invisible yellow dots that encode the machine’s serial number and, in some cases, the date and time of printing. The Electronic Frontier Foundation documented and decoded this mechanism, exposing how a printed document could be traced back to a specific printer without the user knowing or consenting to it.
That’s exactly the template now repeating in the digital world: an industry adopts a tracking technology under the promise of a legitimate purpose (preventing counterfeiting, in the case of printers; identifying AI-generated content, in the case of SynthID) and that promise ends up building an identification infrastructure that exceeds the original goal.
Technical details and performance
Each medium is marked with a different technique, but all share the same principle: altering the content in a way that’s statistically detectable to whoever has the reading key, but imperceptible to whoever doesn’t.
In images, the signal is usually embedded in the frequency domain: small pixel changes that don’t alter visual perception but do create a pattern measurable with a decoding algorithm. In text, SynthID doesn’t touch pixels: it steers the language model’s word choices toward a detectable statistical pattern. An illustrative example, not SynthID’s actual algorithm, which is more complex: if a model has eight word decisions where each represents one bit, the sequence 1-0-1-0-1-1-0-1 encodes the binary 10101101, which corresponds to identifier 173 in a hypothetical database.
In audio, robustness is the explicit design goal. The paper by Wen et al. (2025), “SoK: How Robust is Audio Watermarking in Generative AI models?”, cited in the brand.io analysis, compares six schemes (Timbre, AudioSeal, WavMark, FSVC, Patchwork, and Norm-Space) that operate in the time domain, the frequency domain, or a combination of both. The common conclusion is that these schemes are built to survive compression and re-encoding, something a traditional visual watermark never needed.
These techniques weren’t born with generative AI. The open source tool audiowmark, released in 2018, was already hiding 128-bit payloads in audio files, protected with a secret AES key that prevents anyone without it from decoding the message. SynthID and similar systems bring that same idea to industrial scale, with AI models instead of manual digital signatures.
flowchart TD
A["AI-generated content"] --> B["Encoder (SynthID or other)"]
B --> C["Embedded payload: imperceptible bits"]
C --> D["Published image, audio, or text"]
D --> E["Decoder with provider's key"]
E --> F[("Identifier database")]
subgraph "Provider side"
B
E
F
endThe diagram sums up the point that worries critics most: the decoding step (E) can only be executed by whoever has the key, that is, the provider. The user who published the content has no way to verify what was encoded or to remove it with certainty.
Spymark vs. watermark vs. standard metadata
The table summarizes the key difference: who can see the mark and who can remove it.
| Type of mark | Visible or detectable at a glance? | Can the user edit or remove it? | Stated purpose |
|---|---|---|---|
| Traditional watermark | Yes, visible (logo, seal, overlaid text) | Yes, with basic image editing | Mark authorship or protect against copying |
| Standard metadata (EXIF/ID3) | Not visible, but documented and standardized | Yes, with any metadata editor | Store technical data: camera, date, GPS |
| Spymark (SynthID and similar) | No, imperceptible by design | No, requires the provider’s decoder | Track the origin without the user knowing |
A photo’s EXIF metadata or an MP3’s ID3 tags are standardized and documented fields: anyone can inspect, edit, or delete them with common tools. A spymark is not that. It’s a signal with no public specification, no visible field in any file inspector, designed specifically to resist that kind of user intervention.
How to test it
There’s no publicly available SynthID decoder that anyone can run, because Google keeps the reading key. But you can understand the mechanism in a practical way with audiowmark, the open source tool that uses an audio steganography technique comparable in spirit.
Installation on Linux (Debian/Ubuntu):
sudo apt install meson ninja-build libsndfile1-dev libfftw3-dev libmpg123-dev libzita-resampler-dev ffmpeg
git clone https://github.com/swesterfeld/audiowmark.git
cd audiowmark
meson setup build
ninja -C buildInstallation on macOS (Homebrew):
brew install meson ninja libsndfile fftw mpg123 zita-resampler ffmpeg
git clone https://github.com/swesterfeld/audiowmark.git
cd audiowmark
meson setup build
ninja -C buildOn Windows, the simplest path is WSL2: install Ubuntu with wsl --install and repeat the Linux steps inside it, because audiowmark depends on libraries that don’t compile natively on MSVC without extra work.
With the binary compiled, the full workflow is to mark an audio file and then try to read that mark back:
./build/src/audiowmark add original.wav marcado.wav 0123456789abcdef0123456789abcdef
./build/src/audiowmark get marcado.wavThe first command embeds the hexadecimal payload, 128 bits in 32 hex characters, inside marcado.wav. The second reads it back: if it returns the same value, the message survived; if the file was recompressed to a low bitrate or aggressively trimmed, decoding is expected to fail or produce a different result, which shows in practice the robustness limit of these techniques.
💡 Tip: to check standard metadata, which isn’t spymarks but does expose data, useexiftool foto.jpgon Linux/macOS or the portable version on Windows: you’ll see fields like GPS, camera, and date, all editable with the-all=flag to delete them.
Impact and analysis
The case for these technologies is real: identifying AI-generated content helps combat deepfakes, election disinformation, and cloned-voice fraud. C2PA, the content provenance standard backed by Adobe, Microsoft, and other companies, pursues a similar goal with cryptographically signed metadata. The key difference is that C2PA is a public, auditable standard, while a spymark like SynthID is a black box: only the provider knows exactly what it encodes and who can read it.
That asymmetry is the core of the privacy problem. A user who uploads an AI-generated image to a social network has no way to audit which identifier got embedded, nor to confirm whether that identifier can be linked to their real account. The company that generates the content controls both ends of the chain: the writing key and the reading key.
⚠️ Heads up: a signal being “imperceptible to humans” doesn’t mean it’s undetectable in general: it means only the provider currently has the tool to read it. That’s exactly what distinguishes it from a visible watermark.
There’s also a scale problem. When tracking depended on printing a physical document, the universe of cases was limited. When tracking gets embedded in every image, every voice note, and every paragraph generated by a language model, the footprint multiplies with the volume of AI content already circulating daily on social media, forums, and messaging apps.
What’s next
Spymark adoption is going to grow in parallel with generative AI, because regulators and platforms are already pushing in that direction: marking synthetic content is, in many countries, an increasingly common requirement for social networks and production tools. That means the surface of hidden tracking grows at the same pace, without a public standard equivalent to EXIF yet existing to document what gets encoded and how a user can look it up.
Community efforts to counter this already exist: command-line tools capable of detecting and removing known marks from SynthID, C2PA, and other schemes circulate as open source projects, though their effectiveness varies depending on how robust each scheme is against recompression. The article that originated the term spymark argues that the solution isn’t just technical, but a matter of vocabulary. As long as “watermark” keeps serving as a catch-all, it’s going to remain hard for the average user to understand that what they’re holding isn’t a mark of authorship, but a tracking tag they never asked for.
📖 Summary on Telegram: View summary
Try it yourself: run exiftool on the last photo you shared, or clone audiowmark and try the add/get cycle to see, in minutes, what it feels like to have and lose control over a mark you can’t see.
Frequently Asked Questions
What’s the difference between a spymark and a traditional watermark?
A traditional watermark is visible, and the user can detect, edit, or remove it with common tools. A spymark is imperceptible by design and can only be read with the decoder and key controlled by whoever inserted it.
Can SynthID identify me personally?
The identifier encoded by SynthID-O, according to the cited analysis, points to a database record, not directly to a name. Whether that record is linked to personal data depends on what the company stores in its internal systems, something Google doesn’t detail publicly.
Can spymarks be removed?
It depends on the scheme’s robustness. Some survive recompression and trimming because they were designed for that, as shown by the audio schemes compared by Wen et al. (2025). Others degrade with aggressive editing, but there’s no general guarantee that a homemade edit will remove them completely.
Is it legal for a company to hide these signals without notice?
It varies by jurisdiction. There’s currently no specific law requiring companies to publicly document the exact content of a spymark, unlike standards such as EXIF, which are public by industry convention.
Are EXIF or ID3 spymarks?
No. They’re standardized, documented metadata that’s editable by the user. A spymark, by definition, doesn’t meet any of those three conditions.
Which companies use this type of marking?
Google, with SynthID, is the best publicly documented case. The article that coined the term spymark claims that OpenAI and other tech companies are developing equivalent systems at scale.
References
- Spymarks, not Watermarks: the article that proposes the term and details the SynthID-Image payload and the audio watermarking robustness paper.
- SynthID, Google DeepMind: official page for the AI-generated content marking technology.
- Printer tracking dots, Electronic Frontier Foundation: documentation and reverse engineering of hidden tracking in laser printers since the 1980s.
- audiowmark on GitHub: open source audio steganographic marking tool with 128-bit payloads, released in 2018.
- EXIF, Wikipedia: reference for the metadata standard that contrasts with spymarks.
📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
0 Comments