Spymarks: The Evolution of Invisible Tracking in AI Media

Spymarks represent a shift from authenticity verification to clandestine user tracking

While traditional watermarks are visible marks used to assert ownership or verify authenticity, a spymark is a hidden signal embedded in digital media that makes work traceable to a specific individual without their knowledge or consent. This technology allows platforms to embed database identifiers—linking to full names, IP addresses, and other personal data—directly into the pixels, waveforms, or word choices of a file.

Technical implementation across modalities

Spymarking leverages steganographic principles to hide data within the noise or frequency domain of a medium, making the signals imperceptible to humans but readable by machines.

Image and Video Spymarking

Modern systems can embed significant payloads into images. For example, Google's SynthID-O can encode a 136-bit payload in a 512x512-pixel image, providing enough space for a 64-bit database identifier and 72 bits for error correction. These marks are often embedded in the frequency domain, allowing them to survive common edits and compression.

Audio Spymarking

Audio spymarks are typically inaudible and can be implemented by modifying the audio waveform in the time domain, altering features in the frequency domain, or using a hybrid of both. Tools like audiowmark (originating in 2018) can hide 128-bit payloads protected by AES keys, ensuring that only the key-holder can decode the tracking information.

Text Spymarking

Text-based spymarks operate by steering word choices to create detectable statistical patterns. By selecting between synonyms (e.g., choosing "winding" over "curving"), an AI can encode a binary payload that maps back to a database key containing the author's identity, date, and other metadata.

Spymarks vs. Traditional Metadata and Watermarks

Spymarks differ fundamentally from both visible watermarks and standard metadata (like EXIF or ID3 tags) in terms of visibility and control.

Feature	Visible Watermark	Standard Metadata (EXIF/ID3)	Spymark
Visibility	High (Visible to user)	Hidden (But standardized)	Invisible (Imperceptible)
Control	Obvious/Removable	Inspectable/Editable	Opaque/Persistent
Purpose	Ownership/Authenticity	Organization/Technical data	Clandestine Tracking

Unlike EXIF tags, which can be stripped using standard tools, spymarks are embedded in the actual content of the file. This makes them highly resilient to metadata removal and certain types of editing, meaning the tracking signal remains even after a user attempts to "clean" the file.

Privacy Implications and Risks

The proliferation of spymarking creates significant risks for anonymity and the free flow of information. If every social media post or shared file carries an account-linked spymark, it becomes possible to reconstruct the exact path of content distribution.

Risks to Whistleblowers and Dissidents

Because spymarks are invisible and persistent, they are particularly dangerous for whistleblowers. A leaked document or screenshot containing a spymark can be traced back to the original recipient, regardless of whether the file's metadata was removed.

Potential for Commercial Exploitation

Community discussion suggests that spymarks could be used for aggressive ad attribution. If hardware drivers or OS-level helpers constantly scan for these signals, advertisers could track exactly when a spymarked ad hits a user's screen, bypassing traditional browser-based tracking.

Community Perspectives and Counterpoints

While the author of "Spymarks, Not Watermarks" views this technology as purely antagonistic, other perspectives suggest potential utility:

• AI Detection: Some argue that spymarks are a net positive for identifying AI-generated content in an era of deepfakes, provided they identify the agent (the AI model) rather than the user.
• Copyright Protection: Some suggest these tools could be used by creators to prove their work was used in AI training sets without permission.
• Technical Skepticism: Some users note that these marks can be defeated through "analog holes" (e.g., taking a photo of a screen) or by adding enough entropy/noise to the file to scrub the signal.

"The absence of a watermark/spymark doesn't prove that the source wasn't AI generated. But the absence provides evidence that it wasn't."

Historical Precedents

Spymarking is not a new concept but is being scaled via generative AI. Historical examples include:

• Printer Tracking Dots: Since the 1980s, some printers have embedded yellow tracking dots (Machine Identification Codes) to identify the printer and the time of printing.
• Corporate Leaker Identification: Companies have long used unique, invisible watermarks on internal documents and movie screeners to identify which employee leaked a specific copy of a file.