Spymarks, not Watermarks

> On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced

That doesn't help with things like the typical use of SynthID where the spymarking is done by the same process generating the content, so there is never a clean comparator. (It also wouldn't be useful anytime it is inplemented as part of a transformation—compression, etc. —step, for the same reason.)

This has been going on for a while with Facebook. They seem to embed custom metadata tags so that images shared outside the platform can be traced back:

https://stackoverflow.com/questions/31120222/iptc-metadata-a...

Stop using links instead of words. Your comment is literally unreadable without going on to other websites.

You just need to address three questions:

- who controls what information is going in? (that is, what is the process by which the tech companies who control all the tech are using it)

- who controls what information is coming out? (that is, is the steganographic format open enough that anyone can read it, or does it depend on having a key)

- what legal regulation is this subject to? (does sneaking individuals name and address into their photographs incur you massive GDPR liabilities when it is discovered?)

Note that there's a widespread precedent: https://en.wikipedia.org/wiki/Printer_tracking_dots

Or... add some noise. Just align the last bit of every pixel channel with a random bit sequence - and Bob's your uncle.

I think you may have an outdated view here

Who, exactly, is the "bt@brand.io" whose only attributable contribution is FUD regarding SynthID (and what are their motives)?

I still use IRC on the daily, but someone mentions Discord at least once a month on there, and sometimes tries to whisk people away to that side. There are also people hooking up LLMs to IRC bots and joining them to channels without permission, then when you complain or kick/ban their bot you're somehow treated as the rude one. It's very hard to entirely get away from all the crap anymore.

So I’m not writing off tech as a whole just the adtech companies being a lost cause.

TrojanStego: https://arxiv.org/abs/2505.20118 Improvement: https://arxiv.org/abs/2606.09411

Digital Rights Management isn't just about restricting what you can do with the content, which is often futile anyway. Another way companies can manage their rights is by making sure pirates are properly identified and caught.

I spent half a day messing around with it and I was very impressed by how robust it is. I couldn't get OpenAI to stop detecting their own SynthID without completely trashing the image.

You absolutely can, but if the process transforms the input, it requires you to understand the transformation, or to use an identical, trusted transformer.

Text the whistleblower only reports on, well, if they got it from a computer system, there's already precedent of altering word choices, typos and punctuation in e-mails and memos to create unique per-recipient or per-recipient-group versions, which allows companies to trace leaked transcripts reported by press back to source of the leak.

The article calls out watermarks intended to deter counterfeiting as explicitly being not spymarks. Watermarks can tell you about the items marked, not about the person using/creating it.

Bank notes are mainly protected by things that are hard to create without very specialized machines. You can't rely on anything hidden staying unknown and once you know a steganography scheme you can also control it.

> Tech like SynthID I see a net positive especially since it doesn't degrade text quality. I dream about a browser extension running at all times that makes text more translucent based on the confidence of LLM writing[0].

False confidence is a lot worse than no confidence. If such an extension ever becomes popular, people will take anything not marked as AI as gospel.

One is proof of authenticity, other is tracking tool.

    I'm not convinced spymark is better than just "invisible watermarks", spymark to my ears sounds designed to be sound very negative when invisible watermarks are not always negative, e.g. the counterfeit bank note example.

    Tech like SynthID I see a net positive especially since it doesn't degrade text quality.

    I dream about a browser extension running at all times that makes text more translucent based on the confidence of LLM writing.

I wonder if we could have a real, open and direct democracy. All the models we have right now work via indirect clowns. Then again, looking at how some people vote, perhaps direct democracy can only work if people are clever.

https://www.abc.net.au/news/2026-08-18/what-happens-if-prope...

Might be technically more accurate, but it’s an inscrutable name with no chance of proliferation beyond technical people. If the goal is to rally people to your position, you need a name people can identify.

The concern is valid, but microphones are far worse. They're simpler, smaller, extremely sensitive to sound and an order of magnitude cheaper, both the mic itself as well as any spying with it.

It is possible to record voice using few bytes, to send later. It's further possible to transcribe cheaply into text, and analyze said text.

And mics are already everywhere, including in devices that do not need them, as well as speakers that can be rewired by software to act as microphones.

Because they have this pathway only they can access, their key and signature can be trusted. I’m not gonna trust Joe Schmoe’s signature that “No I didn’t use AI” unless I already trust Joe Schmoe (and in which case, he doesn’t need a watermark, I’ll just believe him when he says it).

When some processing is required by eu or eu member state law, that processing doesn't need explicit consent.

One could also argue the watermark tracks the generated content, not the person

No. The mark is hidden in the word choices.

See the demo in the article.

Hidden side channels of any kind, not under the user's control, should be looked upon with suspicion.