Brandon Thomas has a naming complaint, and it is a substantive one. “Watermark” now covers everything from the faint portrait in a twenty-dollar bill to the invisible identifiers that Google, OpenAI and others are building into AI-generated media. He thinks the second category deserves a different word: a spymark.

His definition — a hidden signal that makes your work traceable without your knowledge or consent.

The flagship example is Google DeepMind’s SynthID, which embeds signals that are “imperceptible to humans,” in Google’s own words, into images, audio, text and video:

  • Google’s SynthID-Image paper reports a variant that fits a 136-bit payload into a 512×512 image — enough room for a 64-bit database identifier plus error correction. In plain terms, that is space for a pointer to a record: a name, an IP address, a date of birth, a home address, party registration.
  • Text gets a version too. SynthID steers word choices into a detectable statistical pattern that encodes a payload; Thomas shows an illustrative encoding of eight word choices standing for eight bits, carrying ID 173.
  • Audio works the same way, through inaudible edits in the time or frequency domain, engineered to survive compression and re-encoding. The open-source audiowmark tool dates to 2018 and hides 128-bit payloads behind an AES key.
  • These are not metadata tags. EXIF fields in a photo and ID3 fields in an MP3 are documented, inspectable, editable — you can strip them. A mark burned into pixels, samples or word choices survives the stripping, and can survive editing.

His reason for splitting the vocabulary is practical. Privacy arguments keep dying in the explanation phase; “to speak the name is to control the thing,” he quotes from Le Guin. With spy- doing the surveillance and -mark doing the embedded signal, the concern arrives before the argument does. His word for it: a privacy Rumpelstiltskin.

The stakes section is short. Printer tracking dots — a serial number baked into every page since the 1980s — are an early spymark, and the article shows the EFF diagram that decodes one. The imagined future is quieter: every device attested, every post carrying an account-linked mark, files handed to you already marked. In that world it becomes easy to trace a person from a single photo, or to map the web of people a “dangerous idea” travelled through.

What the thread adds

The 127-comment thread on Hacker News mostly takes the naming at face value and argues about whether the defense holds.

  • gorgoiler — the sharpest framing of the doubt: “You can’t definitively prove the absence of a watermark. You can only prove the watermark is there.” They follow it out — if verification has to stay secret, and anyone who can verify also gains a tool that tells them when they have successfully scrubbed a mark, the whole thing looks like security through obscurity.
  • jstanley — the hands-on counter to that: “I spent half a day messing around with it and I was very impressed by how robust it is. I couldn’t get OpenAI to stop detecting their own SynthID without completely trashing the image.”
  • Worta — the adversarial extension, offered as a research direction with arXiv links: a model could be trained to encode not only provider identifiers but “e.g. one-time tokens from your email,” so the mark says something about you rather than the platform. They report it works surprisingly well, if noticeably with the naive approach.
  • Retro_Dev — proposes a defense with a hole the thread immediately finds: insist every stage of your pipeline is byte-for-byte identical to a version you trust, and treat social platforms as the real risk since they re-compress everything you upload. dragonwriter answers that SynthID-class marks are applied by the generator itself, so “there is never a clean comparator” — and that the same is true for any compression step.
  • speerer — that door is already open: Facebook has for years added its own metadata tags to uploaded images so copies shared off the platform can be traced back, with the StackOverflow thread to prove it.
  • swiftcoder — the corporate precedent: firms used to embed marks in the background images of internal pages so leakers could be identified from shared screenshots, which produced an adversarial loop of journalists transcribing or redrawing screenshots before publishing. miki123211 supplies the frame: “Watermarks are often just another form of DRM” — and rights management includes making sure pirates are properly identified and caught.
  • TeMPOraL — answers voidUpdate’s question about marking text somebody else wrote: writing is already self-marking. Short passages can identify an author by word choices alone, and there is old precedent of e-mails and memos altered per recipient — typos, punctuation — so that a leaked transcript can be traced to a source.
  • initramfs — the whistleblower scenario is not hypothetical: they link the 2021 case in which an NSA leak suspect was identified through an office printer’s tracking dots.
  • itake — removal is already contested: “Apple rejected my app for removing c2pa metadata.”
  • encrypted_void — the compressed version of the threat model: “This will take surveillance to a whole new level. This is basically email read-receipt tracker, but for all of the digital content.”

Where the thread pushes back

  • The word, not the technology, drew most of the disagreement — and it clusters. pavo-etc is unconvinced: “spymark to my ears sounds designed to be sound very negative,” and rates SynthID a net positive, wanting a browser extension that tints text by how likely it is to have been written by a model. autoexec points out the article explicitly carves out marks that deter counterfeiting, because those say nothing about the person holding the item. account42 answers the extension dream with a systems point: “False confidence is a lot worse than no confidence. If such an extension ever becomes popular, people will take anything not marked as AI as gospel.”
  • layer8 notes the essay never uses the word steganography and prefers “steganomark”; latexr defends the coinage on exactly Thomas’s grounds — it is technically more accurate but “an inscrutable name with no chance of proliferation beyond technical people,” and a name that travels is the entire point.
  • rbtms goes after the evidence rather than the argument: the live demos are labelled “Toy example; not SynthID,” one is a generic spectrogram, and the text example’s identification space is minuscule. “I was hoping to see more realistic scenarios to learn how these new watermarks are being applied, instead of generic steganography.”

The piece is worth reading for the name alone — a word that makes the privacy cost part of the sentence. The thread is worth reading for the argument underneath it, which the coinage does not settle: how much of this is a real tracing system, and how much is a robustness demo that nobody has yet tried hard to defeat.

On reading comments as evidence: HN handles are pseudonymous, the site publishes no per-comment scores, and the order here is HN’s own ranking rather than a vote. This is a slice of the thread, not a consensus.