Are AI Watermarks Surveillance Tools? The "Spymark" Debate Explained
機械翻訳 / Machine-translated
A
AI Friends
8時間前・18分で読める
機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
The images and text you create with AI may carry an "invisible mark" you know nothing about. An essay published in September 2026 proposed renaming these watermarks "spymarks," sparking widespread debate.
The conversation began with an essay titled "Spymarks, not Watermarks" published on September 21, 2026, by Brandon Thomas, founder of AI image and video creation software "ArtCraft." In Japan, GIGAZINE covered the story on November 8.
Thomas's argument is straightforward. Watermarks were originally visible, used to certify authenticity or assert ownership. Yet today, hidden signals that can track users without their awareness are lumped under the same term.
He therefore proposed combining "spy" with "mark" to coin the word spymark. Embedding the concept of "surveillance" in the name, he argued, makes the privacy implications immediately clear.
Looking back at history, the printer tracking dots that have existed since the 1980s—tiny dots secretly embedded in printed materials—are cited as early examples of spymarks.
SynthID (Google DeepMind) is a technology that embeds imperceptible watermarks into AI-generated images, videos, audio, and text. According to its official page, its purpose is to identify AI-generated content and build trust in generative AI.
For images and video, it is designed to survive cropping, filtering, and compression. For audio, it is said to withstand noise and MP3 compression.
The mechanism works somewhat differently for text. It makes subtle adjustments to the probability distribution the model uses when selecting the next word, creating statistical patterns that can be detected later.
What Thomas specifically took issue with is the capacity of "SynthID-O," the image-focused variant. It is described as being able to embed 136 bits of information into a 512×512 pixel image.
Of that total, 64 bits serve as a database identifier and 72 bits are used for error correction. In principle, if that number were linked to a database containing a user's name, IP address, and other details, a single image could theoretically be traced back to its creator.
It is important to note that this is an observation about what could happen. DeepMind's official page contains no concrete explanation about privacy. Whether Google actually links user information to these identifiers was not demonstrated in the materials reviewed for this article.
What exactly sets spymarks apart? Here is a comparison of the three:
Have you ever cleared location data from your phone before sending a photo to a friend? That is the act of removing metadata. But if a signal is embedded within the image content itself, the same operation cannot remove it.
Thomas also illustrates how this works in text. He presents a hypothetical example in which eight word choices are treated as 8 bits, and the binary number 10101101 is read as the number 173, which in turn points to the author and a timestamp—though he is explicit that this example is fictional.
The same principle applies to audio. The open-source tool "audiowmark," released in 2018, is described as capable of embedding 128 bits of information in audio files protected with an encryption key (AES). The underlying technology is not new.
One article that broadened this discussion is a commentary piece by byteiota. Because it is an opinion piece, the following should be read as the author's arguments.
According to byteiota, since August 2, 2026, text returned by the Claude API has contained invisible marks embedded in its word choices. Only Anthropic and parties holding the corresponding key can detect them.
Anthropic states that this watermark only indicates that "Claude was involved in creating or editing" the content. It reportedly cannot identify specific users, organizations, or conversations.
byteiota characterizes this as a policy-based limitation rather than a technical one—meaning the approach could change in the future.
The same article covers findings from developer Xusheng Li, who analyzed Microsoft Paint in August. He reportedly found that AI-generated images contained an invisible GUID (a globally unique identifier unlikely to be duplicated) issued by a server.
This was said to be true even on Copilot+ PCs marketed as generating images "locally," and Microsoft's provenance documentation reportedly makes no mention of GUIDs. However, no evidence is presented that this identifier is actually used to track individual users.
A second item is a study released by Lasso Security on September 17, which reported that text watermarks could potentially alter the behavior of AI agents. The researchers called this a "provenance tax."
There are legitimate reasons to embed watermarks. A TechTarget explainer cites benefits including combating misinformation and deepfakes, verifying authorship, and confirming the authenticity of evidence.
At the same time, weaknesses are acknowledged. Text watermarks tend to disappear when humans make edits, and OpenAI withdrew its text detection tool after just six months due to poor accuracy. There is also potential for misuse—attaching false watermarks to authentic images to cast suspicion on them.
The same explainer also notes concerns that widespread watermarking could enable tracking of how generative AI is used. Even proponents do not deny that privacy challenges exist.
Additionally, the SynthID Detector is described as capable of identifying content created not only by Google's AI, but also by partners including OpenAI, NVIDIA, and Kakao. Watermarking systems are already spreading across multiple companies.
This is not a distant concern for people in Japan. Gemini, ChatGPT, Copilot, and Claude are all available in Japan through the same services. No Japan-specific announcements were found during the research for this article.
Consider three scenarios:
First, a corporate communications staff member publishes a banner created with AI. In this case, a watermark identifying the content as AI-generated might actually enhance credibility.
Second, an employee who discovers internal misconduct rewrites a document with AI and submits an anonymous tip. If the text contains a traceable mark, the author could potentially be identified.
Third, an ordinary user refines a political opinion with AI and posts it on social media. Knowing that the distribution path might be traceable could make them hesitate about what to write.
byteiota suggests that for most use cases, users can simply accept and document the presence of watermarks. For anonymous reporting or handling confidential documents, it recommends locally-run open-weight models such as Llama, Mistral, and Qwen—while acknowledging the trade-off in performance.
byteiota also notes that Article 50 of the EU AI Act requires developers not to remove watermarks from processed content. As this trend advances, tracking mechanisms may become even more deeply embedded.
No. It is a term proposed by Thomas. Technically, these are referred to as "invisible watermarks" or "digital watermarks."
SynthID-O is described as having the capacity to embed a 64-bit identifier, but the materials reviewed for this article contain no evidence that Google links this to personal information. The theoretical possibility and actual practice must be considered separately.
Not necessarily. Because spymarks are embedded in the actual pixels or word choices of the content, operations that delete EXIF data or similar metadata will not remove them.
It is not straightforward. Watermarks are useful for combating misinformation and verifying authenticity, but they can also serve as a means of tracking depending on how they are used. The central demand in this debate is transparency: people want to know what is embedded and who can access it.
As a first step, take a moment to look up the watermarking specifications and official explanations for the AI services you use.
This article is a cross-post from AI Friends.
