A new word entered the AI-privacy vocabulary this week, and the argument behind it is more technical than the pun suggests. An essay titled "Spymarks, Not Watermarks," published September 21, 2026, argues that invisible AI-embedded tracking signals — Google's SynthID chief among them — deserve their own name, distinct from the reassuring, familiar word "watermark." It reached Hacker News's front page with 127 points and a genuinely split comment thread.
The essay's core move is definitional, not just rhetorical: a watermark, it argues, is "a visible mark embedded in a physical or digital medium to verify authenticity or assert ownership." A spymark is "a hidden signal that makes your work traceable without your knowledge or consent." Collapsing both into one word, the argument goes, has let a real tracking capability hide inside a word people associate with banknote security features and stock-photo overlays.
TL;DR — what people are actually asking
| Question | Direct answer |
|---|---|
| What's a "spymark," per the essay? | A hidden, identity-linkable tracking signal embedded in media without meaningful user knowledge |
| What's the named example? | Google's SynthID |
| How much data can it hide? | Up to 136 bits in a 512x512 image — room for a 64-bit database ID |
| Is this the same as C2PA? | No — C2PA is disclosed, standardized metadata; a spymark is embedded in the data itself |
| Does stripping EXIF/ID3 remove it? | No — it's not stored as ordinary metadata |
| What's the pushback? | The term is seen as loaded; some argue SynthID has legitimate, non-tracking uses |
The technical claim behind the coined term
The essay's most concrete evidence is a specific number from Google's own published research: SynthID-Image's SynthID-O variant can encode a 136-bit payload into a single 512x512-pixel image. The essay's own math on what that buys: a 64-bit database identifier, with 72 bits left over for error correction — meaning the payload isn't just "this image is AI-generated," it's large enough to point at a specific record in a database, potentially linking an image back to a specific user account, session, or generation event.
That distinction — a generic AI-generated flag versus a payload big enough for individual identification — is the entire argument. A visible or disclosed watermark tells you what something is. A payload with 64 bits of addressable identifier space can tell whoever controls the decoding key who generated it, which is a fundamentally different category of information than authenticity verification, even though both get called "watermarking" in casual usage.
The essay extends the same argument to audio and text. For audio, it cites academic survey research on watermarking robustness (Wen et al., "SoK: How Robust is Audio Watermarking in Generative AI models?") showing spectrograms of watermarked versus unwatermarked audio that are visually and audibly indistinguishable, while surviving compression and re-encoding — the same durability property that makes the technique useful for legitimate provenance tracking and useful for covert tracking simultaneously. For text, it describes SynthID's word-choice steering: selecting among synonymous word options (e.g., "winding" versus "curving") to encode a detectable statistical pattern across enough word choices to carry a payload, illustrated in the essay with a toy example mapping 8 binary word-choice decisions to a 3-digit database ID.
Why "spymark" specifically, and not just "invisible watermark"
The essay makes a deliberate etymological argument for coining a new term rather than qualifying the existing one: "watermark" already carries decades of benign connotation — banknote security features, stock-photo overlays, meme-image branding — that the essay argues actively works against public understanding of what's actually different about the SynthID category. Citing Ursula K. Le Guin's "The Rule of Names" ("to speak the name is to control the thing"), the essay's stated goal is collapsing a multi-sentence technical explanation into one word that carries the privacy concern by itself, the same way "phishing" or "deepfake" became load-bearing single words for concepts that used to require a paragraph to explain.
The essay is careful to draw a boundary around what does and doesn't count, which is the part worth taking seriously independent of whether the coined term itself catches on:
- Not a spymark: a banknote's visible security watermark, a Getty Images overlay, a meme-site logo stamp — all visible, disclosed, non-tracking.
- Not a spymark: standardized, user-editable metadata like EXIF or ID3 tags — inspectable and strippable, even though EXIF specifically can leak sensitive data like GPS coordinates if left in place.
- A spymark: an invisible signal, embedded directly in pixel, audio, or word-choice data, encoding a tracking identifier the user has limited-to-no visibility into or control over.
That third category is where C2PA / Content Credentials — the standard explainx.ai has covered as an emerging LinkedIn and platform-level AI-disclosure mechanism — deliberately does not sit, by design. C2PA's whole model is disclosed, standardized, auditable metadata stating what generated a piece of content and how it was edited; it's closer to the essay's "EXIF" example than its "SynthID" example, precisely because it's meant to be inspected rather than hidden.
The pushback, and why it's not unreasonable
The Hacker News discussion didn't uniformly accept the framing. One frequent objection: "spymark" is a deliberately negative-sounding coinage applied to a technology with real, legitimate uses — distinguishing AI-generated content from human-created content at scale is a genuine problem worth solving, and a robust, hard-to-remove signal is one honest way to solve it. A commenter argued "invisible watermark" or "tracking watermark" would communicate the same distinction without the loaded framing, and that SynthID specifically has an advantage over visible watermarking: it doesn't degrade the visible quality of the output the way a stamped logo or overlay does.
A separate, more concrete rebuttal challenged the practical durability of the technique itself, specifically for the text example: word-choice steering across a handful of synonym pairs is a small signal space, and natural variation in how any given writer already alternates between synonyms could plausibly interfere with reliably decoding an embedded payload from a short passage — a real technical question about robustness that the essay's toy example doesn't fully address.
The strongest counter-argument in favor of the essay's framing came from a different angle entirely: hidden tracking signals have already been used by governments to identify whistleblowers through leaked documents — a concern that predates generative AI by decades (printer tracking dots, dating to the 1980s, are cited directly in the essay as an early non-AI spymark example) and one that a reader focused only on "is this AI slop or not" might not weigh as heavily as the privacy-and-dissent framing deserves.
Where this fits the broader 2026 provenance fight
This isn't the first time explainx.ai has covered a disclosure mechanism drawing scrutiny for what it actually reveals versus what it appears to promise. LinkedIn's rollout of C2PA Content Credentials faced its own version of this same question — whether a disclosure label actually tells a viewer what they think it tells them, or whether the underlying mechanism does more (or less) than the label implies. The spymark essay pushes that same scrutiny in the opposite direction: instead of asking whether a disclosed label is trustworthy, it asks whether an undisclosed signal should be treated as a privacy risk in its own right, independent of whether the content it's embedded in is ever publicly questioned.
The two mechanisms solve genuinely different problems and shouldn't be evaluated on the same scale. C2PA exists to answer "was this AI-generated, and how was it edited" for a viewer who wants to know. SynthID-style watermarking exists to answer the same underlying question at a technical level detectable by automated systems — social platforms scanning uploads at scale, for instance — without requiring the content's publisher to opt into disclosure at all. The essay's argument is essentially that the second mechanism's non-optional, invisible nature deserves to be named and understood as a meaningfully different category of technology from the first, not folded into the same reassuring "watermark" umbrella term just because both are colloquially called watermarking.
What this means if you publish AI-generated content
- Know which specific tool you're using and what it embeds, rather than assuming "watermark" means the same thing across products. A visible logo stamp, a C2PA credential, and a SynthID-style embedded signal are three different mechanisms with three different levels of user visibility and control — treating them as interchangeable is exactly the confusion the essay is arguing against.
- Don't assume standard metadata removal is sufficient privacy hygiene for content generated by tools using this category of watermarking — stripping EXIF or ID3 tags does nothing to a signal embedded in the underlying pixel or audio data itself.
- If provenance disclosure is your actual goal (proving something is AI-generated, or proving your own authorship), a disclosed standard like C2PA is a fundamentally different tool for a fundamentally different job than an invisible statistical watermark — pick based on whether you want the signal to be inspectable by the content's own recipient, or invisible to everyone except whoever holds the decoding key.
Related on explainx.ai
- LinkedIn Content Credentials: C2PA for AI Images
- How Does AI Text Watermarking Actually Work?
- Anthropic Is Watermarking Claude Text — and Attaching C2PA to Files
- LLM-Generated Text Detection with Classical ML (SVM)
- The Slopocalypse: AI Slop and the Internet
- AI Regulation: EU AI Act and US Policy Complete Guide
- Self-Host Photos with Immich 3: Privacy, Cost, and Background Blur
Primary source: "Spymarks, Not Watermarks" (brand.io, September 21, 2026)
This post reflects an opinion essay published September 21, 2026 and its Hacker News discussion. The "spymark" terminology is the essay's own coined term, not an industry-standard or Google-endorsed classification. SynthID technical details (payload size, error correction bits) are cited from Google's own published SynthID-Image research as referenced in the essay. Follow @explainx_ai for updates.