ArtCraft founder warns AI watermarks could become “spymarks”

Brandon Thomas, founder of ArtCraft, has warned that invisible marks intended to identify AI-generated media could become a means of tracing creators and the routes by which their work spreads. He has proposed the term “spymark” for hidden signals used to track content without a user’s consent.

The argument is hypothetical, not an allegation that Google is conducting such surveillance. Thomas used Google’s SynthID as a representative example, but no evidence has been presented that Google embeds personal identifiers in SynthID or uses it to track users.

Thomas’s concern rests on the possibility that an embedded identifier could be matched with a separate database containing information such as names, IP addresses, dates of birth and political affiliations. In that scenario, he argued, an otherwise imperceptible signal could identify a creator or reconstruct a file’s distribution route.

Gigazine, which reported Thomas’s argument on Nov. 8, distinguished the proposed “spymark” from a conventional watermark that establishes authenticity or ownership. The term combines secret surveillance with an embedded marker, referring to signals that encode an opaque tracking identifier rather than useful file information.

The concern turns partly on durability. EXIF data in images and ID3 information in audio can generally be inspected, edited or removed, Thomas said. An imperceptible watermark embedded in the media itself can be far harder for an ordinary user to notice or erase, and SynthID is designed to remain detectable after image editing or compression.

The technical capacity cited in the discussion is substantial but does not by itself establish a tracking system. Google’s SynthID-O image-watermarking research describes carrying 136 bits in a 512-by-512-pixel image; Thomas said 64 bits could serve as an identifier and 72 as error correction.

Google launched SynthID in 2023 to identify AI-made images, video and audio through imperceptible watermarks. In October, the company said it had marked more than 180 billion images and videos and 240,000 years of audio, and had expanded its English-language SynthID Detector globally on Oct. 7. The detector checks files made using Google AI or participating partners including OpenAI, NVIDIA, Kakao and Apple.

The debate comes as provenance systems move from experimental tools toward broader deployment. Google said verification features in Search, Gemini and Chrome handle more than 1 million requests a day. Brookings notes that watermarking can help trace a medium’s origin, while sophisticated versions generally need a computer to detect; researchers at Duke University have also found that small, imperceptible pixel changes can fool machine-learning watermark detectors.

Thomas warned that wider use across social-media services, smartphones and creation tools could make posts more traceable, with particular consequences for whistleblowers and people expressing views anonymously. CUTS, a consumer advocacy group, has separately warned that watermarking, hashing and metadata-tracking systems can endanger privacy and online anonymity, including for people exposing state abuse or seeking support under hostile conditions.

The central policy question is therefore whether systems designed for transparency can be deployed without turning provenance into identity tracking. Existing measures already include AI-content disclosure requirements in certain contexts under the EU AI Act, alongside voluntary industry commitments in the United States to develop watermarking and provenance mechanisms.