SynthID's image watermark carries a 64-bit ID field

An essay published on brand.io on September 21, 2026, argues that AI content-watermarking systems have grown from simple "this was AI-generated" labels into something closer to tracking infrastructure. Its author calls the result a "spymark" rather than a watermark. The claim rests on one technical detail from Google DeepMind's own research paper on SynthID-Image. Each image's watermark payload is 136 bits long. Of those, 64 bits are described as a database ID. The other 72 bits handle error correction.

Watermarking means quietly hiding information inside a file, such as a picture, an audio clip, or a block of text. A person cannot notice it, but a matching detector can read it back out. SynthID, Google's watermarking system, is built into several of its image- and text-generation products.

What the paper describes versus what Google says it does

The SynthID-Image paper describes a 136-bit payload embedded into 512-by-512-pixel images: 64 bits for a database ID, plus 72 bits of error correction. The brand.io essay calls these "secret hidden signals imperceptible to humans." A 64-bit field is large enough to give a separate number to every image SynthID has ever watermarked. That size is why the essay treats the field as evidence the system could identify single images, not just flag that a picture is AI-made.

Google's own public documentation describes something narrower. It says SynthID works by using "a pseudorandom function to augment model logits" as content is generated. That signal is applied "in a way that helps you determine if the text was generated by your model." It is a single yes-or-no signal, not an identifier tied to one person or one request. The documentation adds that models sharing a tokenizer also share one watermark and one detector. The same watermark covers every output from that model, not a unique one per user. Google's own material does not mention a database-ID field.

The essay is careful about this gap. It presents the 64-bit field as a documented technical capability in the research paper, not as proof that Google or anyone else uses it to track specific people today. It says it found no public evidence that anyone does.

Other systems the essay names

The essay makes the same argument about text and audio watermarks. It says SynthID's text version steers word choices during generation to create "a detectable statistical pattern" tied to the model. It adds that OpenAI has built a similar provenance signal into its own image and video output. For audio, it points to Audiowerk, an open-source watermarking tool dating to 2018. The essay says Audiowerk can "hide 128-bit payloads in audio and protect them with secret AES key." It also compares the idea to printer tracking dots. Many color laser printers have stamped this near-invisible pattern on pages since the 1980s. It encodes a printer's serial number plus the date and time of printing.

What this means for developers

If you build on SynthID or a similar watermarking tool, read the underlying research paper before you tell your own users what the system does and does not record. A payload's technical capacity and a company's stated policy on using that capacity are two different things. This story shows they can diverge without either side lying: the field exists in the specification, and the company says it does not use the field for tracking.

If you generate images, audio, or text at scale, check the watermarking library's specification for any identifier fields before you adopt it. Then write down, in plain language for your own users, what the watermark can and cannot be used to determine.