Spymarks just seem like another word for <a href="https://en.wikipedia.org/wiki/Steganography" rel="nofollow">https://en.wikipedia.org/wiki/Steganography. On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced (for example: a camera we are certain does not watermark, an image editor we are certain doesn't watermark, an image compressor we are certain can't watermark, etc). One vector that I am particularly concerned about is social media. Most images and videos uploaded to most social media is re-compressed by the target platform. This is a door to tracking that is far too easy for social media platforms to open. They might rationalize it (if discovered/announced) by saying that our memes won't be reposted, images or work stolen, etc... but honestly I'd rather my work be stolen than tracking information inserted in there. Oh, we also have stuff which is way more secure, like time-stamped cryptographic signatures.
> Spymarks just seem like another word for <a href="https://en.wikipedia.org/…" rel="nofollow">https://en.wikipedia.org/…
Stop using links instead of words. Your comment is literally unreadable without going on to other websites.
It was cropped to just displaying as <a href="https://en.wikipedia.org/wi" rel="nofollow">https://en.wikipedia.org/wi.. on my mobile screen - so not really readable here.
Spymarks an application of steganography, not a different name for it.
> On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced
That doesn't help with things like the typical use of SynthID where the spymarking is done by the same process generating the content, so there is never a clean comparator. (It also wouldn't be useful anytime it is inplemented as part of a transformation—compression, etc. —step, for the same reason.)
When someone else controls distribution, they also control the spark, each request could serve up a different payload. So innocuous images could encode ids, tracking receivers as well as originators.
You can verify the absence of any particular mark if you have sufficient information about the mark, but, you are right, the whole reason spymarks are steganographic is so that they can escape detection absent that information, which is important for the spying-on-the-user use case.
> ... particularly concerned about is social media. Most images and videos uploaded to most social media is re-compressed by the target platform. This is a door to tracking that is far too easy for social media platforms to open.
This has been going on for a while with Facebook. They seem to embed custom metadata tags so that images shared outside the platform can be traced back:
The vulnerability of steganography is that is has to pretend that signal is noise. Remove the noise - and the signal is gone. I'm pretty sure that the simplest gaussian blur will remove the spymark from any picture.
Or... add some noise. Just align the last bit of every pixel channel with a random bit sequence - and Bob's your uncle.
"just" yes, you "just" have to do it every time. and so does everyone else.
sadly we live in a society of comfort, where people do not even remove the trackers from links, so why would you expect they add a blur to images...
I tried both options, and both options visibly* degraded quality while failing to remove my hidden message. Consider that good schemes are already designed to be resilient in the face of lossy image compression, which is a lot more disruptive than the things you suggested.
* the 7-bit quantization + 1-bit noise option not by much, but still, visible
This is a straightforward example of how the positive or negative valence of a piece of tech depends entirely on how it's used.
You just need to address three questions:
- who controls what information is going in? (that is, what is the process by which the tech companies who control all the tech are using it)
- who controls what information is coming out? (that is, is the steganographic format open enough that anyone can read it, or does it depend on having a key)
- what legal regulation is this subject to? (does sneaking individuals name and address into their photographs incur you massive GDPR liabilities when it is discovered?)
Note that there's a widespread precedent: <a href="https://en.wikipedia.org/wiki/Printer_tracking_dots" rel="nofollow">https://en.wikipedia.org/wiki/Printer_tracking_dots
I actually wrote a library to do stego with LLM outputs last year and it turned out to be an almost exact implementation of the Anthropic watermark algo.
Repo here <a href="https://github.com/sutt/innocuous" rel="nofollow">https://github.com/sutt/innocuous. It works with last year's llama.cpp. Check out the "Use Cases" and "How it works" sections in the readme if you're interested.
Retro_Dev · · focus · HN ↗
wodenokoto · · focus · HN ↗
Stop using links instead of words. Your comment is literally unreadable without going on to other websites.
fumplethumb · · focus · HN ↗
gorgoiler · · focus · HN ↗
zxexz · · focus · HN ↗
faithful_droog · · focus · HN ↗
Normal_gaussian · · focus · HN ↗
lozf · · focus · HN ↗
(Edit: hmm, without the "https://" it seems to depend on the browsers ability to recognise a URL.)
abustamam · · focus · HN ↗
"for stenography (link)"
Or to use another HNism
"Stenography[1]"
Those interested could click it, those not could still read the comment.
TeMPOraL · · focus · HN ↗
teitoklien · · focus · HN ↗
:D
azatom · · focus · HN ↗
What will be the next? I will be unable to see the domain of a link on hover/longtap and have to trust random links like on a search engine?
MUTINY against hn!
amelius · · focus · HN ↗
No, the words could contain steganography. Use links to be safe!
Retro_Dev · · focus · HN ↗
dragonwriter · · focus · HN ↗
> On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced
That doesn't help with things like the typical use of SynthID where the spymarking is done by the same process generating the content, so there is never a clean comparator. (It also wouldn't be useful anytime it is inplemented as part of a transformation—compression, etc. —step, for the same reason.)
Normal_gaussian · · focus · HN ↗
sitkack · · focus · HN ↗
dragonwriter · · focus · HN ↗
speerer · · focus · HN ↗
This has been going on for a while with Facebook. They seem to embed custom metadata tags so that images shared outside the platform can be traced back:
<a href="https://stackoverflow.com/questions/31120222/iptc-metadata-automatically-added-to-uploaded-images-on-facebook" rel="nofollow">https://stackoverflow.com/questions/31120222/iptc-metadata-a...
okaleniuk · · focus · HN ↗
Or... add some noise. Just align the last bit of every pixel channel with a random bit sequence - and Bob's your uncle.
busssard · · focus · HN ↗
okaleniuk · · focus · HN ↗
pjc50 · · focus · HN ↗
okaleniuk · · focus · HN ↗
minitech · · focus · HN ↗
* the 7-bit quantization + 1-bit noise option not by much, but still, visible
pjc50 · · focus · HN ↗
You just need to address three questions:
- who controls what information is going in? (that is, what is the process by which the tech companies who control all the tech are using it)
- who controls what information is coming out? (that is, is the steganographic format open enough that anyone can read it, or does it depend on having a key)
- what legal regulation is this subject to? (does sneaking individuals name and address into their photographs incur you massive GDPR liabilities when it is discovered?)
Note that there's a widespread precedent: <a href="https://en.wikipedia.org/wiki/Printer_tracking_dots" rel="nofollow">https://en.wikipedia.org/wiki/Printer_tracking_dots
stillsut · · focus · HN ↗
Repo here <a href="https://github.com/sutt/innocuous" rel="nofollow">https://github.com/sutt/innocuous. It works with last year's llama.cpp. Check out the "Use Cases" and "How it works" sections in the readme if you're interested.