If Facebook already embeds user IDs in images (AI or no AI) I can only drool to think what kind tracking, advertising and mass surveillance opportunities are coming.
This is a great statistical analysis and it was a pleasure to read, but I wasn't expecting the claims to be so poorly supported.
There's also a reply from one of the Meta authors there, worth checking out.
Which claims do you think are poorly supported? I'm the author; I tried to include everything other people need to repeat the same experiments. I've even had two people write in directly to me, stating that they have been able to replicate my findings.
Or are you referring to the claims from Meta, Google, and Adobe -- which failed to hold up under independent evaluation.
You are also correct that one of the meta authors wrote in a comment. However, he demonstrated a clear lack of understanding regarding what makes the bits "independent" or how to resolve the independence problem.
> Or are you referring to the claims from Meta, Google, and Adobe -- which failed to hold up under independent evaluation.
This.
> However, he demonstrated a clear lack of understanding regarding what makes the bits "independent" or how to resolve the independence problem.
Yes, I didn’t want to call it out explicitly, but this is exactly the kind of thing that would have made my undergraduate statistics professor lose patience.
A watermark is not just “transparency.” It can reveal what tool someone used, how they work, or that an image came from a stigmatized platform. In sensitive contexts—politics, sexuality, medical issues, protest material, or private expression—that can become surveillance.
How common is it for peer reviewed papers like this to be so far off their claimed findings?
“According to Google's peer-reviewed and published paper, they claim to have a true positive rate (TPR) above 99.97% -- meaning that they will miss their own watermarks less than 1 in 10,000 times. However, my own empirical testing found that is it much closer to 1 in 20.”
The point is to embed a particular signature, which was generated randomly, in the image. The distance function discussed is the same as the popcount of the xor. It's well know that the xor of random data with correlated data is statistically random. Hence, however well correlated the signatures of unwatermarked images may be with each other, they would show no correlation with the signature of a watermarked image. That is, unless the watermark by extremely bad luck happened to be near one of these clusters the author discovered. This does represent a genuine flaw, but an extremely minor one, and one that can be easily mitigated with no changes to the underlying algorithm,
9 comments
[ 1332 ms ] story [ 4133 ms ] threadhttps://digital-strategy.ec.europa.eu/en/policies/eu-icons-l...
If Facebook already embeds user IDs in images (AI or no AI) I can only drool to think what kind tracking, advertising and mass surveillance opportunities are coming.
Or are you referring to the claims from Meta, Google, and Adobe -- which failed to hold up under independent evaluation.
You are also correct that one of the meta authors wrote in a comment. However, he demonstrated a clear lack of understanding regarding what makes the bits "independent" or how to resolve the independence problem.
This.
> However, he demonstrated a clear lack of understanding regarding what makes the bits "independent" or how to resolve the independence problem.
Yes, I didn’t want to call it out explicitly, but this is exactly the kind of thing that would have made my undergraduate statistics professor lose patience.
I am working on Saigon Watermarks: https://apps.apple.com/us/app/saigon-watermark/id6777061197 for detecting and removing provenence markers in AI.
The tool also removes c2pa markers, which google is now linking the device that took the photo with the photo.
scary stuff.
https://security.googleblog.com/2025/09/pixel-android-truste...
“According to Google's peer-reviewed and published paper, they claim to have a true positive rate (TPR) above 99.97% -- meaning that they will miss their own watermarks less than 1 in 10,000 times. However, my own empirical testing found that is it much closer to 1 in 20.”