--- title: Marking Media So Leaks Have a Name date: '2026-07-04' description: 'How I''m building Protomarc, a system that marks images, video, audio, and PDF so a file can prove who owns it and, if it leaks, point back to whoever it was given to. A high-level look at the problem and the hard parts.' author: Pablo Fernandez tags: - Forensic Marking - Watermarking - Media - Content Protection - Attribution source: 'https://www.pablofr.com/blog/protomarc-forensic-marking' --- I have been building **Protomarc**, a system that marks media so that a file can answer two questions on its own: who does this belong to, and if it turns up somewhere it shouldn't, who was it given to. It works across four kinds of media that normally have nothing in common: images, video, audio, and [PDF](https://en.wikipedia.org/wiki/PDF). The mark is invisible, and it is built to survive the ordinary abuse a file takes on its way around the internet. This post is a high-level tour of the idea and, honestly, of the parts that were hard. I won't describe how any of it works under the hood. A real mark-and-trace pipeline runs on production infrastructure, not behind a blog post, so the examples below are illustrations of the shape of the thing rather than live output. ## The problem You hand a file to a specific set of people. A photo set goes to a dozen outlets under embargo. A cut of a film goes to a handful of reviewers. An unreleased track goes to a small list. A confidential document goes to the three parties in a deal. Then a copy shows up where it was never meant to be, and you have no idea which of those people let it out. The blunt tool for this is a [visible watermark](https://en.wikipedia.org/wiki/Digital_watermarking), and it is a bad tool. It defaces the work, it insults the honest recipients, and anyone acting in bad faith just crops or blurs it away. What you actually want is something the eye never notices, that ties the file to you, and that quietly encodes which copy this was, so a leak identifies itself. ## What Protomarc does Give it an asset and a recipient. It hands back a copy that looks identical to the original but carries an invisible, durable mark tied to that recipient. Later, if a suspect copy surfaces, even a degraded one, a detector reads the mark back out and tells you where the copy came from. ``` an asset + a recipient │ ▼ ┌──────────────┐ │ Protomarc │ └──────────────┘ │ ▼ one marked copy │ │ … it leaks … ▼ ┌──────────────┐ │ a detector │ └──────────────┘ │ ▼ the copy leads back to that recipient ``` *The whole loop: mark on the way out, read on the way back in.* ## Attribution and accusation There are really two jobs hiding in that loop, and they pull in slightly different directions. **Attribution** is the gentle one: the file proves it is yours. It is a signature woven through the whole thing, so a stray screenshot still carries your ownership with it. **Accusation** is the sharp one: every copy is a little different, so a leak points at a person. This is the harder promise to keep, because now the mark has to be not just invisible and durable but also unique per recipient and readable after someone has actively tried to destroy it. ## A marked example The way to picture accusation is that the same file goes out many times, and every copy is visually identical but privately distinct. Nobody can see the difference. The detector can. *The same file, delivered to three people. Identical to the eye, each copy carries a different invisible identity, so a leak points at one recipient.* Concretely, the same machinery covers very different situations: - **Images**: a press kit goes to forty outlets. A single photo appears on a forum. The photo names the outlet. - **Video**: a screener goes to reviewers. A phone recording of it, shaky and re-compressed, ends up on a pirate site. It still names the reviewer. - **Audio**: an unreleased track goes to a short list. A thirty-second clip leaks. The clip names the source. - **PDF**: a confidential document goes to three parties. One page is photographed and forwarded. The page names the party. ## What a marked copy looks like Every delivered copy carries the recipient's identity in several places at once, so scrubbing one trace does not remove the rest. Most of it is invisible: for an image the mark is woven through the pixels, and for a document it is also carried in the shapes of the text itself, so it survives being copied, re-encoded, or photographed off a screen. On top of that, Protomarc can add an optional visible band: a slim strip with the logo, a short deterrent line, and a File ID a person can read at a glance. It extends the canvas rather than covering the work, so cropping it away leaves the invisible marks untouched. Those layers are not just stacked, they are independent. The identity lives in more than one channel at once, so an attacker who manages to scrub one still leaves the others intact. *The layers of one delivered copy: an invisible mark and a per-recipient identity woven into the asset, with an optional visible mark on top.* Drag the handle on either example to compare an original with its fully marked copy. Most of what has been added you cannot see, which is exactly the point: *Drag to compare. The photo carries an invisible mark; the visible band is the human-readable part.* *The same on a document: marked invisibly through its own text, plus a legible footer band.* ## Marks a person can read Not every mark hides. Often you want the recipient to know a document is tracked, and to hand them a reference they can act on. Protomarc stamps those too, across a spectrum from barely-there to unmissable. The lightest is a slim band along the foot of every page, carrying the owner, a short notice, and a unique File ID: ![An invoice with a slim attribution band along the bottom](/blog/protomarc/doc-band-invoice.jpg "An attribution band along the foot of the page: owner, a short notice, and a unique File ID.") When a document needs to be checkable, it can carry a full verification panel instead: a signed code and a [QR](https://en.wikipedia.org/wiki/QR_code) a recipient scans to confirm the file is genuine and unaltered. ![An invoice with a verification panel and a QR code](/blog/protomarc/doc-verify-invoice.jpg "A verification panel: a signed code and a QR to confirm the document is authentic.") And for licensing an image, the credit and terms can ride in a corner panel with the owner's logo, so the attribution travels with the picture wherever it goes: ![A city sunset photo with a titled credit panel and a picture ID](/blog/protomarc/attribution-licensing.jpg "Picture attribution for licensing: a titled credit panel with the owner's logo and a unique picture ID.") At the loud end of that spectrum is the opposite of invisible: an overt watermark that announces a document is tracked and is hard to remove cleanly. Protomarc can lay a wave of repeating text across the whole page, on parallel sinusoidal baselines that keep it legible underneath. Each copy's wave is subtly different, so beyond shouting "handle with care" it also identifies the recipient, and because it blankets every corner, even a cropped fragment carries both. *Drag to reveal the wave overlay. It covers the page yet stays readable, and every copy is unique.* ## The hard parts The idea is simple to state. Making it hold up in the real world is where the work actually lived. **Invisible, yet almost impossible to kill.** These two goals fight each other. A mark you can feel is worthless, and a mark that dissolves the first time a file is compressed, cropped, rotated, re-encoded, or photographed off a screen is also worthless. The whole discipline is holding both at once. The thing that helped most was refusing to grade the mark against a clean copy: the only bar that matters is whether it survives the mess a real file goes through. **Four media, one promise.** An image, a video, an audio file, and a PDF are nothing alike, and yet the promise, attribution plus accusation, has to be identical across all of them. A lot of the effort went into hiding that difference behind a single, consistent interface, so that from the outside marking a PDF and marking a video feel like the same operation. **A copy for everyone, at scale.** Accusation means every recipient gets their own subtly different copy. Doing that for a long list, without the process becoming impractical, is its own problem, and one that is easy to underestimate until the list is long. **Reading a copy that has been through hell.** Leaks never arrive clean. They come cropped, screenshotted, re-compressed, half-deleted, or as a photo of a monitor. The detector had to be built to squeeze an answer out of a badly damaged copy, leaning on the strongest evidence it can find and falling back to weaker signals when it has to, rather than giving up the moment the file is imperfect. *The same marked copy after filters, cropping, a screenshot, and a photo taken off a screen. Every version still hands back the same identity.* **People who fight back.** The interesting adversary is not accidental damage, it is someone deliberately trying to strip the mark, including several recipients pooling their copies to try to cancel it out. Standing up to that, so that even a pooled and attacked copy still points at someone, was one of the parts I am most careful about. ``` copy A ──┐ copy B ──┼──▶ pooled into one copy ──▶ detector ──▶ still points at a colluder copy C ──┘ (to cancel the mark) ``` *Several recipients pool their copies and average them to cancel the per-recipient mark; a collusion-resistant mark still points back at one of them.* **Never accuse the wrong person.** An accusation is a serious thing to hand someone. So the whole system is tuned to be conservative: I would far rather it say "I cannot tell" than confidently name the wrong recipient. Getting that balance right, high confidence when it speaks, silence when it is unsure, matters more than raw detection rate. ``` suspect copy ──▶ detector ──┬──▶ strong evidence ──▶ names the recipient │ └──▶ weak / ambiguous ──▶ says "I cannot tell" ``` *The detector stays silent unless the evidence is strong, so it would rather say 'I cannot tell' than name the wrong recipient.* ## Where it is going Right now Protomarc is a working pipeline I keep sharpening, mostly along the two axes that matter: surviving nastier real-world damage, and staying trustworthy enough that an accusation means something. What I have not settled yet is the product around it. The technology works; the shape it should take does not have a single obvious answer. I can see several, but they do not pull equally. The one I keep coming back to is an advanced data room: the place you hand sensitive material to outside parties, with per-recipient leak protection baked into every file that leaves it. It is the sharpest fit, and for unglamorous reasons. The buyer is obvious, the pain is already budgeted for, and in the legal, M&A, and due-diligence world a single leaked document carries real weight, so "which side let this out" is a question people will pay to answer. The same engine points at two adjacent directions I hold more loosely: a layer for secure, protected content delivery that marks each copy at the moment it is served, and something closer to enforcement, on the [DMCA](https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act) and takedown side, where the job is not only to notice a leak but to prove whose copy it was. The industries with this exact problem are not hard to find: press and media under embargo, film and television screeners, music promos, licensing and stock imagery, and the deal rooms where one leaked page can move a number. The ordering may still shift, but the first move is settled: take this out of my own pipeline and put it in front of the people who hand sensitive files to others for a living. ``` ┌─────────────┐ │ Protomarc │ │ engine │ └──────┬──────┘ │ ┌─────────────────┼─────────────────┐ ▼ ▼ ▼ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ data room │ │ protected │ │ leak & │ │ with leak │ │ content │ │ takedown │ │ protection │ │ delivery │ │ evidence │ └─────────────┘ └─────────────┘ └─────────────┘ ▲ start here ``` *One engine, several possible products. The technology is settled; the data room is where I would start, with the other two close behind.* I am also not pretending this is an empty field. Serious companies already work on pieces of it, [steg.ai](https://steg.ai/), [Digimarc](https://www.digimarc.com/), [IMATAG](https://www.imatag.com/), [Irdeto](https://irdeto.com/), [Verimatrix](https://www.verimatrix.com/), and others, each with a different emphasis, from invisible image marks to broadcast and video protection. Knowing that field is part of the work: it shows me where the bar sits, and where there is still room to be genuinely better rather than merely different. And there is one frontier I care about more than any other. The most dangerous attack on a mark like this is no longer compression or a photo of a screen, it is [generative AI](https://en.wikipedia.org/wiki/Generative_artificial_intelligence): passing an image through a model that regenerates it in [latent space](https://en.wikipedia.org/wiki/Latent_space) and hands back something that looks identical to a person while the original signal is quietly gone. Making a mark that survives that, all the way to one hundred percent, is the problem I most want to solve. The goal has not changed since the first sketch: make ownership and traceability something you can rely on invisibly, across every kind of file you share. But in a world where any image can be silently re-synthesized by a model, keeping that promise means the mark has to live somewhere the model cannot wash away. ``` marked original generative model resynthesized (latent space) ┌────────┐ · ○ ○ ○ · ┌────────┐ ╱▓▓▓▓▓▓▓▓╱ · ○ ○ ○ · ╱········╱ ╱▓ MARK ▓╱ ──▶ · ○ ○ ○ · ──▶ ╱········╱ └────────┘ · · · · └────────┘ ``` *The attack I worry about most. A model takes the image apart into latent space and paints a fresh one from scratch: the result looks identical to a person, but the invisible mark that lived in the original signal is quietly washed away. Surviving this is the frontier.*