You can verify the absence of any particular mark if you have sufficient information about the mark, but, you are right, the whole reason spymarks are steganographic is so that they can escape detection absent that information, which is important for the spying-on-the-user use case.

When someone else controls distribution, they also control the spark, each request could serve up a different payload. So innocuous images could encode ids, tracking receivers as well as originators.