SoK: How Robust is Audio Watermarking in Generative AI models?
Yizhu Wen, Ashwin Innuganti, Aaron Bien Ramos, Hanqing Guo, Qiben Yan
TL;DR
This SoK conducts a comprehensive, large-scale evaluation of audio watermarking schemes in the context of generative AI, revealing that no scheme remains robust against the full spectrum of seen attacks, especially AI-induced removals. By introducing a taxonomy, reproducing 9 schemes, and testing 22 removal-attack types across 3 datasets with an open-source framework, the work highlights fundamental vulnerabilities such as desynchronization and AI-model-assisted removal. The findings underscore limited practical viability for watermark-based IP protection in evolving AI landscapes and call for strategies like content-adaptive, patchable, or attack-informed watermark designs. The work provides a valuable benchmark for researchers and developers aiming to assess and improve watermark robustness in real-world, AI-driven audio ecosystems.
Abstract
Audio watermarking is increasingly used to verify the provenance of AI-generated content, enabling applications such as detecting AI-generated speech, protecting music IP, and defending against voice cloning. To be effective, audio watermarks must resist removal attacks that distort signals to evade detection. While many schemes claim robustness, these claims are typically tested in isolation and against a limited set of attacks. A systematic evaluation against diverse removal attacks is lacking, hindering practical deployment. In this paper, we investigate whether recent watermarking schemes that claim robustness can withstand a broad range of removal attacks. First, we introduce a taxonomy covering 22 audio watermarking schemes. Next, we summarize their underlying technologies and potential vulnerabilities. We then present a large-scale empirical study to assess their robustness. To support this, we build an evaluation framework encompassing 22 types of removal attacks (109 configurations) including signal-level, physical-level, and AI-induced distortions. We reproduce 9 watermarking schemes using open-source code, identify 8 new highly effective attacks, and highlight 11 key findings that expose the fundamental limitations of these methods across 3 public datasets. Our results reveal that none of the surveyed schemes can withstand all tested distortions. This evaluation offers a comprehensive view of how current watermarking methods perform under real-world threats. Our demo and code are available at https://sokaudiowm.github.io/.