Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech

TL;DR

This work addresses the vulnerability of state-of-the-art post-hoc audio watermarks to transformation-based removal in speech. It unified and extended robustness evaluations across signal-processing, neural codecs, vocoders, and denoisers, testing five neural watermarking methods using a comprehensive metric suite that includes $TPR@1%FPR$, $ASR-CER$, $SIM$, and $SQUIM-MOS$; it also employs a band-splitting technique to accommodate varying native sample rates. The authors demonstrate that neural network–based transformations—especially low-bitrate neural codecs and denoisers—can reduce watermark detectability to near-zero without substantially harming audio quality. These findings underscore fundamental limitations of current post-hoc watermarking approaches and motivate the development of more robust, perhaps non-post-hoc, watermarking strategies for speech with practical deployment considerations such as detection thresholds and audio fidelity.

Abstract

In the audio modality, state-of-the-art watermarking methods leverage deep neural networks to allow the embedding of human-imperceptible signatures in generated audio. The ideal is to embed signatures that can be detected with high accuracy when the watermarked audio is altered via compression, filtering, or other transformations. Existing audio watermarking techniques operate in a post-hoc manner, manipulating "low-level" features of audio recordings after generation (e.g. through the addition of a low-magnitude watermark signal). We show that this post-hoc formulation makes existing audio watermarks vulnerable to transformation-based removal attacks. Focusing on speech audio, we (1) unify and extend existing evaluations of the effect of audio transformations on watermark detectability, and (2) demonstrate that state-of-the-art post-hoc audio watermarks can be removed with no knowledge of the watermarking scheme and minimal degradation in audio quality.

Figures (3)

• Figure 1: Watermark signatures. Given a short audio excerpt ("Original"), we apply five watermarking methods described in Section \ref{['sec:exp_watermarks']} ("AudioSeal," "WavMark," "MaskMark," "Timbre," and "Collaborative") and visualize the difference between original and watermarked audio at the spectrogram (top row) and waveform (bottom row). For each watermarking method, the original waveform is shown in grey and the difference in color.
• Figure 2: Robustness to low-bitrate codecs. We plot the achievable true-positive rate at a fixed 1% false-positive rate ("TPR@1%FPR") for each watermarking method under transformation via low-bitrate neural codecs. Watermark detection declines at low bitrates while audio quality is generally preserved, as indicated by SQUIM-MOS scores.
• Figure 3: Denoiser attack. We illustrate the application of the denoiser attack to Timbre-Watermark with spectrogram plots. Artifacts introduced by the watermark (blue rectangle) can be seen more clearly when compared to the original spectrogram (green rectangle); these are removed by the application of noise followed by the denoiser (yellow rectangle).