VocBulwark: Towards Practical Generative Speech Watermarking via Additional-Parameter Injection

TL;DR

VocBulwark tackles the challenge of watermarking generative speech without degrading perceptual quality by introducing an additional-parameter injection framework. It freezes the generative backbone and tightly couples watermarks into the acoustic space via a Temporal Adapter, while a Coarse-to-Fine Gated Extractor enables robust watermark recovery under diverse distortions. An Attack Simulator and Accuracy-Guided Optimization Curriculum balance fidelity and extraction reliability, achieving high payload capacity (up to 2000 bps) with strong robustness to common, variable-length, and neural Codec attacks across diffusion and GAN vocoders. The approach demonstrates excellent generalization to out-of-distribution data and cross-lingual settings, offering a practical pathway for model provenance and content regulation in real-world speech synthesis. Overall, VocBulwark delivers a scalable, efficient, and resilient watermarking solution for regulated, AI-generated speech.

Abstract

Generated speech achieves human-level naturalness but escalates security risks of misuse. However, existing watermarking methods fail to reconcile fidelity with robustness, as they rely either on simple superposition in the noise space or on intrusive alterations to model weights. To bridge this gap, we propose VocBulwark, an additional-parameter injection framework that freezes generative model parameters to preserve perceptual quality. Specifically, we design a Temporal Adapter to deeply entangle watermarks with acoustic attributes, synergizing with a Coarse-to-Fine Gated Extractor to resist advanced attacks. Furthermore, we develop an Accuracy-Guided Optimization Curriculum that dynamically orchestrates gradient flow to resolve the optimization conflict between fidelity and robustness. Comprehensive experiments demonstrate that VocBulwark achieves high-capacity and high-fidelity watermarking, offering robust defense against complex practical scenarios, with resilience to Codec regenerations and variable-length manipulations.

Figures (8)

• Figure 1: Schematic comparison of generative watermarking paradigms and robustness evaluation. The left panel contrasts our VocBulwark (an Additional-Parameter Injection strategy) against prevalent baselines, including Weight Embedding, Model Fine-tuning, and Input Modification. The right panel visualizes the comparative robustness of these strategies across diverse attack scenarios.
• Figure 2: The overall framework of VocBulwark. The Temporal Adapter functions as a lightweight module that seamlessly entangles watermarks into acoustic attributes without disrupting the native generation process. Following the Attack Simulator, the Cage achieves precise watermark recovery via a coarse-to-fine feature aggregation mechanism. The Accuracy-Guided Optimization Curriculum is employed to adaptively modulate the trainable components, optimizing the trade-off between generation fidelity and extraction accuracy.
• Figure 3: Scalability Analysis Under Varying Watermark Capacities on LJSpeech Dataset.
• Figure 4: Robustness against cropping attacks across diverse ratios and positions.
• Figure 5: Comparison of Computational Efficiency in Generating and Extraction Time.