SoK: Audio Watermarking Robustness

26 Watermarking schemes analyzed

10 Open-source methods reproduced

5 Datasets (3 speech + 2 music)

127 Attack settings evaluated

Paper Overview

We study whether modern audio watermarks survive practical removal attacks while preserving the usefulness of the audio, connecting a component-wise taxonomy of 26 schemes with a benchmark of 10 reproducible methods across speech and music.

Research Questions

RQ1. How do traditional and AI-based methods compare in robustness? Answer: AI-based methods defend against 51.63% of attack settings vs. 28.97% for traditional methods.
RQ2. What are the main robustness challenges? Answer: Physical and AI-induced distortions remain the main challenges—pitch shift, time stretch, re-recording, VC, and TTS are major failure modes.
RQ3. How do design choices affect robustness? Answer: Message repetition and broad frequency coverage improve robustness; AI-distortion training helps against AI-induced attacks.

Generalized audio watermark pipeline — Generalized audio watermarking pipeline from the paper

Key Finding No evaluated method is robust to all tested attacks.

Pitch shift Physical re-recording Voice conversion TTS regeneration

Suggestions Design and evaluation lessons for future audio watermarks.

Frame-level repetitionMore recoverable evidence across time.
Broader frequency coverageLess dependence on one fragile band.
AI-distortion trainingExpose models to VC and TTS attacks.
Subjective listening testsMeasure utility beyond objective scores.

Implemented Watermark Methods

We reproduce 10 open-source watermarking methods spanning both AI-based and traditional signal-processing approaches, each with different embedding strategies and robustness characteristics.

#	Method	Type	Watermark Pattern	Frequency Range	Message Repetition	Training Distortions
1	AudioSeal	AI	Encoder network → waveform additive	0 – 8000 Hz	Frame level	14
2	WavMark	AI	Invertible Neural Network (INN)	0 – 8000 Hz	Block level	10
3	SilentCipher	AI	Encoder network → waveform additive	0 – 4000 Hz	Frame level	6
4	Timbre	AI	Encoder network → waveform additive	0 – 8000 Hz	Frame level	1
5	RobustDNN	AI	Encoder network → waveform additive	0 – 8000 Hz	Frame level	3
6	AWARE	AI	Adversarial optimization	0 – 8000 Hz	None	0
7	audiowmark	Traditional	FFT bin modification	861 – 4307 Hz	Block level	N/A
8	FSVC	Traditional	DCT coefficient modification	1088 – 1448 Hz	None	N/A
9	Patchwork	Traditional	DCT coefficient modification (multi-layer)	3000 – 7000 Hz	Layer level	N/A
10	Norm-space	Traditional	DCT coefficient modification (norm-space)	0 – 8000 Hz	None	N/A

Evaluation Settings

We evaluate watermark robustness across three categories of removal attacks: digital-level, physical-level, and AI-induced distortions.

Watermark Spectrogram Comparison

Visual comparison of where watermark energy appears across the 10 methods.

Spectrogram visualization of watermark-only signals across selected methods.

Digital-level: Pitch Shift & Time Stretch

Heatmap of watermark bit recovery accuracy and perceptual quality under pitch-shift and time-stretch attacks. Quality thresholds: ViSQOL > 3.0, MUSHRA-Music > 79, MUSHRA-Speech > 60.

Heatmap: watermark accuracy under pitch-shift and time-stretch.

Physical-level: Re-recording

Re-recording introduces room, distance, microphone, and speaker effects. Distance causes larger accuracy drops than device changes.

Radar chart: recovery accuracy under distance settings.

Distance accuracy

Radar chart: recovery accuracy under device settings.

Device accuracy

Distance setting

Device setting

AI-induced: Voice Conversion & TTS

Voice conversion and TTS regeneration preserve perceived speech utility while discarding watermark traces from the waveform.

Zero-shot VC

Few-shot / Adaptive VC

Zero-shot TTS

Radar chart: Adaptive TTS + Griffin-Lim.

TTS + G-Lim

Radar chart: Adaptive TTS + universal HiFi-GAN.

TTS + H-GAN

Radar chart: Adaptive TTS + adaptive HiFi-GAN.

TTS + H-GAN*

Imperceptibility metrics under AI-induced distortion (SECS ≥ 0.8 threshold). Green = above threshold; red = below.
Metric	No Attack	Voice Conversion					Text-to-Speech
		AdaIn-VC	FragmentVC	YourTTS VC	MediumVC	RVC	YourTTS	Tacotron2			FastSpeech2
								G-Lim	H-GAN	H-GAN	G-Lim	H-GAN	H-GAN
		Zero-shot	Zero-shot	Zero-shot	Few-shot	Adaptive	Zero-shot	Adaptive	Adaptive	Adaptive*	Adaptive	Adaptive	Adaptive*
ViSQOL	4.87	3.82	3.02	3.96	2.54	4.04	2.35	1.81	2.69	2.72	1.82	2.71	2.75
SECS	0.99	0.84	0.75	0.90	0.67	0.93	0.83	0.69	0.87	0.87	0.71	0.89	0.90
MUSHRA-Speech	100	70	64	65	76	97	78	81	85	78	79	96	72

Diagram of zero-shot, few-shot, and adaptive AI-induced distortion attacks.

Audio Demos

Listen to representative audio samples for each distortion setting. Samples are grouped by distortion type. Expand a group to browse individual settings, then expand a setting to listen to more samples.