How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

Likhith Kumara

cs.SDAug 17, 2026

How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

Authors: Likhith Kumara

Organizations: Indian Institute of Technology Madras, Chennai, India

Abstract

Neural audio watermarks are increasingly used to attribute and detect AI-generated speech, so their practical value rests on how cheaply an adversary can remove them. Robustness is usually measured by running a fixed battery of distortions blindly against every scheme. We instead make removal diagnostic: from a few clean/watermarked pairs we compute cheap structural probes that reveal where a watermark sits in the signal (its embedding domain), then apply a single domain-matched attack rather than a blind sweep. We further summarize each scheme with one threshold-free fragility score, the area under its accuracy-versus-quality trade-off, which an accuracy-only benchmark cannot provide. Across ten watermarking schemes the probes separate fragile from robust marks: for magnitude and carrier-domain watermarks a single matched attack erases the payload (WavMark, SilentCipher, audiowmark) or removes the detection flag (AudioSeal) at high objective quality (PESQ >= 3.6), whereas latent-domain marks (VoiceMark, WMCodec, AlignMark, AWARE) resist every training-free attack we apply. The same pair-only probe signatures also identify which watermarking scheme is present (84% over ten schemes).

Figures & tables

Figure 1: Method overview. From a few clean/watermarked pairs (Sec. 3 ) we compute the four structural probes (Sec. 4 ); each probe selects a matched attack class (Sec. 5 ), and the same probe signatures also identify which scheme is present. Sweeping the matched attack traces the accuracy–quality frontier whose area above the curve is the threshold-free fragility score (Sec. 5.1 ).

Figure 2: Structural probe signatures per scheme (pair-only, no attack run; means over $N{=}100$ clips/scheme, bootstrap $95\%$ CI half-widths $\leq 0.07$ ; formulas in Sec. 4 ). The cells with relative higher value is each scheme’s defining probe, which selects its matched attack (Sec. 5 ); the black line splits the fragile group (left) from the robust latent anchors (right), whose uniformly low values predict their resistance. The distinct signatures also identify which scheme is present (Sec. 5 ).

Archetype (defining probe)	Matched attack	Schemes
Narrowband carrier (Concentration)	band-stop	AudioSeal
Frequency-redundant (Coherence)	band-sweep	DNN-AWM
Universal template (Estimability)	template subtraction	audiowmark, WavMark, SilentCipher, AudioSeal payload
Linear in payload bits (Linearity)	estimation subtraction	Timbre

Table 1: Joint probe signature to matched attack. We assign an archetype, then verify by running the attack.

Scheme	matched attack	bit-acc	det	PESQ	ViSQOL	frag a
Removed at near-transparent quality:
audiowmark	template subtr.	$\mathbf{48.4\pm 2.9}$	0.00	4.22	4.62	$0.85\pm 0.03$
WavMark	template subtr.	$\mathbf{5.9\pm 4.6}$	0.06	4.17	4.47	$0.87\pm 0.05$
AudioSeal	band-stop	$60.7\pm 2.8$	0.05	3.62	4.55	$0.80\pm 0.03$
SilentCipher	RMS-adaptive subtr.	$\mathbf{10.3\pm 4.1}$	0.20	3.84	4.22	$0.84\pm 0.03$
DNN-AWM b	band-sweep	$58.9\pm 3.6$	1.00	3.34	3.36	$0.62\pm 0.04$

Table 2: Probe-matched removals. Lower bit-acc

=

payload removed (chance

\approx 50\%

); det

=

detection flag there. Means

\pm 95\%

CI,

N{=}100

clips (

89

for audiowmark ;

84

for its fragility). PESQ is speech content only (

N{=}60

); audio-mode ViSQOL covers all five content types.

Figure 3: Threshold-free fragility (( 5 )): the area above the accuracy–quality frontier, traced by sweeping the matched attack (

\alpha\in\{1,\dots,16\}

). Per-content curves for SilentCipher (fragile, orange dashed) and VoiceMark (robust, blue solid); cf. the content-averaged

0.84

0.28

in Table 2 . A fragile mark’s accuracy collapses while quality is still high; a robust mark’s persists until the audio is destroyed.

Explore similar work

Sep 24, 2026

The Vulnerability of Neural Audio Watermarks under Speech Enhancement

Neural audio watermarks are increasingly deployed in commercial speech generation systems to make AI-generated speech traceable, yet their robustness has been studied mainly under conventional signal distortions. Since a watermark can be regarded as imperceptible noise added to the speech signal, a natural question is whether speech enhancement (SE), as a denoising model, can remove it. In this paper, we cascade Gaussian noise with SE models as a black-box watermark removal attack, covering both discriminative and generative SE paradigms, against six neural watermarks: AudioSeal, WavMark, SilentCipher, Timbre, Perth, and AlignMark. Experimental results show that the proposed attack significantly outperforms existing neural re-synthesis methods in watermark removal. In particular, we find that generative SE, which reconstructs the harmonic regions of speech while denoising, is highly destructive to watermarks. These findings show that SE poses a serious threat to current audio watermarking methods, and we call for SE-aware robustness evaluation in watermark design.

Xincong Zhong, Shengyao Wang, Lingfeng Yao +4

Waseda University, Japan · University of Houston, USA

Watermark Removal Audio Watermarking Robust Watermarking

Ask PDF

May 28, 2026

Audio Pirates: Black-box Audio Watermark Removal via Diffusion Priors

With the rise of AI-generated audio, watermarking has become widely used for detecting misuse and protecting intellectual property. However, adversaries may try to remove these watermarks, making it critical to evaluate how well watermarking schemes withstand removal attacks. Existing attacks are often impractical: they either noticeably degrade perceptual quality or require access to the watermarking scheme. We propose DiffErase, a black-box watermark removal attack that assumes no knowledge of the target watermarking scheme while maintaining perceptual quality. DiffErase perturbs watermarked audio to an intermediate diffusion noise level and regenerates it using a pretrained denoising model, effectively suppressing watermark signals. Theoretical analysis and extensive experiments demonstrate that inaudible audio watermarks are highly vulnerable: across multiple audio domains, DiffErase consistently removes watermarks while preserving perceptual quality. These findings highlight the need for future audio watermarking designs to consider diffusion-based threats. Code and demos are available at https://differase.github.io/DiffErase/.

Lingfeng Yao, Xincong Zhong, Chenpei Huang +6

University of Houston · Waseda University · UC Berkeley +3

Watermark Removal Audio Watermarking Robust Watermarking Black-Box Adversarial Attacks

Ask PDF

Sep 24, 2026

No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers

Modern neural audio watermarking systems typically embed a message repeatedly across time and then collapse the resulting temporal evidence into a single payload using averaging, voting, or another fixed aggregation rule. We argue that this temporal collapse limits both robustness and the recovery of multiple payloads, and that the limitation can be addressed without retraining the underlying watermarker. We freeze a pretrained watermarker's encoder and detector and train only a low-latency Conformer-based decoder. The decoder consumes the detector's temporal soft outputs, which a system-specific adapter pools into a sequence of window-level representations, and predicts the embedded message. On three frozen watermarkers (AURA, AudioSeal, and WavMark), the learned decoder improves recovery of attacked messages and yields higher detection AUROC point estimates on all three. Under controlled full- and partial-coverage multiplexing, it improves joint-exact recovery of two alternating payload words by 9.7-48.0, 6.9-17.3, and 8.2-14.2 percentage points, respectively, under one to three chained attacks on feasible clips.

Xuanye Wang, Linxi Li, Yechen Wang +3

OfSpectrum, Inc., Los Angeles, CA, USA · University of Warwick, Coventry, United Kingdom

Audio Watermarking Robust Watermarking

Ask PDF