How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

Likhith Kumara

cs.SDAug 17, 2026

How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

Authors: Likhith Kumara

Organizations: Indian Institute of Technology Madras, Chennai, India

Abstract

Neural audio watermarks are increasingly used to attribute and detect AI-generated speech, so their practical value rests on how cheaply an adversary can remove them. Robustness is usually measured by running a fixed battery of distortions blindly against every scheme. We instead make removal diagnostic: from a few clean/watermarked pairs we compute cheap structural probes that reveal where a watermark sits in the signal (its embedding domain), then apply a single domain-matched attack rather than a blind sweep. We further summarize each scheme with one threshold-free fragility score, the area under its accuracy-versus-quality trade-off, which an accuracy-only benchmark cannot provide. Across ten watermarking schemes the probes separate fragile from robust marks: for magnitude and carrier-domain watermarks a single matched attack erases the payload (WavMark, SilentCipher, audiowmark) or removes the detection flag (AudioSeal) at high objective quality (PESQ >= 3.6), whereas latent-domain marks (VoiceMark, WMCodec, AlignMark, AWARE) resist every training-free attack we apply. The same pair-only probe signatures also identify which watermarking scheme is present (84% over ten schemes).

Figures & tables

Figure 1: Method overview. From a few clean/watermarked pairs (Sec. 3 ) we compute the four structural probes (Sec. 4 ); each probe selects a matched attack class (Sec. 5 ), and the same probe signatures also identify which scheme is present. Sweeping the matched attack traces the accuracy–quality frontier whose area above the curve is the threshold-free fragility score (Sec. 5.1 ).

Figure 2: Structural probe signatures per scheme (pair-only, no attack run; means over $N{=}100$ clips/scheme, bootstrap $95\%$ CI half-widths $\leq 0.07$ ; formulas in Sec. 4 ). The cells with relative higher value is each scheme’s defining probe, which selects its matched attack (Sec. 5 ); the black line splits the fragile group (left) from the robust latent anchors (right), whose uniformly low values predict their resistance. The distinct signatures also identify which scheme is present (Sec. 5 ).

Archetype (defining probe)	Matched attack	Schemes
Narrowband carrier (Concentration)	band-stop	AudioSeal
Frequency-redundant (Coherence)	band-sweep	DNN-AWM
Universal template (Estimability)	template subtraction	audiowmark, WavMark, SilentCipher, AudioSeal payload
Linear in payload bits (Linearity)	estimation subtraction	Timbre

Table 1: Joint probe signature to matched attack. We assign an archetype, then verify by running the attack.

Scheme	matched attack	bit-acc	det	PESQ	ViSQOL	frag a
Removed at near-transparent quality:
audiowmark	template subtr.	$\mathbf{48.4\pm 2.9}$	0.00	4.22	4.62	$0.85\pm 0.03$
WavMark	template subtr.	$\mathbf{5.9\pm 4.6}$	0.06	4.17	4.47	$0.87\pm 0.05$
AudioSeal	band-stop	$60.7\pm 2.8$	0.05	3.62	4.55	$0.80\pm 0.03$
SilentCipher	RMS-adaptive subtr.	$\mathbf{10.3\pm 4.1}$	0.20	3.84	4.22	$0.84\pm 0.03$
DNN-AWM b	band-sweep	$58.9\pm 3.6$	1.00	3.34	3.36	$0.62\pm 0.04$

Table 2: Probe-matched removals. Lower bit-acc

=

payload removed (chance

\approx 50\%

); det

=

detection flag there. Means

\pm 95\%

CI,

N{=}100

clips (

89

for audiowmark ;

84

for its fragility). PESQ is speech content only (

N{=}60

); audio-mode ViSQOL covers all five content types.

Figure 3: Threshold-free fragility (( 5 )): the area above the accuracy–quality frontier, traced by sweeping the matched attack (

\alpha\in\{1,\dots,16\}

). Per-content curves for SilentCipher (fragile, orange dashed) and VoiceMark (robust, blue solid); cf. the content-averaged

0.84

0.28

in Table 2 . A fragile mark’s accuracy collapses while quality is still high; a robust mark’s persists until the audio is destroyed.

Explore similar work

The Vulnerability of Neural Audio Watermarks under Speech Enhancement
Sep 24, 2026Xincong Zhong, Shengyao Wang, Lingfeng Yao +4Watermark Removal Audio Watermarking
Waseda University, Japan · University of Houston, USA
Audio Pirates: Black-box Audio Watermark Removal via Diffusion Priors
May 28, 2026Lingfeng Yao, Xincong Zhong, Chenpei Huang +6Watermark Removal Audio Watermarking
University of Houston · Waseda University · UC Berkeley +3
No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers
Sep 24, 2026Xuanye Wang, Linxi Li, Yechen Wang +3Audio Watermarking Robust Watermarking
OfSpectrum, Inc., Los Angeles, CA, USA · University of Warwick, Coventry, United Kingdom

Sep 24, 2026J/K move · Enter open · S save

The Vulnerability of Neural Audio Watermarks under Speech Enhancement

Xincong Zhong, Shengyao Wang, Lingfeng Yao, Yihang Bao+3

Waseda University, Japan · University of Houston, USA

Watermark Removal Audio Watermarking Robust Watermarking

Open paper AskPDF arXiv

Neural audio watermarks are increasingly deployed in commercial speech generation systems to make AI-generated speech traceable, yet their robustness has been studied mainly under conventional signal distortions. Since a watermark can be regarded as imperceptible noise added to the speech signal, a natural question is whether speech enhancement (SE), as a denoising model, can remove it. In this paper, we cascade Gaussian noise with SE models as a black-box watermark removal attack, covering both discriminative and generative SE paradigms, against six neural watermarks: AudioSeal, WavMark, SilentCipher, Timbre, Perth, and AlignMark. Experimental results show that the proposed attack significantly outperforms existing neural re-synthesis methods in watermark removal. In particular, we find that generative SE, which reconstructs the harmonic regions of speech while denoising, is highly destructive to watermarks. These findings show that SE poses a serious threat to current audio watermarking methods, and we call for SE-aware robustness evaluation in watermark design.

Abstract

Explore similar work

The Vulnerability of Neural Audio Watermarks under Speech Enhancement

Audio Pirates: Black-box Audio Watermark Removal via Diffusion Priors

No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers