On the Robustness of Audio Deepfake Detection under Audio Watermarking

Zi Qian Yong; Ajinkya Kulkarni; Julia Lau; Hwa Hui Tew; Shu Min Leong; Raphael Phan; Sébastien Marcel

cs.SDAug 25, 2026

On the Robustness of Audio Deepfake Detection under Audio Watermarking

Authors: Zi Qian Yong, Ajinkya Kulkarni, Julia Lau, Hwa Hui Tew, Shu Min Leong, Raphael Phan, Sébastien Marcel

Organizations: School of Information Technology, Monash University, Malaysia campus · Idiap Research Institute, Switzerland

Abstract

Recent advances in generative audio models have enabled highly realistic synthetic speech, increasing the importance of reliable audio deepfake detection (ADD) systems. While prior studies have primarily focused on adversarially optimized perturbations, the robustness of ADD systems under realistic signal transformations remains insufficiently understood. In this work, we investigate the impact of audio watermarking on ADD systems by treating watermarking as a structured, non-adversarial perturbation rather than a conventional attack mechanism. Using a watermark-based evaluation framework built upon WavMark, we evaluate multiple self-supervised learning (SSL), Convolutional Neural Network (CNN) and Graph Neural Netrowk (GNN)-based ADD models across several benchmark datasets. Beyond conventional detection metrics, we further analyze watermark-induced representation shifts using Fréchet Distance, cosine similarity, and L2 distance in the embedding space. Experimental results reveal a strong dataset-dependent behavior: watermarking causes substantial performance degradation on ASVspoof 2021 LA and DF, while exhibiting limited impact on ASVspoof 2024, FoR, and ITW. Moreover, large embedding-space shifts are strongly associated with severe detection degradation, suggesting that watermark-induced perturbations can substantially alter the feature representations relied upon by current ADD systems. These findings demonstrate that benign signal transformations designed for content protection can expose previously overlooked robustness vulnerabilities in audio deepfake detection systems. Our code is available at https://github.com/ziqian0925/wm-ADD-robustness.git

Figures & tables

Fig. 1 : Overview of normal ADD inference and the proposed watermark-based perturbation framework.

ADD Models	ASVspoof 2021 LA		ASVspoof 2021 DF		ASVspoof 2024		FoR		ITW
ADD Models	No WM	Proposed WM	No WM	Proposed WM	No WM	Proposed WM	No WM	Proposed WM	No WM	Proposed WM
XLSR+SLS	2.86	29.33	1.91	33.90	18.76	18.79	5.07	6.38	7.45	8.11
TCM	2.99	29.83	2.14	34.22	18.85	19.06	10.68	11.20	7.80	7.88
Nes2Net	2.17	29.70	1.49	34.06	22.05	21.67	6.31	7.01	7.75	8.55
AASIST	11.46	30.83	21.07	35.05	35.53	35.59	21.64	22.96	43.00	43.86
RawGAT-ST	10.25	29.77	23.26	36.50	40.29	40.41	53.09	53.19	52.53	53.79

TABLE I : EER (%) of ADD Systems on Original (No WM) and Watermarked (WM) Audio Across Different Datasets

	Metrics	ASVspoof						FoR		ITW
		2021 LA		2021 DF		2024
		Spoof	Bonafide	Spoof	Bonafide	Spoof	Bonafide	Spoof	Bonafide	Spoof	Bonafide
XLSR+SLS	Fréchet Distance	419.10	37.52	498.55	12.25	2.76	1.92	55.85	160.65	81.73	271.14
	Mean Cosine Distance	0.30	0.06	0.30	0.04	0.01	0.01	0.14	0.13	0.22	0.20
	Mean L2 Distance	22.09	10.55	23.84	9.10	4.77	4.13	18.25	17.94	21.63	21.40
TCM	Fréchet Distance	103.90	9.63	91.25	2.78	1.55	0.48	7.85	19.35	3.70	0.67

TABLE II : Representation-Level Embedding Shifts Under Watermark Perturbation

Panel of Figure 4 — Fig. 2 : t-SNE visualization of embedding distributions before (blue) and after (orange) watermark perturbation on the ASVspoof 2021 LA dataset. Larger distribution shifts between the embeddings suggest that watermarking alters the learned feature space and affects ADD decision boundaries.

Explore similar work

Oct 12, 2026

Adaptive Compression and Targeted Perturbation: A Unified Framework for Generalized Audio Deepfake Detection

Existing audio deepfake detection (ADD) methods frequently exhibit limited generalization, as fixed bottleneck architectures fail to adapt to the heterogeneous information densities inherent in diverse spoofing artifacts. Moreover, standard augmentation often leads to a pathological robustness-accuracy trade-off. In this paper, we propose a unified ADD framework to address these challenges. Our approach integrates: (1) an Adaptive Audio Feature Integration (AAFI) module that dynamically selects optimal latent dimensions via a compression pool and a stochastic exploration mechanism, ensuring flexible representations across multiple types of dynamic attacks; and (2) a Mel-Band Adversarial Perturbation (Mel-BAP) strategy that applies targeted regularization in the mel-spectrogram domain to encourage the model to learn invariant decision boundaries. Extensive evaluations on benchmarks including ADD 2022, FakeOrReal, and In-the-Wild demonstrate that our model based on Whisper-small achieves a state-of-the-art average Equal Error Rate (EER) of 1.51%. Compared to existing SOTA models such as the 3-billion-parameter Resemble-Detect-3B-Omni, our framework reduces the parameter count by up to 91.6% while achieving a 60.7% improvement in average EER. In a separate cross-lingual evaluation, the Whisper-base configuration achieves EERs of 3.91-5.65% on five unseen languages. The framework also maintains strong resilience to real-world acoustic distortions. This work provides a scalable and efficient "plug-in" solution for enhancing trust and security in the audio Web ecosystem.

Jianqiao Cui, Haoxian Zhu, Hanbiao Meng +1

Imperial College London, London, UK · Taiyuan University of Technology, Taiyuan, China

Audio Deepfake Detection Cross-Domain Generalization Adversarial Training Audio Representation Learning

Ask PDF

Aug 24, 2026

AT-ADD: A Benchmark and Challenge for Robust and All-Type Audio Deepfake Detection

Recent audio generation models can synthesize high-fidelity speech, environmental sound, singing voice, and music, creating new risks for multimedia trust. Existing audio deepfake detection (ADD) benchmarks remain predominantly speech-centric and often underrepresent realistic channel variation and diverse audio types. This paper presents AT-ADD, a large-scale benchmark and challenge designed to evaluate both robust speech deepfake detection and all-type audio deepfake detection. Track 1 evaluates binary speech detection under unseen generators, diverse recording conditions, signal perturbations, and replay effects. Track 2 evaluates type-agnostic real/fake detection over speech, sound, singing, and music when the audio type is unknown at test time. We detail the dataset construction, evaluation protocol, and reproducible baselines, and analyze the final systems submitted to the ACM Multimedia 2026 Grand Challenge. The strongest official baseline obtains 76.73% and 79.47% Macro-F1 on the Track 1 and Track 2 evaluation sets, respectively, whereas the winning challenge systems reach 90.71% and 96.10%. Beyond aggregate rankings, sample-level analysis of the top five submissions examines generator- and type-level difficulty, cross-system error complementarity, and ranking stability. The results show that large-scale self-supervised representations, condition-aware augmentation, multi-crop inference, and structured fusion or routing are central to generalization, while generator-specific robustness and consistent performance across diverse audio types remain unresolved.

Yuankun Xie, Haonan Cheng, Jiayi Zhou +11

Communication University of China, Beijing, China · Ant Group · Machine Intelligence, Ant Group, Shanghai, China +3

Audio Deepfake Detection

Ask PDF

Sep 17, 2026

Robust Workflow Generation via Adversarial Learning for Audio Deepfake Detection

The rapid advancement of speech synthesis and voice conversion technologies has made audio deepfakes increasingly realistic, posing serious security risks in practical applications. While existing detection methods achieve strong performance under controlled conditions, they often fail to generalize under real-world perturbations and corruptions. In this paper, we propose ROGUE, a framework that dynamically constructs robust detection workflows by orchestrating multiple detection tools. ROGUE formulates workflow generation as a sequential decision-making problem and introduces a dual-agent paradigm, where a perturbation agent generates audio perturbations and a policy agent learns to select and execute detection tools under perturbed conditions. Through adversarial learning, ROGUE enables perturbation-aware tool selection, adaptive execution strategies, and improved robustness to distribution shifts. Extensive experiments across multiple datasets and real-world corruptions demonstrate that ROGUE consistently outperforms strong baselines in both robustness and generalization. Our results highlight the effectiveness of adversarially optimized workflow generation for building reliable audio deepfake detection systems in real-world deployment settings.

Xiang Li, Pin-Yu Chen, Wenqi Wei

Department of Computer Science and Information, Fordham University, NY, USA · IBM Research, Yorktown Heights, NY, USA

Distribution Shift Robustness Audio Deepfake Detection Adversarial Robustness

Ask PDF