Backward Compatibility in Zero-Bit Neural Audio Watermarking

Admir Krnić; Kosta Pavlović; Petar Nedić; Željko Bolević; Slavko Kovačević; Igor Djurović

cs.SDOct 15, 2026

Backward Compatibility in Zero-Bit Neural Audio Watermarking

Authors: Admir Krnić, Kosta Pavlović, Petar Nedić, Željko Bolević, Slavko Kovačević, Igor Djurović

Organizations: DeepMark

Abstract

Neural watermarking systems are typically trained as tightly coupled embedder-detector pairs and implicitly assume static deployment. In real-world deployments, embedders and detectors are frequently updated and selectively decoupled for security and versioning purposes, which can break detection in previously embedded content and, more critically, increase false-positive rates on embedders that a given detector is intentionally not intended to recognize. In this paper the concept of backward compatibility in zero-bit audio watermarking is formalized. A training framework is proposed that pairs a new detector with a sequence of frozen legacy embedders (its legacy chain), using a performance-weighted sampling strategy so that the detector retains accuracy across all earlier versions. This coupling, while necessary for backward compatibility, is shown to induce an embedder-collapse effect that catastrophically degrades the true negative rate (TNR) against out-of-chain embedders. To counteract this, a Angular Diversity Loss (ADL) is introduced that explicitly forces each new embedder to occupy a distinct region of the output space. The combined approach restores near-perfect TNR with no measurable cost to detection accuracy or perceptual audio quality.

Figures & tables

Version	Embedder	Detector
$v_{1}$	DenseNet: 1 block, ReLU	ResNet: 1 stack, ReLU
$v_{2}$	DenseNet: 1 block, Swish	ResNet: 1 stack, Swish
$v_{3}$	DenseNet: 1 block, GELU	ResNet: 1 stack, GELU
$v_{4}$	DenseNet: 2 blocks, GELU	ResNet: 2 stacks, GELU
$v_{5}$	ViTMAE: 1 enc, 2 dec, ReLU	AST: 4 layers, ReLU
$v_{6}$	ViTMAE: 1 enc, 2 dec, Swish	AST: 4 layers, Swish

Table 1: Model configurations per version.

Figure 1: Accuracy matrix for the base setup (no diversity loss). Rows index embedder versions, columns index detector versions. The main diagonal and entries above it show TPR entries below show TNR. In-chain TPR is near-perfect, but the lower triangle collapses: the detector accepts almost all out-of-chain watermarks as its own.

$\bar{c}_{M,N}$	$n$	TNR (%)
$[0.45,0.55)$	3	98.9
$[0.55,0.65)$	1	2.7
$[0.65,0.75)$	15	0.9
$[0.75,0.85)$	9	0.4

Table 2: Out-of-chain TNR grouped by mean residual similarity

\bar{c}_{M,N}

Figure 2: Accuracy matrix for the full method (with the ADL). Same layout as Fig. 1 . In-chain TPR is unchanged, while the lower triangle recovers to near-perfect TNR.

Revoked	No div.	Div., $E_{i}$ unused	Div., $E_{i}$ pushed
$v_{3}$ (conv.)	0.7	24.3	100.0
$v_{5}$ (transf.)	0.0	95.9	100.0

Table 3: Revocation: TNR (%) against the revoked embedder.

	Baseline						Ours
	TPR (%)			TNR (%)			TPR (%)			TNR (%)
Attack	min	max	avg	min	max	avg	min	max	avg	min	max	avg
Additive Noise	25.0	69.5	52.7	26.3	100.0	49.5	16.8	76.3	44.3	100.0	100.0	100.0
Bandstop	66.2	66.2	66.2	33.7	100.0	41.0	65.5	66.2	66.1	99.3	100.0	99.9
Crop Beginning	99.3	100.0	99.7	0.0	100.0	11.6	98.6	100.0	99.7	99.3	100.0	99.9
Crop Random	98.6	100.0	99.7	0.0	100.0	11.7	98.6	100.0	99.8	100.0	100.0	100.0

Table 4: Per-attack TPR (%) and TNR (%) at

\tau=0.99

Audio Watermarking

Audio watermarking embeds detectable signals or representations in audio to establish provenance, attribute generated content, and reveal tampering.

See all 30 papers

No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers
Sep 24, 2026Xuanye Wang, Linxi Li, Yechen Wang +3Audio Watermarking Robust Watermarking
OfSpectrum, Inc., Los Angeles, CA, USA · University of Warwick, Coventry, United Kingdom
How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks
Aug 17, 2026Likhith KumaraWatermark Removal Audio Watermarking
Indian Institute of Technology Madras, Chennai, India
Latent-Mark: An Audio Watermark Robust to Neural Codec Compression
Mar 5, 2026Yen-Shan Chen, Shih-Yu Lai, Ying-Jung Tsou +5Audio Watermarking Robust Watermarking
National Taiwan University, Taiwan · RIKEN Center for Computational Science (RIKEN-CCS), Japan · MoonShine Animation Studio, Taiwan +1

Sep 24, 2026J/K move · Enter open · S save

No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers

Xuanye Wang, Linxi Li, Yechen Wang, Liwei Jin+2

OfSpectrum, Inc., Los Angeles, CA, USA · University of Warwick, Coventry, United Kingdom

Audio Watermarking Robust Watermarking

Open paper AskPDF arXiv

Modern neural audio watermarking systems typically embed a message repeatedly across time and then collapse the resulting temporal evidence into a single payload using averaging, voting, or another fixed aggregation rule. We argue that this temporal collapse limits both robustness and the recovery of multiple payloads, and that the limitation can be addressed without retraining the underlying watermarker. We freeze a pretrained watermarker's encoder and detector and train only a low-latency Conformer-based decoder. The decoder consumes the detector's temporal soft outputs, which a system-specific adapter pools into a sequence of window-level representations, and predicts the embedded message. On three frozen watermarkers (AURA, AudioSeal, and WavMark), the learned decoder improves recovery of attacked messages and yields higher detection AUROC point estimates on all three. Under controlled full- and partial-coverage multiplexing, it improves joint-exact recovery of two alternating payload words by 9.7-48.0, 6.9-17.3, and 8.2-14.2 percentage points, respectively, under one to three chained attacks on feasible clips.

Abstract

Audio Watermarking

Explore similar work

No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers

How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

Latent-Mark: An Audio Watermark Robust to Neural Codec Compression