ScrambleMark: Zero-Query Watermark-Agnostic Black-Box Evasion of Modern Speech Watermarking

Binhao Ma; Weikang Ding; Hanqing Guo; Wenwei Zhao; Xiaowen Li; Leah Ding; Zhuo Lu; Rui Duan

cs.CRNov 3, 2026

ScrambleMark: Zero-Query Watermark-Agnostic Black-Box Evasion of Modern Speech Watermarking

Authors: Binhao Ma, Weikang Ding, Hanqing Guo, Wenwei Zhao, Xiaowen Li, Leah Ding, Zhuo Lu, Rui Duan

Organizations: University of Missouri–Kansas City · Indiana University Bloomington · University of South Florida · American University

Abstract

Speech watermarking is becoming a key defense for digital copyright and content authentication. Existing attacks treat evasion as a removal problem: they erase the watermark, relying on detector access or on speech data that is hard to collect, such as paired clean-watermarked or clean target speaker speech. Commercial platforms are moving to close off these assumptions. TrustedAudio, for instance, restricts detection to authenticated users and denies meaningful detection feedback to unauthorized parties. Adversaries thus cannot tell whether a sample is watermarked or which watermark it carries, nor reliably remove it without degrading speech quality. In this work, we show that evading a speech watermark does not require erasing it: detection relies on the structural consistency of the embedded pattern, and disrupting this consistency is enough to defeat it. Building on this observation, we identify harmonic structure as an effective attack surface, as perturbing it breaks watermark consistency while preserving perceptual quality. We therefore propose ScrambleMark, a zero-query, watermark-agnostic, black-box attack that evades detection through harmonic scrambling. ScrambleMark combines a deterministic engine for discovering transferable harmonic perturbations with a generative model that learns randomized scrambling patterns, avoiding reliance on fixed attack rules. Across three commercial platforms (Google SynthID, Resemble AI, and TrustedAudio), ScrambleMark is the only attack to both evade detection and keep speech natural, achieving nearly 97% evasion and a 4.2/5 human rating, far above the 1.1 to 1.7 of prior attacks. Beyond evasion, ScrambleMark withstands adaptive recovery designed to reverse it, evidence that structural evasion is hard to mitigate in practice.

Figures & tables

Fig. 1 : Overview of the watermarking pipeline.

Method	System Access		Data Dependencies		Evasion Scope
Method	WM Pipeline	Query	Paired Data	Target Data	Academic	Commercial
White-box Noise [ 14 ]	✓	✓	✗	✗	✓	✗
Black-box Noise [ 14 ]	✗	✓	✗	✗	✓	✗
Overwrite (query) [ 16 ]	✗	✓	✗	✗	✓	✗
Overwrite NQ [ 16 ]	✗	✗	✗	✗	✓	✗
SE Attack [ 15 ]	✗	✗	✓	✓	✓	✗

TABLE I : Adversary’s knowledge and evasion scope.

Fig. 2 : Comparison of watermark patterns under different attack strategies. The Timbre watermark [ 4 ] is used as the target, while AudioSeal [ 5 ] serves as a surrogate watermarking model to which noise-based [ 14 ] , overwrite [ 16 ] , and SE [ 15 ] attacks are applied. (a) Timbre watermark and (b) AudioSeal pattern under the same all-ones message; (c)–(f) patterns after existing attacks; (g)–(h) Simple scrambling: (g) 0–4 kHz shifted down by 753 Hz; (h) above 4 kHz shifted down by 753 Hz.

Method	Perturbation Strengths
Method	Level 1	Level 2	Level 3	Level 4	Level 5
Median Filtering (samples)	5	15	25	35	45
Quantization (bps)	9	8	7	5	3
Gaussian Noise (dB)	25	20	15	10	-10
Downsampling (HZ)	16000	14000	6000	4000	2500
Background Noise (dB)	25	20	15	10	-10

TABLE II : Parameters for each perturbation method.

Fig. 4 : EQTR across feature-level perturbations.

Fig. 5 : Harmonic partition-shift operation.

Fig. 6 : Feature-variation distributions on seen vs. unseen data. Over 500 original clips, we measure variations in loudness (Root Mean Square difference [ 58 ] ), pitch ( $F_{0}$ difference [ 59 ] ), timbre (Mel-Cepstral Distortion [ 60 ] ), and rhythm (Energy-Envelope Dissimilarity [ 61 ] ), all normalized to $[0,1]$ (lower indicates less variation). Details are provided in Appendix A .

Metric	AudioSeal		WavMark		SilentCipher		Average
Metric	VoxCeleb1	VOiCES	VoxCeleb1	VOiCES	VoxCeleb1	VOiCES	Average
ASR	0.98	1.00	1.00	0.99	0.97	0.98	0.99
STOI	0.91	0.92	0.90	0.90	0.91	0.90	0.91

TABLE III : Evasion Effectiveness and Quality Results.

Fig. 7 : ScrambleMark: dataset generation and training.

Method	AudioSeal		WavMark		AudioMarkNet		SilentCipher		Collaborative		RobustDNN		$\text{Timbre}^{*}$		Average
Method	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )
White-Box-PGD [ 14 ]	0.00	1.00	0.00	1.00	0.15	1.00	0.00	1.00	0.02	1.00	0.00	1.00	0.00	1.00	0.02	1.00
White-Box-I-FGSM [ 14 ]	0.00	1.00	0.00	1.00	0.13	1.00	0.00	1.00	0.01	1.00	0.00	1.00	0.00	1.00	0.02	1.00
Black-Box-HSJA [ 14 ]	0.55	0.85	1.00	0.83	0.46	0.83	1.00	0.86	1.00	0.84	0.03	0.87	0.56	0.81	0.66	0.84
Black-Box-S-HSJA [ 14 ]	0.82	0.84	1.00	0.85	0.58	0.81	1.00	0.84	1.00	0.84	0.03	0.86	0.20	0.83	0.66	0.84
Overwriting Attack [ 16 ]	0.00	0.98	0.03	0.97	0.14	0.99	0.27	0.98	0.37	0.98	0.02	0.97	0.00	0.98	0.12	0.98

TABLE IV : ScrambleMark compared with existing attacks on academic watermarking schemes.

Fig. 8 : Transferability and fidelity across surrogates.

Method	SynthID		Resemble AI		TrustedAudio		Average
Method	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )
White-Box-PGD [ 14 ]	0.00	1.00	0.00	1.00	0.15	1.00	0.05	1.00
White-Box-I-FGSM [ 14 ]	0.00	1.00	0.00	1.00	0.13	1.00	0.04	1.00
Black-Box-HSJA [ 14 ]	0.79	0.87	1.00	0.83	1.00	0.77	0.93	0.82
Black-Box-S-HSJA [ 14 ]	0.38	0.83	1.00	0.85	1.00	0.79	0.79	0.82
SE Attack [ 15 ]	0.00	1.00	0.00	0.99	0.00	0.99	0.00	0.99

TABLE V : Commercial platforms: ASR & objective quality

Surrogate Model	SynthID		Resemble AI		TrustedAudio		Average
Surrogate Model	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )	ASR( $\uparrow$ )	STOI( $\uparrow$ )
AudioSeal	0.86	0.92	0.98	0.90	1.00	0.90	0.95	0.91
WavMark	0.83	0.92	0.93	0.91	1.00	0.91	0.92	0.91
AudioMarkNet	0.86	0.89	0.93	0.90	1.00	0.90	0.93	0.90
SilentCipher	0.83	0.92	0.90	0.89	1.00	0.89	0.91	0.90
Collaborative	0.86	0.90	0.98	0.91	1.00	0.90	0.95	0.90

TABLE VI : Cross-Surrogate Transferability and Quality.

Method	SynthID		Resemble AI		TrustedAudio		Average
Method	ASR $\uparrow$	MOS $\uparrow$	ASR $\uparrow$	MOS $\uparrow$	ASR $\uparrow$	MOS $\uparrow$	ASR $\uparrow$	MOS $\uparrow$
Black-Box-HSJA [ 14 ]	29/30	1.16	30/30	1.08	30/30	1.14	98.9%	1.13
DiffErase-L [ 17 ]	25/30	1.52	30/30	1.35	30/30	2.29	94.4%	1.72
DiffErase-M [ 17 ]	28/30	1.27	30/30	1.32	30/30	2.08	97.8%	1.56
ScrambleMark (Ours)	27/30	3.95	30/30	4.36	30/30	4.20	96.7%	4.17

TABLE VII : Commercial platforms: ASR & human ratings.

Fig. 9 : Attack robustness under recovery.

Fig. 10 : Perceptual feature variation across fine-tuning steps, and harmonic features before and after fine-tuning.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Metric	Timbre	AudioSeal	WavMark	AudioMarkNet	SilentCipher	Collaborative	RobustDNN
Threshold $\kappa$	0.90	0.50	0.50	0.99	0.50	0.50	0.99
FPR	0.00	0.00	0.00	0.00	0.00	0.02	0.00
FNR	0.00	0.00	0.00	0.00	0.03	0.00	0.06

Appendix

TABLE VIII : Detection threshold

\kappa

for different watermarks.

Objective	Type	AudioS.	WavM.	AudioM.	Silent.	Colla.	Robust.
Percp. Recovery	clean	0.00	0.00	0.00	0.00	0.00	0.00
Percp. Recovery	untarget	0.00	0.00	0.00	0.00	-	0.00
Bit Recovery	clean	0.00	0.00	0.00	0.00	0.00	1.00
Bit Recovery	untarget	0.00	0.00	0.00	0.00	-	1.00

Appendix

TABLE IX : FPR across recovery objectives.

Metric	Statistic	AudioSeal	WavMark	AudioMark.	SilentC.	Collab.	Robust.	Timbre*	SynthID	Resemble	TrustedA.
ASR	Mean	1.00	1.00	0.98	1.00	0.94	0.87	1.00	0.90	0.98	1.00
ASR	Variance	0.0000	0.0000	0.0002	0.0000	0.0005	0.0005	0.0000	0.0007	0.0003	0.0000
STOI	Mean	0.90	0.91	0.89	0.91	0.90	0.89	0.92	0.91	0.90	0.90
STOI	Variance	0.0001	0.0002	0.0002	0.0003	0.0002	0.0003	0.0003	0.0002	0.0002	0.0003

Appendix

TABLE X : ASR and STOI statistics over 15 runs.

FPR	AudioSeal		AudioMarkNet		SilentCipher		Collaborative		RobustDNN		Timbre*		Avg.
FPR	$\boldsymbol{\kappa}$	ASR	$\boldsymbol{\kappa}$	ASR	$\boldsymbol{\kappa}$	ASR	$\boldsymbol{\kappa}$	ASR	$\boldsymbol{\kappa}$	ASR	$\boldsymbol{\kappa}$	ASR	ASR
Baseline	0.500	1.00	0.990	1.00	0.500	1.00	0.500	0.96	0.990	0.86	0.900	1.00	0.97
1-2%	0.100	1.00	0.688	0.97	0.475	0.97	0.500	0.96	0.984	0.86	0.700	0.99	0.96
2-5%	0.050	0.98	0.625	0.95	0.450	0.94	0.107	0.95	0.977	0.84	0.600	0.95	0.94
5-8%	0.020	0.92	0.563	0.91	0.425	0.93	0.004	0.91	0.965	0.82	0.500	0.93	0.90
8-15%	0.010	0.92	0.500	0.90	0.400	0.92	0.001	0.91	0.953	0.80	0.400	0.92	0.90

Appendix

TABLE XI : Threshold sensitivity across FPR levels.

Target	Evasion–quality Trade-off Weight								Diffusion Schedule Steps								Candidate-Count								Initial-Band-Count
	0.25		0.5		1		2		30		40		50		70		1		3		5		10		1		50		100		200
	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI	ASR	STOI
AudioSeal	1.00	0.81	1.00	0.85	1.00	0.91	0.93	0.93	0.96	0.86	0.98	0.88	1.00	0.91	1.00	0.90	0.91	0.80	0.93	0.82	0.97	0.85	1.00	0.91	1.00	0.91	0.99	0.91	1.00	0.89	1.00	0.89
AudioMarkNet	1.00	0.80	0.98	0.83	0.98	0.88	0.90	0.94	0.95	0.86	0.97	0.87	0.98	0.89	0.98	0.90	0.85	0.81	0.89	0.83	0.94	0.83	0.98	0.88	0.98	0.90	0.95	0.90	0.98	0.92	0.98	0.91
SilentCipher	1.00	0.81	1.00	0.86	1.00	0.92	0.91	0.94	0.97	0.87	0.99	0.89	1.00	0.92	1.00	0.91	0.92	0.80	0.93	0.81	0.97	0.86	1.00	0.92	0.99	0.92	0.97	0.91	0.97	0.92	1.00	0.90
Collaborative	1.00	0.82	0.96	0.85	0.96	0.90	0.92	0.93	0.90	0.86	0.93	0.86	0.96	0.90	0.97	0.91	0.88	0.83	0.90	0.83	0.92	0.87	0.96	0.90	0.97	0.91	0.96	0.89	0.97	0.92	0.98	0.91

Appendix

TABLE XII : Sensitivity analysis of ScrambleMark parameters.

Setting	Order (first $\rightarrow$ last)	10	9	8	7	4	5	3	Avg.
Baseline	–	1.000	1.000	1.000	1.000	1.000	1.000	1.000	1.000
RF-I	1-2-4-3-5-7-6-10-8-9	0.735	1.000	0.958	0.727	0.994	0.959	0.991	0.909
RF-II	1-2-5-4-3-6-7-9-10-8	0.952	1.000	1.000	0.807	0.995	0.931	0.995	0.954
RF-III	1-2-3-5-4-7-6-9-8-10	1.000	1.000	0.961	0.752	0.997	0.946	0.990	0.949
WF-I	1-2-9-10-8-6-7-5-4-3	0.411	0.450	0.603	0.709	0.997	0.977	1.000	0.735
WF-II	1-2-8-9-10-7-6-4-3-5	0.479	0.495	0.579	0.704	0.995	1.000	0.993	0.749

Appendix

TABLE XIII : Matching scores across embedding orders.

Setting	Metric	AudioSeal	WavMark	AudioMark.	SilentC.	Collab.	Robust.	Timbre	SynthID	Resemble	TrustedA.
RF	SW-ASR	1.00	1.00	1.00	1.00	1.00	0.91	1.00	0.93	1.00	1.00
WF	SW-ASR	1.00	1.00	0.99	1.00	1.00	0.96	1.00	0.96	1.00	1.00
Random	SW-ASR	1.00	1.00	1.00	1.00	1.00	0.95	1.00	0.95	1.00	1.00
Overall Multi-Watermark Performance
RF				WF				Random
AW-ASR		STOI		AW-ASR		STOI		AW-ASR		STOI

Appendix

TABLE XIV : ScrambleMark against multiple watermarks.

Lang.	B-HSJA			DiffErase-L			DiffErase-M			ScrambleMark
Lang.	STOI	SPR	WER	STOI	SPR	WER	STOI	SPR	WER	STOI	SPR	WER
English	0.81	0.88	11.74%	0.75	0.83	25.19%	0.73	0.80	23.61%	0.91	0.98	0.31%
Chinese	0.83	0.85	13.96%	0.72	0.83	19.90%	0.74	0.79	21.38%	0.92	0.96	0.72%
Korean	0.82	0.85	26.81%	0.71	0.81	27.63%	0.70	0.76	23.27%	0.91	0.99	0.53%
French	0.85	0.87	14.36%	0.72	0.83	23.04%	0.71	0.79	19.91%	0.93	0.97	0.49%
German	0.84	0.82	18.62%	0.70	0.85	20.01%	0.73	0.80	24.55%	0.92	1.00	1.05%

Appendix

TABLE XV : Speech utility on unwatermarked audio.

Audio Watermarking

Audio watermarking embeds detectable signals or representations in audio to establish provenance, attribute generated content, and reveal tampering.

See all 32 papers

Learning to Evade: Adaptive Attacks on Audio Watermarking
Jun 21, 2026Weikang Ding, Hanqing Guo, Rui Duan +4Watermark Removal Audio Watermarking
University of Missouri-Kansas City, USA · University of Hawaii at Manoa, USA · University of South Florida, USA +2
How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks
Aug 17, 2026Likhith KumaraWatermark Removal Audio Watermarking
Indian Institute of Technology Madras, Chennai, India
SSTMark: Robust Training-Free Semantic-Level Speech Watermarking
Jul 20, 2026Kuan-Lin Chu, Jun-Cheng Chen, Chun-Shien LuAudio Watermarking Robust Watermarking
CITI, Academia Sinica · Taiwan, ROC · IIS, Academia Sinica

Jun 21, 2026J/K move · Enter open · S save

Learning to Evade: Adaptive Attacks on Audio Watermarking

Weikang Ding, Hanqing Guo, Rui Duan, Guangjing Wang+3

University of Missouri-Kansas City, USA · University of Hawaii at Manoa, USA · University of South Florida, USA+2

Watermark Removal Audio Watermarking Adversarial Attacks Robust Watermarking Consistent Adversarial Attacks

Open paper AskPDF arXiv

Advances in generative audio have intensified copyright concerns, making audio watermarking increasingly important for asserting ownership. However, existing audio watermarking methods are vulnerable to adversarial attacks. We find that watermark decoder message probabilities follow normal distributions, a property exploited by defenses to detect manipulations. This paper introduces an adaptive audio watermark attack method (AWM) designed to bypass existing defense strategies. AWM uses a two-stage optimization: the first stage ensures attack success, while the second improves audio quality. To evade detection, it estimates normal distribution parameters from limited samples of the target audio, and then adaptively steers decoded probabilities back into the estimated range. Evaluated on two watermarking methods across three voice datasets, AWM achieves high success while bypassing state-of-the-art detectors: detection rates are below 10% for replacement and creation, and 0% for removal.

Abstract

Audio Watermarking

Explore similar work

Learning to Evade: Adaptive Attacks on Audio Watermarking

How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks

SSTMark: Robust Training-Free Semantic-Level Speech Watermarking