Source-linked AI summary
The Vulnerability of Neural Audio Watermarks under Speech Enhancement
Xincong Zhong, Shengyao Wang, Lingfeng Yao, Yihang Bao, Jinze Yu, Miao Pan, Jiang Liu
TL;DR
Neural audio watermark robustness has been studied mainly under conventional distortions, leaving speech enhancement less examined as a removal threat. This paper tests a black-box Gaussian-noise-plus-enhancement attack across six watermarks and two SE paradigms. Generative SE, particularly language-model-based SE, achieves the strongest overall removal.
Problem
Audio watermark robustness has been measured mainly against conventional signal distortions, while speech enhancement is rarely considered despite being designed to remove noise-like perturbations.
Source: §1 · p. 1Method
The authors add Gaussian noise before pretrained discriminative or generative SE in a strict black-box attack against six neural watermarks.
Source: §1 · p. 1, §2.2 · p. 2, §2.3 · p. 2Results
Language-model-based generative SE achieves the strongest overall watermark removal, with harmonic-region reconstruction identified as especially destructive.
Source: §1 · p. 1, §3.4 · p. 3, §4 · p. 4Takeaways & Limitations
Audio watermark robustness evaluations should address speech enhancement alongside signal-level distortion and neural re-synthesis.
Source: §4 · p. 4The attack assumes access only to one watermarked audio file and no knowledge of the watermark scheme.
Source: §2.3 · p. 2
Abstract
from arXiv · showhide
Neural audio watermarks are increasingly deployed in commercial speech generation systems to make AI-generated speech traceable, yet their robustness has been studied mainly under conventional signal distortions. Since a watermark can be regarded as imperceptible noise added to the speech signal, a natural question is whether speech enhancement (SE), as a denoising model, can remove it. In this paper, we cascade Gaussian noise with SE models as a black-box watermark removal attack, covering both discriminative and generative SE paradigms, against six neural watermarks: AudioSeal, WavMark, SilentCipher, Timbre, Perth, and AlignMark. Experimental results show that the proposed attack significantly outperforms existing neural re-synthesis methods in watermark removal. In particular, we find that generative SE, which reconstructs the harmonic regions of speech while denoising, is highly destructive to watermarks. These findings show that SE poses a serious threat to current audio watermarking methods, and we call for SE-aware robustness evaluation in watermark design.
1. INTRODUCTION
Watermarks can provide provenance for generated speech, but their robustness has been assessed mainly against conventional signal transformations. This paper evaluates speech enhancement as a removal threat and finds generative SE especially destructive.
1. INTRODUCTION
- Watermark robustness has been measured mainly against conventional signal transformations, while speech enhancement is rarely evaluated despite its denoising role.Earlier removal approaches include optimization, overwriting, learned attacks, diffusion reconstruction, and neural re-synthesis.Source: §1 · p. 1
- The paper compares discriminative and generative SE in a strict black-box attack that adds Gaussian noise before enhancement against six neural watermarks.The evaluated watermarks are AudioSeal, WavMark, SilentCipher, Timbre, Perth, and AlignMark.Source: §1 · p. 1
- Language-model-based generative SE achieves the strongest overall watermark removal, and visualizations indicate vulnerability during reconstruction of speech harmonics.The authors identify speech enhancement as a practical vulnerability for current audio watermarking methods.Source: §1 · p. 1
2. METHODS
The methods evaluate six neural watermarks using discriminative and generative speech-enhancement models. The attack adds Gaussian noise to a watermarked file, then applies a pretrained enhancer under a strict black-box setting.
2.1. Audio Watermarking Methods
- The evaluation covers six neural watermarks, including Perth, deployed by default in Chatterbox, and AlignMark, which aligns its signal with speech-content features.AlignMark’s feature alignment lets it carry higher watermark energy to improve robustness against neural re-synthesis attacks.Source: §2.1 · pp. 1–2
2.2. Speech Enhancement Methods
- Discriminative SE learns a deterministic noisy-to-clean mapping, whereas generative SE learns the clean-speech distribution and generates enhanced speech conditioned on noisy input.The study evaluates six SE models across these two paradigms.Source: §2.2 · p. 2
- Demucs operates on waveforms and DF3 predicts a complex mask, while generative models include spectrogram-domain SGMSE and FlowSE and token-based GenSE and UniSE.SGMSE uses reverse diffusion, FlowSE uses flow matching, and GenSE and UniSE predict speech tokens decoded by a neural codec.Source: §2.2 · p. 2
2.3. Attack Pipeline
- The strict black-box attacker has one watermarked audio file, no knowledge of its watermark scheme, and aims to reduce detectability while preserving perceptual quality.The pipeline adds Gaussian noise at a target input SNR of 20 or 10 dB, then applies a pretrained SE model using released weights and specified inference settings.Source: §2.3 · p. 2
3. EVALUATION AND ANALYSIS
The evaluation compares speech-enhancement attacks with neural re-synthesis baselines across six watermarks, then analyzes why generative enhancement can remove them. Generative models are especially effective when they reconstruct watermark-bearing harmonic regions.
3.1. Datasets
- The evaluation uses 200 gender-balanced LibriSpeech utterances longer than five seconds, sampled from a roughly 1,000-hour, 16-kHz corpus.The subset follows.Source: §3.1 · p. 2
3.2. Baselines
- The attack is benchmarked against EnCodec at 24 kbps, BigVGAN v2, and AudioLDM at transfer strength s=0.1.Classical signal-level distortions are omitted because prior studies report robustness to them [5].Source: §3.2 · p. 2
3.3. Evaluation Metrics
- Removal is measured by TPR@1%FPR, with successful removal defined as TPR of 10% or below; speech quality is assessed with UTMOS, ESTOI, and ViSQOL.Detection scores use 200 attacked watermarked and 200 unwatermarked utterances; UTMOS is no-reference, while ESTOI and ViSQOL compare against the original unwatermarked speech.Source: §3.3 · p. 2
3.4. Results
- AudioLDM lowers average TPR to 13.4 but has the highest perceptual cost among the three re-synthesis baselines.Its UTMOS, ESTOI, and ViSQOL are 2.58, 0.749, and 4.131, respectively.Source: §3.4 · p. 2
- Without noise injection, Demucs, DF3, SGMSE, and FlowSE largely preserve watermarks, while GenSE and UniSE almost fully remove all except AlignMark.For AlignMark, TPR remains 28.0% with GenSE and 9.5% with UniSE; discriminative SE and STSE outperform LMSE on perceptual quality.Source: §3.4 · pp. 2–3
- At GN 10 dB, noise alone leaves average UTMOS at 1.47, and Gaussian noise plus discriminative SE cannot fully remove watermarks.Demucs and DF3 slightly restore AudioSeal TPR; at GN 20 dB, their AlignMark TPRs are 73.0 and 99.5, respectively.Source: §3.4 · p. 3
- At GN 10 dB, UniSE reduces AlignMark to 6.5% TPR while keeping the other five watermarks at or below 1.5%.The Table 1 evaluation also reports an average UTMOS of 4.05 and ViSQOL of 3.537 for UniSE at GN 10 dB.Source: §3.4 · p. 3, Table 1 · p. 3
3.5. Vulnerability Analysis and Visualization
- The analysis attributes generative-SE removal to reconstruction of watermark-bearing harmonics and removal of residual energy overlapping Gaussian noise.Discriminative SE preserves continuous harmonic structure, whereas LMSE regularizes harmonic envelopes and blurs formant transitions, altering speaker timbre to some extent; the figure compares residuals and AlignMark outputs under GN 10 dB attacks.Source: §3.5 · p. 4, Figure 1 · p. 4
4. CONCLUSION
The study analyzes a strict black-box attack that cascades Gaussian noise with six speech-enhancement models. Watermarks are removed most effectively when enhancement both denoises and regenerates harmonic regions, motivating robustness evaluation that includes speech enhancement.
- Watermarks are removed most effectively when the enhancement model both denoises and regenerates speech harmonic regions.Source: §4 · p. 4
- The paper systematically analyzes a strict black-box watermark-removal attack cascading Gaussian noise with six speech-enhancement models.Source: §4 · p. 4
- Future audio-watermark robustness evaluation should address speech enhancement alongside signal-level distortion and neural re-synthesis.Source: §4 · p. 4