PaperlayerView exact revision on arXiv

Source-linked AI summary

Tokens Change, Structure Endures: Spectral Watermarking for Generated Speech

Kanghwi Lee, Kyeongseok Jeong, Jeongmin Liu

arXiv:2609.33774v1cs.SDcs.CLcs.CRcs.LGeess.AS

TL;DR

Speech watermarking faces a durability problem because retokenization can change token identities and weaken token-level signals. Redwing builds its watermark around observed substitutions and optimizes embedding and detection in a basis derived from them. After eight Mimi passes on Moshi, it achieves 80.7% TPR at 1% FPR, compared with 8.3% for KGW and at most 7.3% for WMAR.

  • Problem

    Token-level speech watermarking is weakened when detectors re-encode audio and recover changed token identities, even without an attack.

    Source: §1 · pp. 1–2

  • Method

    Redwing builds a graph from retokenization substitutions and optimizes embedding and detection functions in a Laplacian-derived basis.

    Source: §1 · p. 2

  • Results

    80.7% TPR at 1% FPR after eight Mimi passes on Moshi, versus 8.3% for KGW and at most 7.3% for WMAR.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Retokenization substitutions are structured enough to design around, and Redwing transfers to CosyVoice3 and MOSS-TTS at a speech-quality cost about that of KGW.

    Source: §1 · p. 2, §7 · pp. 9–10

    Short answers and frame misalignment constrain detection: most un-attacked misses and 72 of 116 misses after eight Mimi passes are answers of at most 4 s, while sub-frame shifts, speed changes, and cropping remove most of the watermark.

    Source: §6 · p. 9

Abstract

from arXiv · show

Watermarking is a promising tool for establishing the provenance of AI-generated speech. While many neural audio watermarking methods rely on a separately trained watermark generator, token-level watermarking is a training-free alternative that operates directly during generation. Its main weakness is retokenization: decoding generated speech to a waveform and encoding it again can change token identities and erode the watermark. To make the watermark robust to these changes, we propose Redwing, REtokenization-Durable Watermarking IN Generation. It builds a graph from the token substitutions observed under retokenization, whose Laplacian yields a basis that assigns similar values to tokens likely to substitute for one another. Over this basis, embedding and detection functions are jointly optimized to preserve watermark signal through retokenization while limiting embedding distortion and detector variability on unwatermarked speech. On the Moshi full-duplex system, after eight consecutive passes of Mimi resynthesis, Redwing achieves 80.7% TPR at a calibrated 1% FPR, compared with 8.3% for KGW and at most 7.3% for WMAR. It also has the highest TPR after eight passes through three other neural codecs (77.5-93.0%), and the gains generalize to TTS models at a speech-quality cost close to that of KGW. These results show that retokenization is not merely a source of noise: its transition structure can be exploited as a design principle for robust token-level watermarking.

1 INTRODUCTION

Redwing uses retokenization’s structured token substitutions to make a token-level speech watermark more durable. After eight Mimi passes, it substantially outperforms KGW and WMAR on Moshi, while generalizing to TTS models.

1 INTRODUCTION

  • Speech token watermarks weaken because detectors must retokenize audio, and some token identities change even without an attack.Repeated resynthesis repeats this round trip.Source: §1 · pp. 1–2
  • Redwing builds a graph from observed substitutions and uses its Laplacian eigenvectors as a basis for embedding and detection functions optimized for durability, low distortion, and low unwatermarked-speech variability.The method needs substitution counts and statistics of unwatermarked generations, so it applies to a released model and codec unchanged.Source: §1 · p. 2
  • 80.7% of Moshi answers retain a detectable Redwing watermark after eight Mimi passes at 1% FPR, versus 8.3% for KGW and at most 7.3% for WMAR.Redwing’s speech-quality cost is about that of KGW, and it also has the highest detection rate after most other low-bitrate neural codecs.Source: §1 · p. 2
  • The paper’s contributions are a substitution-based basis, embedding and detection functions solved in that basis, and evidence of generalization across models and codecs.Token-level watermarks operate during generation, unlike separately trained waveform watermark generators.Source: §1 · pp. 1–2

2 RELATED WORK

Prior work includes waveform-level post-hoc watermarking and generation-time token watermarking, each with distinct robustness properties. Redwing’s overview illustrates its focus on substitutions during codec round trips.

2 RELATED WORK

  • Post-hoc watermarks apply across generators, but repeated low-bitrate neural-codec resynthesis removes most of their watermark.They can survive codecs that preserve the waveform closely, and are unaffected by time shifts and cropping; pitch shifts remove them.Source: §2 · p. 2
  • Generation-time token methods bias sampled-token logits; KGW uses a keyed green list, while WMAR fine-tunes the codec and HiPT applies KGW to clusters prone to retokenization confusion.Redwing instead assigns smoothly varying real values over the substitution graph and solves distinct embedding and detection functions.Source: §2 · p. 2
  • Figure 1 depicts tokens changing during round trips and a basis built from those substitutions for solving embedding and detection functions.Its token IDs, graphs, and matrices are schematic.Source: Figure 1 · p. 3
  • Neural codecs quantize speech into token streams, which speech language models generate directly.Examples include Mimi, EnCodec, DAC, SpeechTokenizer, and SNAC.Source: §2 · p. 3
  • Redwing’s basis uses low-eigenvalue graph-Laplacian eigenvectors that vary slowly across strongly connected nodes.This construction draws on spectral clustering, Laplacian eigenmaps, and graph signal processing.Source: §2 · p. 3

3 METHODS

Redwing models speech retokenization as a channel, constructs a smooth basis from token substitutions, and optimizes embedding and detection functions within that basis. Its design balances surviving signal against embedding cost and unwatermarked detector noise.

3.1 SETTING

  • The watermark biases token logits during generation and detects the keyed pattern in tokens recovered by encoding received audio.Retokenization is the random map from generated tokens to re-encoded tokens, which can differ even when the audio is unchanged.Source: §3 · p. 3, §3.1 · p. 3

3.2 A BASIS FROM TOKEN SUBSTITUTIONS

  • The substitution graph is built from aligned encode-decode-encode token sequences, connecting tokens according to how often they replace one another.Tokens observed at least 50 times form the support; self-transitions are excluded because they make leading modes indicators of tokens that survive, carrying little watermark.Source: §3.2 · p. 4
  • Low-eigenvalue Laplacian eigenvectors vary little across substituting tokens, so combinations of the retained 16 nonconstant basis functions change little under retokenization.The normalized Laplacian is computed on the substitution graph.Source: §3.2 · p. 4

3.3 SIGNAL, COST, AND NOISE

  • The design measures recovered watermark signal, sampling-distribution cost, and detector-score noise on unwatermarked speech using matrices A, B, and C.The cost is measured by KL divergence, while C determines the noise in the detector statistic on unwatermarked speech.Source: §3.3 · pp. 4–5

3.4 EMBEDDING AND DETECTION FUNCTIONS

  • Embedding and detection functions are linear combinations of the smooth basis, and their coefficients are chosen to maximize signal per unit cost and noise.The unconstrained maximizer can overvalue rarely sampled tokens and collapse speech quality, so the method instead caps cost, noise, and token values and alternates between bounded subproblems.Source: §3.4 · p. 5

4 EXPERIMENTAL SETUP

Experiments evaluate Redwing on Moshi and two TTS models, matching watermarking cost to KGW and testing repeated resynthesis. Thresholds are calibrated on unwatermarked audio, with separate speech-quality scoring procedures.

4 EXPERIMENTAL SETUP

  • Experiments use Moshi with 1,000 spoken questions and CosyVoice3 and MOSS-TTS with 250 validation and 600 test texts each; each model gets its own codec-derived basis and functions.Substitution counts use 20 hours of LibriSpeech; Moshi’s streams 1–4 and MOSS-TTS’s streams 1–16 are watermarked.Source: §4 · p. 6
  • KGW runs on the same streams as Redwing, while WMAR fine-tunes Mimi; four post-hoc methods are also tested on unwatermarked model outputs.HiPT is omitted because at its nominal 1% level it flags almost all unwatermarked Moshi answers.Source: §4 · p. 6
  • The cost budget matches KGW with δ = 2 on the same streams, yielding Redwing strengths of δ = 0.7 for Moshi and δ = 0.9 for both TTS models.Strength is chosen from measured validation cost because first-order cost prediction underestimates it on TTS models.Source: §4 · p. 6
  • Attacks apply up to eight decode-and-re-encode passes using the native codec or specified foreign neural codecs, including EnCodec at 6 kbps, SpeechTokenizer, SNAC, DAC, and Mimi for TTS.Even the identity condition is read as retokenized tokens rather than generated tokens.Source: §4 · p. 6
  • Detection thresholds are calibrated so at most 1% of unwatermarked calibration answers exceed them, and they are not recalibrated per attack.Moshi quality is scored on non-empty answers only, although detection uses all answers; TTS models produce no empty answers.Source: §4 · p. 6

5 RESULTS

Redwing retains strong detection through repeated Mimi resynthesis on Moshi, outperforming token-level and post-hoc baselines. Its advantage also carries across other codecs and TTS models, with speech-quality costs close to KGW.

5 RESULTS

  • 80.7% TPR after eight Mimi passes, versus 8.3% for KGW and at most 7.3% for WMAR.Detection is measured at a calibrated 1% false-positive rate.Source: §5 · pp. 6–7, Figure 2 · p. 7
  • Redwing has the highest TPR after eight passes through EnCodec, SpeechTokenizer, and SNAC; only on DAC16 does CRAW outperform it, while Redwing beats token-domain baselines.AudioSeal’s 82.3% after EnCodec coincides with a 75.3% unwatermarked-answer flag rate.Source: §5 · p. 7, Table 1 · p. 7
  • After eight native passes, Redwing retains 84.7% TPR on CosyVoice3 and 99.8% on MOSS-TTS, versus 9.2% and 6.2% for KGW.It also has the highest TPR after every foreign codec; Mimi on MOSS-TTS is its weakest case, where no other method exceeds 10%.Source: §5 · p. 7, Figure 3 · p. 8, Table 2 · p. 8
  • Redwing’s speech-quality cost is about KGW’s: UTMOSv2 falls by 0.10 on Moshi and 0.12 on MOSS-TTS, versus 0.09 for KGW on MOSS-TTS.On Moshi, Redwing retains the highest DNSMOS Pro and NISQAv2 among watermarked rows; on CosyVoice3, each predictor changes by at most 0.01.Source: §5 · p. 7
  • After eight Mimi passes, Redwing retains 80.7%, versus 52.3% with a random basis, 68.5% with a transition-matrix basis, and 76.5% when detection uses the embedding function.A fixed random function retains 16.8%; without amplitude bounds, the budget permits only δ = 0.07, yielding 18.7% and substantially lower UTMOSv2, while DAC16 is an exception to the ablation ranking.Source: §5 · pp. 7–8

6 DISCUSSION AND LIMITATIONS

Redwing’s robustness is linked to preserving signal across token substitutions, while its transfer to other codecs depends on those substitutions remaining local in the native graph. Its advantages are strongest for neural resynthesis, with practical boundaries around short answers and frame-misaligning edits.

Why the watermark survives

  • Similar basis values for substituting tokens preserve watermark signal across passes, while separate embedding and detection functions and amplitude bounds keep distortion and detector noise moderate.Removing any of these three design properties lowers TPR after eight Mimi passes.Source: §6 · p. 8

Transfer to other codecs

  • TPR stays above 50% in 12 of 14 model–codec pairs after eight foreign-codec passes, provided re-encoding mostly substitutes native-graph neighbors.Counting foreign-pass substitutions could test this condition and explain the two exceptions.Source: §6 · p. 8

Speech quality

  • Table 3 reports Moshi speech-quality means with 95% confidence intervals for non-empty answers, using KL/frame as the cost measure.The dagger marks WMAR’s fine-tuned decoder, which changes quality even without a watermark.Source: Table 3 · p. 9

Token-domain and post-hoc watermarks

  • Token-domain and post-hoc watermarks have complementary strengths: Redwing survives neural resynthesis and pitch shifts, but not sub-frame shifts or cropping.Post-hoc methods instead survive waveform-preserving codecs and shifts or cropping, but repeated low-bitrate neural-codec passes remove most of their watermark.Source: §6 · p. 9

Leaving the model unchanged

  • Redwing adapts the watermark to the released codec rather than changing the codec, and carries over to two TTS models at a quality cost close to KGW’s.WMAR’s fine-tuned decoder changes quality even without a watermark.Source: §6 · p. 9

Limitations

  • Almost all un-attacked misses and 72 of 116 misses after eight Mimi passes come from answers of at most 4 s; sub-frame shifts, speed changes, and cropping remove most of the watermark.These edits misalign the frame grid; an untested multi-offset detector could recover fractional shifts at greater computation and a higher threshold, but not speed changes.Source: §6 · p. 9

7 CONCLUSION

The conclusion summarizes Redwing’s approach to preserving watermark signal through retokenization, its robustness results, and key design choices and analytical approximations. It also clarifies that the objective predicts a detection-statistic mean shift at a given cost and clip length, but does not ensure TPR ordering because that depends on the statistic’s full distribution.

7 CONCLUSION

  • 80.7% TPR after eight Mimi passes on Moshi, versus 8.3% for KGW and at most 7.3% for WMAR, at no more than KGW’s cost.Redwing leaves the language model and codec unchanged.Source: §7 · pp. 9–10
  • Redwing transfers to CosyVoice3 and MOSS-TTS, while frame misalignment and some foreign codecs remain weaknesses.The conclusion points to improved detector synchronization and a basis built from several codecs as directions for addressing them.Source: §7 · p. 10

A.2 SUBSTITUTION COUNTS

  • The substitution basis is built on tokens with at least 50 source occurrences; tokens outside that support have zero basis values, and unseen-source rows are completed with Pii = 1.The transition matrix retains self-transitions because it represents the full retokenization channel, including tokens that survive.Source: §A.2 · p. 15

A.3 SPECTRAL BASIS

  • Without self-transitions, Moshi’s leading basis modes spread over 70–230 tokens; including them makes 11–15 of 16 modes on streams 3–8 single-token indicators.The method excludes self-transitions so the basis describes substitutions rather than token survival; on CosyVoice3, the median participation ratio falls from 264 to 110 when they are included.Source: §A.3 · pp. 16–17, Table 4 · p. 17

A.4 FIRST-ORDER SIGNAL, COST, AND NOISE

  • Centering the detector removes per-frame variance without changing signal; the first-order analysis is limited to fixed sampling support and leading-order expansions at δ = 0.These expansions do not model support changes, additional sampler renormalization, or watermark effects on later contexts; deployed-strength behavior is measured separately.Source: §A.4 · p. 19

A.5 OBJECTIVE

  • The objective’s derivation approximates the mean of the detection-statistic ratio by the mean numerator divided by a typical denominator; the text identifies this as an approximation, not a derived result.The preceding steps compare embedding and detection-function pairs at a fixed cost.Source: §A.5 · p. 19
  • J predicts the mean shift in Z at fixed cost and clip length, but does not guarantee TPR ordering because TPR depends on Z’s full distribution.The TPR is measured directly.Source: §A.5 · p. 20

A.6 BOUNDED PROBLEM AND SOLVER

Pointwise bounds prevent rare tokens from taking extreme values that can distort generation and detection. The bounded formulation fixes function scale, constrains cost and noise, and is solved by alternating optimization, but the joint problem is nonconvex.

A.6 BOUNDED PROBLEM AND SOLVER

  • Rarely sampled tokens can take extreme values at little average cost, reaching 23, 217, 50, and 5.5 standard deviations on Moshi streams 1–4.Such values can sharply multiply token probabilities when those tokens enter the language model’s candidates, while extreme detector scores can make decisions hinge on a token rather than evidence across frames.Source: §A.6 · p. 20
  • 97% TPR with bounded functions, versus 35% with unbounded functions; bounded functions preserve predicted naturalness while spending more KL divergence.These results are for Moshi streams 1–4 on the validation set; the unbounded result is at δ = 0.07 and the bounded result at δ = 0.7.Source: §A.6 · p. 20, Table 5 · p. 21
  • Scale fixing makes pointwise bounds meaningful: at unit variance, δ sets the typical logit shift and κδ bounds each token’s shift.The scale-fixed constraints also make the embedding cost and detector noise constraints operative.Source: §A.6 · p. 21
  • With amplitude bounds, the optimization is a surrogate that maximizes signal under cost and noise limits, and its solution need not inherit the unbounded problem’s optimality.The cost constraint is slack on Moshi stream 1 and active on streams 2–4.Source: §A.6 · p. 21
  • The procedure starts from one of three leading singular-vector pairs of M, then alternately solves for a with c fixed and c with a fixed using CVXPY and Clarabel.If each block step is solved exactly, objective values from the first complete sweep onward are nondecreasing and converge. The joint problem is nonconvex, so the limit need not be globally optimal; at κ = 5, attained objectives are 68–100% of σ1(M) per stream on Moshi.Source: §A.6 · pp. 21–22

A.7 CHOICE OF K AND κ

The held-out objective supports using K = 16, while κ = 5 captures most of the benefit of a looser bound without the quality drop observed at κ = 10.

A.7 CHOICE OF K AND κ

  • 97–100% of the in-sample objective is retained on held-out data at every k, and K = 16 is within 5% of the plateau on every stream.Streams 5–8 saturate by k = 6 and streams 1–4 by k = 12; every stream is within 1% of its k = 16 value by k = 15.Source: §A.7 · p. 22, Figure 4 · p. 22
  • Useful modes are not ordered by eigenvalue: mode 9 is most useful on stream 1 and mode 14 on stream 2.A cutoff based only on eigenvalue would discard these useful modes.Source: §A.7 · p. 22
  • 0.87 of the unconstrained objective is retained at κ = 5, versus 0.76 at κ = 3 and 0.91 at κ = 10.κ = 5 is the smallest tested value within 5% of the κ = 10 objective; detection per unit KL divergence is flat from κ = 4.5 to 6, while quality drops sharply at κ = 10.Source: §A.7 · p. 22, Table 6 · p. 22

A.8 DETECTION STATISTIC

The detector scores recovered tokens against keyed signs, accounting for stream delays and searched frame offsets. Its null-score analysis relies on assumptions about the signs, while the reported threshold is empirical.

A.8 DETECTION STATISTIC

  • Moshi uses zero-frame delay on stream 1 and one frame on streams 2–8; MOSS-TTS delays stream s by s − 1, while CosyVoice3 has one stream with no delay.The detector indexes key signs to these generation delays.Source: §A.8 · p. 23
  • On unwatermarked audio, Z(τ) has conditional mean zero and variance one when keyed signs are independent fair signs independent of the recovered tokens.The numerator is a sum of independent weighted signs, and its conditional variance equals the squared denominator.Source: §A.8 · p. 23
  • The empirical thresholds are lower than the conservative 1% bound; Moshi uses 2.94, and the bounds do not depend on clip length.On watermarked clips, the expected statistic at the correct offset grows as √n with the number of frames.Source: §A.8 · p. 23
  • The offset search spans ±2 frames because watermarked clips concentrate at τ = −1 on Moshi and τ = 0 on both TTS models.After eight passes through the listed codecs, the Moshi peak remains at τ = −1 on 94–99% of watermarked clips.Source: §A.8 · p. 23

B.1 LANGUAGE MODELS

  • The appendix evaluates Moshi and two TTS systems, with MOSS-TTS watermarking limited to streams 1–16 because streams 17–32 carry little signal through resynthesis.Using streams 1–16 detects 92.3% after eight native passes, matching the all-stream detector; adding streams 17–32 lowers TPR after foreign codecs.Source: §B.1 · p. 24

B.2 DATA AND THRESHOLDS

The appendix details the evaluation protocol, strength selection, baselines, and attack results. Redwing retains detection across codec conditions, while time shifts, cropping, and short clips expose specific weaknesses.

B.2 DATA AND THRESHOLDS

  • The protocol uses 250 validation and 600 test prompts per model, with strength chosen on validation data and thresholds calibrated on separate unwatermarked answers.The calibration threshold is the kth-largest score for k = ⌈0.01n⌉, and a clip is flagged only if its score is strictly above it.Source: §B.2 · pp. 24–25, Table 8 · p. 25

B.3 STRENGTH AND COST

  • At κ = 5, the measured costs are 1.54 nats per frame on Moshi, 0.60 on CosyVoice3, and 2.45 on MOSS-TTS, each within its KGW budget.The first-order cost prediction underestimates measured cost on CosyVoice3 because of its sampler; strength is selected using validation cost.Source: §B.3 · p. 25, Figure 5 · p. 26

C.1 HIGH-FIDELITY CODECS

  • Redwing keeps at least 90.7% TPR on every model and high-fidelity codec except DAC24 on Moshi (64.0%), and KGW and WMAR remain below it in every cell.The table reports detection after eight passes through high-fidelity codecs.Source: §C.1 · p. 28, Table 11 · p. 28

C.2 DETECTION AFTER EVERY PASS

  • Redwing’s TPR declines gradually across repeated codec passes on all three models, rather than collapsing after the first pass.AudioSeal’s TPR under repeated DAC16 and DAC24 passes rises and falls across passes while its FPR stays flat.Source: §C.2 · pp. 28–29, Figure 6 · p. 30, Figure 7 · p. 31

C.3 SIGNAL-PROCESSING ATTACKS

  • Pitch shifts leave Redwing detectable at 67–100% TPR while removing every post-hoc watermark; under milder timing-preserving attacks, Redwing stays close to its unattacked TPR.Redwing loses the most under 10 dB noise and 4-bit quantization on Moshi.Source: §C.3 · p. 29, Table 12 · p. 33
  • Cropping removes almost all of Redwing’s watermark, and fractional-frame shifts weaken it strongly on Moshi and MOSS-TTS; whole-frame shifts within the ±2-frame search cost nothing.Speed changes of 2% or more remove most watermarks except KGW on CosyVoice3.Source: §C.3 · p. 29

C.4 FALSE POSITIVES

  • After eight codec passes, token-domain methods and WavMark, Timbre, and CRAW stay at or below 2.5% FPR, while AudioSeal reaches 45.9–75.3% under EnCodec across the three models.The authors caution that AudioSeal’s TPR under those codecs therefore says little about its watermark.Source: §C.4 · p. 29, Table 14 · p. 34

C.5 CLIP LENGTH

  • After eight Mimi passes, Redwing’s TPR rises from 39.5% in Moshi’s shortest answer-length bin to 100% in its longest, while KGW stays at or below 13.5% in every bin.The shortest bin begins at the 38-frame minimum answer length; FPR stays at or below 2.2% in every bin.Source: §C.5 · p. 29

C.6 NON-EMPTY ANSWERS

Empty answers lower identity TPR across methods, but excluding them does not change Redwing’s comparison after resynthesis. On non-empty answers, Redwing and KGW incur similar UTMOSv2 reductions.

C.6 NON-EMPTY ANSWERS

  • 83.8% TPR after eight Mimi passes remains higher for Redwing than KGW’s 12.2% after empty answers are excluded.Excluding empty answers raises Redwing from 80.7% to 83.8% and KGW from 8.3% to 12.2%; the non-empty unwatermarked FPRs are 1.2% and 1.4%, respectively.Source: §C.6 · p. 34
  • On non-empty prompts, Redwing and KGW lower UTMOSv2 by about the same amount.Across all answers, Redwing’s mean is 3.00 versus 2.91 unwatermarked, alongside fewer empty answers and more speech-like audio in empty answers.Source: §C.6 · p. 34

C.7 SPEECH QUALITY

The section compares paired speech-quality changes from watermarking with unwatermarked answers. Redwing’s reported quality effects are close to KGW on Moshi, small on CosyVoice3, and mixed across predictors on MOSS-TTS.

C.7 SPEECH QUALITY

  • Post-hoc methods do not change the sampling distribution and therefore have no cost.Table 16 reports their speech quality as mean ± 95% CI on the test sets.Source: §C.7 · p. 35, Table 16 · p. 35
  • On Moshi, Redwing lowers UTMOSv2 by 0.09 and raises DNSMOS Pro by 0.10; its UTMOSv2 drop is about the same as KGW and WMAR.The paired comparison uses 448 prompts with non-empty answers from the unwatermarked model, Redwing, and KGW.Source: §C.7 · p. 35
  • On MOSS-TTS, Redwing lowers UTMOSv2 by 0.12 versus 0.09 for KGW, while changing every other predictor by at most 0.04.On CosyVoice3, Redwing changes every predictor by at most 0.01.Source: §C.7 · p. 35

C.8 ABLATIONS

The ablation table specifies variants and evaluation measures, while the extended related work places Redwing among post-hoc and generation-time watermarks and motivates its spectral basis from retokenization substitutions.

C.8 ABLATIONS

  • Table 18 evaluates Moshi ablations by TPR after foreign codecs, UTMOSv2, and KL cost, with each component-removed variant run at its own budget-matched δ.Variants include random and transition bases, a random function, and scoring with the embedding function instead of the solved detection function.Source: §C.8 · p. 35, Table 18 · p. 36

D EXTENDED RELATED WORK

  • Post-hoc watermarks embed into finished audio and generalize across generators, but repeated low-bitrate neural-codec resynthesis removes most of their watermark in the reported experiments.CRAW adds neural-codec resynthesis to training distortions; Latent-Mark instead targets codec latent representations.Source: D EXTENDED RELATED WORK · p. 37
  • Token-level methods bias generation logits; unlike HiPT’s hard token clusters, Redwing uses real-valued functions that vary smoothly over the retokenization substitution graph.Redwing’s embedding and detection functions are distinct and solved for rather than drawn at random.Source: D EXTENDED RELATED WORK · p. 37
  • Neural codecs reconstruct waveforms rather than their original tokens, so decoding and re-encoding can change token identities.The passage describes codecs as compressing speech into discrete token streams, including through residual vector quantization.Source: D EXTENDED RELATED WORK · p. 37
  • The smallest-eigenvalue eigenvectors of the normalized substitution-graph Laplacian vary slowly across strongly connected tokens and form Redwing’s basis.This is the graph-smoothness property used by spectral clustering and Laplacian eigenmaps.Source: D EXTENDED RELATED WORK · p. 37

Related papers

Loading 2609.33774v1…