Contents
Yes. A motivated adversary can remove a voice watermark from AI speech, and against the strongest published attacks the erasure is close to total rather than partial. This article reviews what the research shows about removing watermarks from spoken audio, treating removability as a reliability property. It is not a removal guide. Here the only question is what the literature proves about how durable a voice mark is.
What a voice mark is built to survive
Start with the best case, because it sets the envelope. AudioSeal is “the first audio watermarking technique designed specifically for localized detection of AI-generated speech” (San Roman, Fernandez and Elsahar, ICML 2024). It operates at 16 kHz, its detector resolves the mark to one sample, a resolution of 1/16000 second, and its multi-bit payload can attribute a clip “to one model among 1,000.” That fine localization matters for a voice system, because speech is often edited in pieces: a short pasted phrase can be the whole point, and a clip-level yes-or-no result is too coarse to catch it. WavMark belongs to the same generation of marks and encodes “up to 32 bits of watermark within a mere 1-second audio snippet” (Chen, Wu and Liu, 2023), enough to carry an identifier through routine handling. For the everyday life of a speech clip, uploading, streaming, ordinary re-saving, a well-built voice mark of this kind usually comes through. That is the deterrent half of the answer, and it is real.
The two attacks that erase it
The envelope ends abruptly where a motivated remover begins, and it ends the same way for every current speech mark. The first ceiling is overwriting. Yao, Huang and Wang (AAAI 2026), in “Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking,” re-embed a fresh mark over the original signal and report driving the leading neural speech watermarks to a “nearly 100% attack success rate” across white-box, gray-box and black-box settings in their own tests. The mechanism is simple in principle: write a new mark into the space the old one lived in, and the old one is displaced. Their conclusion is blunt, that keeping the model secret provides no security. The second ceiling is neural re-synthesis. Passing watermarked speech through a neural codec such as EnCodec or DAC and back pushes AudioSeal’s bit-error rate to 98% or higher (Liu, Guo and Jiang, NeurIPS 2024). At that error rate the payload is not degraded, it is gone. The difference between the two halves of this article is the difference between trimming a signal and rebuilding it: MP3 trims, a neural codec rebuilds, and the fragile mark does not survive the rebuild.
Removal does not need the scheme
A reader might hope that keeping the watermarking method private is itself a defense. It is not. O’Reilly, Pardo and Jin (ICLR 2025 Workshop), in work titled “Deep Audio Watermarks are Shallow,” report removing state-of-the-art post-hoc speech watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality.” These removal figures, from Yao, AudioMarkBench and O’Reilly alike, are each the source paper’s own reported result, not independently replicated. Combined with the overwriting result, this closes the secrecy escape route from two directions: a black-box attacker who never learns the scheme can still strip the mark, and an attacker who simply writes over it succeeds regardless of what the original was.
The voice-cloning axis
Speech has one removal channel that music does not, because the whole point of an AI voice is that it can be cloned, and cloning re-synthesises the voice from scratch. This is its own axis of fragility. TimbreWatermarking (Liu, Zhang and Zhang, NDSS 2024) was built to survive voice cloning and does survive the fine-tuned case, but it drops toward random under zero-shot cloning, where the attacker needs no training on the target voice. VoiceMark (Li, Wu and Xie, Interspeech 2025) was introduced as the first zero-shot voice-cloning-resistant speech watermark precisely because it survives the exact case where AudioSeal, WavMark and TimbreWatermarking collapse toward random. Read that progress narrowly: each new scheme names the previous generation’s failure case as its reason to exist, which tells you the collapse cases are real and known, not that the problem is solved.
What removability means for trust
The benchmark that measures all of this, AudioMarkBench, describes itself as “the first systematic benchmark for evaluating the robustness of audio watermarking against watermark removal and watermark forgery” (Liu, Guo and Jiang, NeurIPS 2024), and it puts three state-of-the-art methods through fifteen types of perturbation. The verdict that emerges is not that voice watermarks are useless, but that they are asymmetric evidence. A present mark is real evidence that a specific scheme processed the audio. An absent mark is close to neutral, because the speech may never have carried a mark, may have been re-synthesised by a codec or a cloner, or may have been overwritten in a single pass. None of that makes a voice watermark worthless; it makes it evidence that runs in one direction only. That asymmetry is the same conclusion the reliability companion, are voice watermarks reliable?, reaches from the other side. If your goal is the reverse, keeping your own voice from being traced back to you, see does removing an audio watermark work?.
Sources
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.
- Liu, Zhang, Zhang (2024). Detecting Voice Cloning Attacks via Timbre Watermarking. NDSS.
- Li, Wu, Xie (2025). VoiceMark: Zero-Shot Voice Cloning-Resistant Speech Watermarking. Interspeech.