Contents
A well-designed audio watermark survives ordinary MP3 and other lossy compression at reasonable bitrates, but “survives MP3” is not the same claim as “survives re-encoding”, because a neural-codec round-trip or a single overwrite erases it. The answer splits cleanly by what you do to the file. Classical lossy compression, the kind that happens when audio is uploaded, streamed, or converted to MP3 or Ogg, is inside what these marks are built to withstand. Neural re-synthesis and deliberate re-embedding are not. What follows is what survives, what does not, and why the difference matters.
What survives ordinary compression
The marks designed for it hold up well under lossy compression. The open-source audiowmark project is a concrete example: Stefan Westerfeld’s GPL tool hides a 128-bit payload in the FFT spectrum using a patchwork algorithm, uses convolutional codes for error correction, and reports that after conversion to MP3 or Ogg at 128 kbit/s or higher its watermark “usually can be retrieved without problems”. It searches replay speed over roughly 0.8 to 1.25 times. AudioSeal likewise survives classical MP3 compression inside its training envelope, the range of distortions it was trained against (San Roman, Fernandez and Elsahar, ICML 2024). Robustness to compression is a design target, not an accident: SilentCipher (Singh, Takahashi, Liao and Mitsufuji, Interspeech 2024) was the first deep-learning audio watermark to integrate psychoacoustic thresholding and the first to scale to a 44.1 kHz sampling rate, the standard rate for distributed music. WavMark, which encodes “up to 32 bits of watermark within a mere 1-second audio snippet” (Chen, Wu, Liu et al., 2023), belongs to the same generation of marks built to ride through everyday audio handling.
Where it categorically breaks
The break is not gradual. It is a change of attack class. A neural-codec round-trip, passing the audio through an EnCodec or DAC encoder and back, pushes AudioSeal’s bit-error rate to 98% or higher (Liu, Guo and Jiang, NeurIPS 2024). At that error rate the payload is gone, not degraded. A single overwriting pass does the same: Yao, Huang and Wang (AAAI 2026) report re-embedding a fresh mark over the original to drive AudioSeal and WavMark to a “nearly 100% attack success rate” across white-box, gray-box and black-box settings in their own tests, concluding that keeping the model secret provides no security. And they report the removal generalising beyond any one scheme: O’Reilly, Pardo and Jin (ICLR 2025 Workshop) report removing state-of-the-art post-hoc audio watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality”. These are each source paper’s own reported result, not independently replicated.
| Operation | Typical effect on the mark |
|---|---|
| MP3 or Ogg at 128 kbit/s or higher | Usually recoverable |
| Neural-codec round-trip (EnCodec, DAC) | Bit-error 98% or higher, payload lost |
| Overwrite with a fresh mark | Near-total removal |
Why the two cases differ
The reason MP3 is survivable and a neural codec is not comes down to what each operation does to the signal. Lossy compression like MP3 discards perceptual detail but leaves intact the broad structure the watermark rides in, which is why a mark designed with the compression in its training envelope comes through. A neural codec re-synthesises the audio from a learned representation, so it rebuilds the waveform rather than trimming it, and the fragile watermark pattern does not survive the rebuild. An overwrite is more direct still: it writes a new mark over the region the old one occupied. This is why the phrasing is always attack-specific rather than a blanket “yes” or “no”.
The one outlier
There is a single audio mark built to a different standard. Cinavia, Verance’s copy-control watermark covered by US 8,085,935 B2 (Petrovic, Verance, 2011), is designed to survive the analog hole, including microphone re-recording and broadcast. That durability rests on Verance’s own patent rather than any independent benchmark, so it is a design claim rather than a tested result, and it applies to a copy-control mark that needs no large payload, not a template the attribution marks can adopt.
How to read it
If your question is “will my watermark still be there after this file is uploaded and turned into a 128 kbit/s MP3”, the answer for a well-designed mark is usually yes. If your question is “will it survive someone passing the audio through a neural codec or re-embedding over it”, the answer is no. The reliability of an audio watermark is defined by the strongest operation it faces, not the most common one. If your goal is the reverse, keeping your own audio from being traced back to you, see does removing an audio watermark work?.
Sources
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Singh, Takahashi, Liao, Mitsufuji (2024). SilentCipher: Deep Audio Watermarking. Interspeech.
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.
- Petrovic (2011). Embedding and Extraction of Information from an Embedded Content Using Replica Modulation. US Patent 8,085,935 B2, Verance.