Contents
Audio watermarking is reliable against everyday handling and unreliable against a determined remover, and the benchmark evidence is now precise about which method survives which attack. A mark that rides cleanly through uploading, streaming, and MP3 conversion can still be erased in a single pass by re-synthesis or re-embedding. So reliability is never a blanket property of “a watermark”. It is a claim about one specific method facing one specific attack, and the reliable way to answer the headline question is to look at what the benchmarks measure rather than at a vendor’s promise.
The benchmark that measures it
For years, audio-watermark robustness was reported method by method, each paper on its own terms. AudioMarkBench changed that. It is “the first systematic benchmark for evaluating the robustness of audio watermarking against watermark removal and watermark forgery” (Liu, Guo and Jiang, NeurIPS 2024 Datasets and Benchmarks). It draws its speech from Common-Voice “across languages, biological sexes, and ages”, puts three state-of-the-art watermarking methods through fifteen types of perturbation, and tests each in no-box, black-box, and white-box settings, the three levels of attacker knowledge. That structure matters because it separates the everyday distortions a mark should shrug off from the deliberate attacks that define its ceiling.
What each method actually survives
The schemes are not interchangeable. Each is built to survive a different thing, and reads best against the handling it was designed for.
| Method | Built to survive | Where it breaks |
|---|---|---|
| AudioSeal | Classical MP3 in its training envelope | Overwrite, neural codec |
| WavMark | Everyday handling, one-second chunks | Overwrite, neural codec |
| SilentCipher | Lossy compression at 44.1 kHz | Shared re-synthesis ceiling |
| TimbreWatermarking | Fine-tuned voice cloning | Zero-shot cloning |
| VoiceMark | Zero-shot voice cloning | General re-synthesis |
AudioSeal is “the first audio watermarking technique designed specifically for localized detection of AI-generated speech” (San Roman, Fernandez and Elsahar, ICML 2024), it survives classical MP3 inside the distortion range it was trained against, and its detector can attribute a marked clip “to one model among 1,000”. WavMark encodes “up to 32 bits of watermark within a mere 1-second audio snippet” (Chen, Wu, Liu et al., 2023), built to ride through routine audio handling. SilentCipher was the first deep-learning audio watermark to integrate psychoacoustic thresholding and the first to scale to a 44.1 kHz sampling rate (Singh, Takahashi, Liao and Mitsufuji, Interspeech 2024), the rate distributed music uses. The cloning column is its own axis: TimbreWatermarking (Liu, Zhang and Zhang, NDSS 2024) survives fine-tuned voice cloning but drops toward random under zero-shot cloning, and VoiceMark (Li, Wu and Xie, Interspeech 2025) was introduced as the first zero-shot voice-cloning-resistant speech watermark, surviving the exact case where AudioSeal, WavMark and TimbreWatermarking collapse toward random.
The two ceilings every method shares
Underneath the per-method differences sit two attacks that break the whole class. The first is overwriting. Yao, Huang and Wang (AAAI 2026) report re-embedding a fresh mark over the original to drive AudioSeal, WavMark and TimbreWatermarking to a “nearly 100% attack success rate” across white-box, gray-box and black-box settings in their own tests, concluding that keeping the model secret provides no security. The second is neural re-synthesis. A benchmark measures passing watermarked speech through a neural codec such as EnCodec or DAC and back pushing AudioSeal’s bit-error rate to 98% or higher (Liu, Guo and Jiang, NeurIPS 2024), which it frames as erasure rather than degradation. And the removal is reported as not tied to any one scheme: O’Reilly, Pardo and Jin (ICLR 2025 Workshop) report stripping state-of-the-art post-hoc audio watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality”. These removal figures are each source paper’s own reported result, not independently replicated. Whichever method you pick, these two ceilings are roughly where its reliability ends.
Reliability is not uniform across speakers
There is a dimension the headline numbers hide. Because AudioMarkBench draws its speech across languages, biological sexes, and ages, it is built to ask whether a mark is equally removable for every kind of speaker, not just on average. The benchmark closes by calling for “more robust and fair audio watermarking solutions”, naming fairness as an open problem rather than a solved one. For anyone relying on a watermark as evidence, that means robustness measured on one population does not automatically transfer to another, and a single headline detection rate can hide real variation underneath.
How to read it
Audio watermarking is a strong deterrent against casual handling and a weak seal against a determined remover. If your question is whether a mark survives uploading, streaming, and ordinary compression, a well-designed scheme usually holds. If your question is whether it survives a neural-codec round-trip, an overwrite, or a scheme-blind removal tool, the benchmarks say no. That asymmetry also shapes how to read a result: a positive detection is useful evidence that a specific mark is present, while a negative detection is usually weak, because the audio may never have been watermarked, may have been re-synthesised, or may have been overwritten. The reliability of any audio watermark is set by the strongest operation it faces, not the most common one, so read every reliability claim as attack-specific and method-specific. If your goal is the reverse, keeping your own audio from being traced back to you, see does removing an audio watermark work?.
Sources
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Singh, Takahashi, Liao, Mitsufuji (2024). SilentCipher: Deep Audio Watermarking. Interspeech.
- Li, Wu, Xie (2025). VoiceMark: Zero-Shot Voice Cloning-Resistant Speech Watermarking. Interspeech.
- Liu, Zhang, Zhang (2024). Detecting Voice Cloning Attacks via Timbre Watermarking. NDSS.