Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech

Patrick O'Reilly, Zeyu Jin, Jiaqi Su, Bryan Pardo

Track: long paper (up to 9 pages)

Keywords: audio watermarking, deepfakes, speech synthesis

TL;DR: We demonstrate that state-of-the-art audio watermarks can be removed from speech audio without significantly degrading audio quality

Abstract: In the audio modality, state-of-the-art watermarking methods leverage deep neural networks to allow the embedding of human-imperceptible signatures in generated audio. The ideal is to embed signatures that can be detected with high accuracy when the watermarked audio is altered via compression, filtering, or other transformations. Existing audio watermarking techniques operate in a post-hoc manner, manipulating ``low-level" features of audio recordings after generation (e.g. through the addition of a low-magnitude watermark signal). We show that this post-hoc formulation makes existing audio watermarks vulnerable to transformation-based removal attacks. Focusing on speech audio, we (1) unify and extend existing evaluations of the effect of audio transformations on watermark detectability, and (2) demonstrate that state-of-the-art post-hoc audio watermarks can be removed with no knowledge of the watermarking scheme and minimal degradation in audio quality.

Presenter: ~Patrick_O'Reilly1

Format: Yes, the presenting author will attend in person if this work is accepted to the workshop.

Funding: Yes, the presenting author of this submission falls under ICLR’s funding aims, and funding would significantly impact their ability to attend the workshop in person.

Anonymization: This submission has been anonymized for double-blind review via the removal of identifying information such as names, affiliations, and identifying URLs.

Submission Number: 54