# Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech

arXiv: https://arxiv.org/abs/2504.10782 · HTML: https://mlsanity.com/paper/2504.10782/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Apr 2025.

## Built on by (most cited first, 11 of 11)

- [Self Voice Conversion as an Attack against Neural Audio Watermarking](https://mlsanity.com/paper/2601.20432/) (2026)
- [Attribution-by-design: Ensuring Inference-Time Provenance in Generative Music Systems](https://mlsanity.com/paper/2510.08062/) (2025)
- [HarmonicAttack: An Adaptive Cross-Domain Audio Watermark Removal](https://mlsanity.com/paper/2511.21577/) (2025)
- [Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audio](https://mlsanity.com/paper/2605.25967/) (2026)
- [Latent-Mark: An Audio Watermark Robust to Neural Codec Compression](https://mlsanity.com/paper/2603.05310/) (2026)
- [CRAW: Codec Robust Audio Watermarking](https://mlsanity.com/paper/2609.03107/) (2026)
- [Audio Pirates: Black-box Audio Watermark Removal via Diffusion Priors](https://mlsanity.com/paper/2605.30614/) (2026)
- [Feature-Aligned Speech Watermarking for Robustness to Reconstruction Distortions](https://mlsanity.com/paper/2606.11828/) (2026)
- [LambdaMark: Semantic Audio Watermarking for Robustness and Radioactivity](https://mlsanity.com/paper/2606.21365/) (2026)
- [MusicMark: A Robust Generative Watermarking Framework for Music Generation](https://mlsanity.com/paper/2607.11117/) (2026)
- [GAMW: Generation-Aware Mel-Domain Watermarking for TTS Traceability](https://mlsanity.com/paper/2610.15082/) (2026)

## Abstract (arXiv)

In the audio modality, state-of-the-art watermarking methods leverage deep neural networks to allow the embedding of human-imperceptible signatures in generated audio. The ideal is to embed signatures that can be detected with high accuracy when the watermarked audio is altered via compression, filtering, or other transformations. Existing audio watermarking techniques operate in a post-hoc manner, manipulating "low-level" features of audio recordings after generation (e.g. through the addition of a low-magnitude watermark signal). We show that this post-hoc formulation makes existing audio watermarks vulnerable to transformation-based removal attacks. Focusing on speech audio, we (1) unify and extend existing evaluations of the effect of audio transformations on watermark detectability, and (2) demonstrate that state-of-the-art post-hoc audio watermarks can be removed with no knowledge of the watermarking scheme and minimal degradation in audio quality.