{"id":"8bbe159c-10fa-433a-9303-98fad85735f3","arxiv_id":"2412.13917","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"DiscreteWM embeds watermarks in speech by altering the parity of vector-quantized audio token IDs, and reports state-of-the-art robustness and imperceptibility with up to 150 bits per second capacity.","lead":"This paper presents DiscreteWM, a speech watermarking system that hides data by changing the ID numbers of speech sound tokens rather than by adding noise to the audio. Because the tokens form a compact, robust representation, the hidden messages survive signal distortions while the audio sounds nearly unchanged.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 3e-5 false-positive-rate claim is a hypothetical calculation from assumed frame-level α/β and independent frames, not a measured detector statistic.","rationale":"The reader's conditional verdict is appropriate. I examined two candidate concerns: (1) whether the restorer R is trained on the actual substitution distribution produced by the manipulator M, and (2) whether the utterance-level FPR is measured or assumed. The aggregate BER in Table 1 (0.28%) already suggests R recovers parity on real watermarked frames, so concern (1) is partially answered by the reported experiments. Concern (2), however, is not answered anywhere in the paper: the 3e-5 FPR follows from plugging assumed α=0.95, β=0.10, T=200 into a normal approximation, and the paper gives no raw localizer statistics, error bars, or empirical FPR with sample size. Because this number appears in the abstract and in contribution 4, it is load-bearing for the voice-cloning-detection claim. The concrete check (measuring α/β and accounting for frame autocorrelation) would settle whether the claimed FPR is reproduced with measured detector statistics. If it is not, the paper remains a plausible method but with an over-stated reliability guarantee.","tokens_in":18080,"tokens_out":15646,"duration_ms":149203,"concrete_test":"Measure D's actual frame-level α and β on the full 24,837-utterance test set (watermarked with m=10% vs clean), and estimate the autocorrelation function of D's binary frame outputs on clean speech. Compute the effective number of independent frames T_eff = T/(1+2Σρ_k), then recompute the Z-statistic and empirical utterance-level FPR at threshold 4.0 using the measured β and T_eff (or by bootstrap over utterances). If the recomputed FPR differs materially from 3×10−5, the headline reliability claim should be re-scoped.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline reliability number is not an empirical result. In Section 3.3, Eq. (6) is combined with assumed α=95%, β=10%, T=200, m=10% to obtain Z=4.01 and one-sided p=3e-5; the abstract and contributions repeat this as 'achieves a false positive rate of 3×10−5'. The 'Utterance-level Reliability' ablation in Section 4.4 reports Z-statistics for watermarked clips and states TPR/FPR of 1.0/0.0 at m≥0.10, but gives no sample size, confidence intervals, or raw α/β for the localizer, so it does not validate the theoretical FPR. The calculation is also sensitive to the assumed β: with T=200, m=0.10, and α=0.95, the watermarked frame count is α·20+β·180. At β=0.10 this is 37 (Z=4.01), but at β=0.20 it is only 55, below the Z=4 threshold of 40+4·sqrt(32)≈62.6, so the detector would fail at the claimed setting. Additionally, Eq. (6) treats frame decisions as independent Bernoulli variables, while speech frames and a convolutional localizer produce strongly autocorrelated outputs, so the effective number of independent frames is likely much smaller than T=200. Both the mean and the variance used in the Z-test are therefore unverified assumptions.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DiscreteWM, a speech watermarking framework that embeds watermark bits by enforcing the parity of vector-quantized token IDs to match the watermark string. A masked VQ-VAE maps speech to discrete tokens; a manipulator model selects replacement tokens so that the watermark is imperceptible; a localizer and restorer recover the parity from (possibly distorted) watermarked audio. The paper reports competitive PESQ/SNR and low BER for information hiding, a frame-wise detector that avoids sliding-window localization, flexible capacity up to 150 bits per second, and a Z-test procedure for utterance-level AI-generated speech detection with a claimed false positive rate of 3e-5.","tokens_in":18405,"tokens_out":6223,"duration_ms":56378,"significance":"If the claims hold, DiscreteWM is a practically interesting contribution: embedding watermarks in discrete latent space is conceptually different from prior continuous-space schemes, the frame-wise localization removes a known efficiency bottleneck, and the reported BER/PESQ trade-off in Table 1 is strong. The ablation isolating discrete versus continuous representations (Table 3) and the random-seed averaging in Appendix A.4 are useful. However, the headline false positive rate is a hypothetical calculation from assumed localizer parameters rather than a measured detector statistic, and the 'state-of-the-art' claim is overstated in the voice-cloning-detection comparison. These issues are fixable but require reanalysis and rephrasing.","major_comments":[{"comment":"The claimed false positive rate of 3e-5 is not an empirical result: it is computed from assumed frame-level alpha=0.95 and beta=0.10 with T=200. The 'Utterance-level Reliability' experiment in Section 4.4 reports TPR/FPR 1.0/0.0 at m>=0.10 but gives no sample size, confidence intervals, or measured alpha/beta for the localizer, so it does not validate the theoretical FPR. The calculation is also fragile: with the same T=200, m=0.10, and alpha=0.95, the expected watermarked-frame count is 37 at beta=0.10 but only 55 at beta=0.20, giving Z around 2.65 rather than 4.01, well below the Z=4 threshold. Moreover, Eq. (6) treats frame decisions as independent Bernoulli variables, while overlapping STFT frames and a convolutional localizer produce strongly autocorrelated outputs, so the effective number of independent frames is likely much smaller than T=200. Please present the Z-test as a conditional analysis, report measured localizer statistics with error bars, and avoid stating the 3e-5 value as an achieved detection property without those measurements.","section":"Section 3.3, Eq. (6); abstract; Section 4.4"},{"comment":"The contribution statement that DiscreteWM 'outperforms other state-of-the-art speech watermarking models on both voice cloning detection and information hiding tasks' is not supported by Table 2. In that table, SeamlessWM has a lower MEAN BER (0.18) than Ours (0.32), while Ours has higher PESQ (4.37 vs 3.77) and SNR (38.01 vs 29.62). The evidence shows a favorable imperceptibility/robustness trade-off and faster RTF, not dominance. Please revise the claim to match the evidence, for example by stating that the method achieves state-of-the-art imperceptibility with comparable robustness and higher speed, or by reporting an operating point where the BER comparison is also favorable.","section":"Section 3.1 (contributions) and Table 2"},{"comment":"The attack simulator used in the restoration loss Lres is mentioned as 'employed ... following previous works' but its exact configuration is never specified: no distortion types, SNR ranges, augmentation probabilities, or schedule are given. Since the robustness results in Tables 1 and 2 are central evidence for the proposed discrete-latent advantage, omitting the training-distortion distribution makes the experiments hard to reproduce and leaves open whether the reported robustness is specific to the test attacks rather than a general property. Please specify the attack simulator and, ideally, include robustness evaluation under distortions not seen during training.","section":"Section 3.2.1 and Appendix A"},{"comment":"The evaluation protocol for Audiowmark is inconsistent and underreported: Section 4.2 states that Audiowmark 'can hardly embed watermarks into the one-second speech segment' and therefore uses utterance-level evaluation, yet Table 1 lists Audiowmark among the segment-based results without explaining the asterisk in the caption. Please clarify exactly how the Audiowmark numbers in Table 1 were obtained and remove or annotate the inconsistency.","section":"Section 4.2, Table 1, and Appendix A.5"}],"minor_comments":[{"comment":"The sentence 'For Seamless (Chen et al. 2023), we successfully reproduce their model...' cites the wrong reference; SeamlessWM is Duquenne et al. (2023), not Chen et al.'s WavMark.","section":"Appendix A.5"},{"comment":"The paper says results are averaged over 10 random seeds, but the tables report no standard deviations or confidence intervals; please add error bars or explicitly state that the reported differences are larger than seed variance.","section":"Appendix A.4 and Tables 1-3"},{"comment":"The text refers to a 'one-sided p-value' without defining the test direction; since the Z-statistic can be negative when the detected frame count is below the clean-speech expectation, please clarify the one-sided alternative being tested.","section":"Section 3.3"},{"comment":"There are minor typos: 'Attention Headss' in Table 4 and 'Disccusions' in the Appendix F/G/H headings should be corrected.","section":"Table 4 and Appendix F/G/H"}],"recommendation":"major_revision","confidential_remarks":"The core method is original and the main experimental evidence for the discrete-latent approach is credible, so I would not reject. However, the unsupported 3e-5 false-positive claim and the overstated SOTA statement in Table 2 need to be corrected before publication. I recommend major revision rather than minor because the headline reliability number is presented as an achieved result and the authors need to either measure the localizer's actual alpha/beta or substantially rephrase the claim. The absence of code is not disqualifying, but the missing attack-simulator specification is a reproducibility concern that should also be addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is real and worth engaging with: embedding speech watermarks by enforcing the parity of VQ token IDs is a new twist for speech watermarking, and the frame-wise localizer is a practical fix for the fixed-length constraint. The ablations actually support the discrete-representation story, and the capacity/flexibility claims (1–150 bps) are credible. For the information hiding task in Table 1, the numbers are good: lower BER than WavMark, DeAR, and Chang Liu at 32 bps with competitive PESQ/SNR. That is a meaningful contribution.\n\nThe soft spots are not fatal but are real. First, the paper's contribution line says it \"outperforms SOTA on both voice cloning detection and information hiding,\" but Table 2 tells a different story: SeamlessWM has a lower MEAN BER (0.18 vs 0.32). The paper's own text in Section 4.3 is more careful, saying \"comparable robustness\" — the abstract and contributions overstate it. Second, the 3e-5 false positive rate is not an empirical result. Section 3.3 computes it from assumed alpha=95%, beta=10%, T=200, m=10%, and the utterance-level ablation in Section 4.4 reports TPR/FPR of 1.0/0.0 without any sample size or confidence intervals. That is a hypothetical calculation, not a measured detector statistic. The stress-test note also correctly points out that the Z-test treats frames as independent, which is almost certainly false for speech, so the variance is optimistic. This claim should be re-scoped as a design analysis, not an achieved result.\n\nMinor issues: no error bars in the main tables (they mention 10 seeds in the appendix but do not report variance), and the attack simulator used in training is never specified. Those are fixable in a revision. The citation pattern looks honest; the related work covers the relevant baselines, and the lack of code/data is a limitation but not a disqualifier.\n\nOverall, this is a solid paper with one overclaimed headline number and one overbroad contribution statement. It deserves a serious referee: the framework is novel, the experiments are mostly careful, and the problems are re-scoping and verification, not a load-bearing flaw. I would send it to peer review with a request to soften the SOTA claim, report measured detector statistics with confidence intervals, and describe the attack simulator.","headline":"DiscreteWM is a genuinely new watermarking scheme with solid support for the info-hiding task, but the SOTA claim for AI-detection and the 3e-5 FPR are not backed by its own tables.","tokens_in":18953,"tokens_out":2091,"would_cite":true,"duration_ms":19954,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DiscreteWM embeds speech watermarks by enforcing that vector-quantized token IDs have parity equal to the watermark bits, reporting 0.28% mean bit error at 32 bps and a 3e-5 false positive rate for voice-cloning detection.","keywords":["speech watermarking","discrete latent space","vector quantization","parity embedding","voice cloning detection","information hiding","robustness","imperceptibility"],"falsifier":"Run the localizer on clean, unwatermarked speech from a target domain (for example, telephone-band recordings or an unseen TTS voice) and estimate its false positive rate beta; if beta is materially above the assumed 10%, the Z-test's 3e-5 utterance-level false positive rate no longer follows. A second check is to feed the restorer audio distorted by channels outside the attack simulator, such as strong room reverb or a neural vocoder, and measure whether the parity bit error rate stays near the reported 0.28%.","tokens_in":17893,"feed_emoji":"🎙️","tokens_out":6959,"duration_ms":56274,"temperature":0.7,"pith_summary":"This paper tries to establish that watermarks for speech are more robust when hidden in a discrete, codebook-based latent space than in the continuous noise patterns used by prior systems. The proposed scheme, DiscreteWM, maps speech to vector-quantized tokens and encodes each watermark bit as the parity (even or odd) of a token's codebook ID. A learned manipulator picks replacement tokens whose parity matches the desired bit while keeping the audio nearly unchanged. On one-second clips it reports a mean bit error rate of 0.28% at 32 bits per second, and its frame-wise localizer detects watermarks roughly 22 times faster than sliding-window detectors. The same machinery is offered as a defense against voice cloning by flagging which frames were reconstructed.","feed_headline":"Watermark bits ride on parity of discrete speech tokens","feed_subtitle":"New speech watermarking scheme reports 0.28% bit error at 32 bits per second while staying inaudible.","key_machinery":"The load-bearing object is the parity of the discrete codebook index, c mod 2, used as the watermark symbol. The VQ-VAE turns magnitude spectrograms into sequences of token IDs; the manipulator model predicts token probabilities from context and restricts the sample to same-parity candidates; the localizer distinguishes original from reconstructed frames; the restorer is trained with Lres = E[−log p(c mod 2)] under an attack simulator so parity survives distortion. Together they convert watermarking into a token-selection problem rather than a noise-adding problem.","core_discovery":"The central claim is that the modular arithmetic relation of discrete acoustic token IDs can serve as a robust, imperceptible watermark channel. Concretely, DiscreteWM trains a masked vector-quantized autoencoder to reconstruct speech from frame-level discrete tokens, then embeds a bit string by requiring each selected token's ID to be even for '0' and odd for '1' (or, in general, to satisfy c mod 2 = w). A probability-based manipulator, trained to predict masked tokens, samples the most likely token among those with the required parity, minimizing audible distortion. At detection time, a localizer finds the watermarked frames and a restorer recovers the parity from distorted audio; the paper reports mean BER of 0.28% at 32 bps, better than the continuous-space baselines it was compared against, and a Z-test-based false positive rate of 3e-5 for utterance-level voice-cloning detection.","pith_inferences":["A natural stress test would be to attack the parity channel with distortions the simulator never saw, such as room reverberation, codec cascades, or adversarial perturbations designed to flip parity; the paper's reported robustness covers the distortions it lists, not all possible channels.","The modular-constraint idea is not speech-specific: any vector-quantized codebook with a small index space could carry side information through parity or other modular relations, suggesting a transfer path to image or video tokenizers.","The 3e-5 false positive rate is an analytic consequence of assumed localizer rates (alpha=95%, beta=10%) rather than a measured detector statistic; a deployment would need to estimate those rates on target audio."],"forward_implications":["Encoding capacity becomes a runtime choice: 1 to 150 bits per second in a one-second clip, with no retraining for a new capacity.","Watermark localization no longer needs a sliding window, yielding a 22.1x speedup in the combined embedding-and-detection pipeline.","AI-generated speech detection reduces to counting reconstructed frames and running a one-proportion Z-test, with a reported false positive rate of about 3e-5.","The parity channel keeps mean bit error below 1% under the eight tested distortions (Gaussian noise, amplitude scaling, resampling, MP3 compression, median filtering, low-pass filtering, and echo addition)."],"supporting_citations":[{"why":"Supplies the vector-quantized variational autoencoder that maps speech spectrograms into discrete token IDs.","marker":"(Van Den Oord, Vinyals et al. 2017)"},{"why":"Supplies the clustered vector quantizer used to improve codebook usage and reduce reconstruction error.","marker":"(Zheng and Vedaldi 2023)"},{"why":"Provides the parity (c mod 2) watermarking idea and the WavMark baseline, plus the attack-simulator training recipe.","marker":"(Chen et al. 2023)"},{"why":"Provides the DeAR continuous-space watermarking baseline and the distortion-resilient training approach the attack simulator builds on.","marker":"(Liu et al. 2023a)"},{"why":"Provides a fixed-length frequency-domain watermarking baseline and a second reference for the attack simulator.","marker":"(Liu et al. 2023b)"},{"why":"Frames voice-cloning detection as the application and supplies the SeamlessWM baseline for AI-generated speech detection.","marker":"(Duquenne et al. 2023)"},{"why":"Supplies the multi-period and multi-scale discriminators used to keep watermarked speech perceptually close to clean speech.","marker":"(Kong, Kim, and Bae 2020)"}],"fun_headline_variants":["Parity trick hides bits in discrete speech tokens","DiscreteWM: watermarking via token parity","Bit errors drop to 0.28% via token parity watermark","Inaudible watermark keys off discrete token ID parity","Speech watermarking with discrete token parity"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole detection pipeline depends on the restorer being able to recover the parity (c mod 2) of the originally selected token from distorted audio; the paper does not specify the attack simulator's distortion distribution and reports no error bars on the localizer's true and false positive rates, so the headline false positive rate rests on assumed localizer statistics.","fun_headline_variants_meta":{"raw":{"variants":["Parity trick hides bits in discrete speech tokens","DiscreteWM: watermarking via token parity","Bit errors drop to 0.28% via token parity watermark","Inaudible watermark keys off discrete token ID parity","Speech watermarking with discrete token parity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000291,"raw_usage":{"total_tokens":1702,"prompt_tokens":946,"completion_tokens":756,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":562,"completion_tokens_details":{"reasoning_tokens":682}},"tokens_in":562,"tokens_out":756,"duration_ms":7137,"temperature":1.0,"reasoning_tokens":682,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T12:39:19.198749+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the localizer on clean, unwatermarked speech from a target domain (for example, telephone-band recordings or an unseen TTS voice) and estimate its false positive rate beta; if beta is materially above the assumed 10%, the Z-test's 3e-5 utterance-level false positive rate no longer follows. A second check is to feed the restorer audio distorted by channels outside the attack simulator, such as strong room reverb or a neural vocoder, and measure whether the parity bit error rate stays near the reported 0.28%.","supporting_citations":[],"review_version":1}