WAKE: Watermarking Audio with Key Enrichment

Dong Yu; Hangting Chen; Jianwei Yu; Rongzhi Gu; Xixin Wu; Yaoxun Xu; Yi Luo; Zhiyong Wu

REVIEW 3 major objections 4 minor 38 references

WAKE: Watermarking Audio with Key Enrichment

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read WAKE is the first key-controllable audio watermarking framework, letting a single model embed and decode multiple watermarks with per-message keys and preventing overwriting.

desk verdict The multi-watermark decoding result is real and useful, but the 8-bit key makes the security claims hollow and the variable-length claim is undemonstrated. read the letter →

arxiv 2506.05891 v1 pith:FG623BDE submitted 2025-06-06 cs.SD eess.AS

Yaoxun Xu , Jianwei Yu , Hangting Chen , Zhiyong Wu , Xixin Wu , Dong Yu , Rongzhi Gu , Yi Luo This is my paper

classification cs.SDeess.AS

keywords audiowatermarkingkey-controllableinvertibleneuralnetworkmultiplewatermarkembeddingvariable-lengthbiterrorrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

WAKE is a proposed framework for embedding watermarks into audio so that each watermark is bound to a user-chosen key, and can only be recovered with that key. The paper claims this is the first key-controllable audio watermarking method, and that it fixes three known problems: anyone can decode public watermarks, a second embedding overwrites the first, and watermark length is fixed at training time. In their tests, WAKE decodes the first and second watermarks after double embedding with bit error rates of 1.25% and 2.71%, while AudioSeal and WavMark can only decode the second watermark, failing on the first. With the wrong key, WAKE's output is essentially random guessing (around 50% BER), which the authors present as proof that decoding without the key is impossible. If these results hold, WAKE gives audio a way to carry several independent, key-protected watermarks at once.

What carries the argument

The machinery is an invertible neural network (INN) with eight invertible blocks, one per key bit. In block $i$, the update is $x_{i+1}^f = x_i^f + \phi(wm_i^f) \cdot k_i$, so the key bit $k_i$ gates how much watermark feature is added into the audio feature; the inverse blocks undo this transformation only when the same key bits are supplied. The Predict Module generates the auxiliary $wm_{pre}$ from the watermarked audio, replacing random Gaussian sampling, which the paper argues is needed because the redundancy created by embedding is audio-dependent. Training alternates single- and double-watermark tasks and includes a loss that pushes decoding with a wrong key away from the true watermark, teaching key-dependence.

What would settle it

Use WAKE's released code to embed a known 32-bit watermark with a randomly chosen 8-bit key, then brute-force decode with all 256 possible keys. If more than one key yields a BER close to 0%, or if the correct key is found without prior knowledge, the claim that an incorrect key cannot decode is falsified. A second check: embed three different watermarks sequentially with three keys and measure the first watermark's BER; if it rises above the reported 2-3% toward 50%, the overwriting solution is only demonstrated for two watermarks.

Watch

Extended reading notes

Core claim

The paper's central claim is that by making the invertible neural network's forward and inverse transforms depend on an 8-bit key, one model can both embed and decode multiple watermarks without overwriting, and can refuse to reveal any watermark under a wrong key. Each key bit multiplies the watermark feature in one of the eight invertible blocks, so the whole embedding path is key-specific; decoding with another key inverts a different transform and yields noise. To recover the watermark, WAKE uses a Predict Module that estimates the 'redundancy' term from the audio itself rather than sampling it from a Gaussian, which the authors say is why decoding stays accurate. The paper reports BER of 0.12% for a single watermark with the correct key, 50.09% with an incorrect key, and 1.25%/2.71% for first/second watermarks after sequential embedding, outperforming both baselines in SNR and PESQ.

Load-bearing premise

The whole security argument depends on the 8-bit key being strong enough to stop unauthorized decoding, yet 256 keys can be tried by brute force; if the key space is too small or the key's role as a per-block scalar is too weak, 'impossible without the key' collapses.

Editorial extensions

If this is right

A single WAKE model can embed several independent watermarks into the same audio clip, and each can be recovered later with its own key, so downstream entities adding their own watermark will no longer destroy the original owner's mark.
Because a wrong key yields BER near 50%, the model can serve as a key-based gatekeeper; without the right key, an extractor learns nothing about any embedded watermark.
Variable-length watermark messages can be composed by using multiple keyed watermarks in sequence, removing the need to retrain a model for each message length.
WAKE's reported audio quality (SNR 41.2 dB single, 38.9 dB double) and accuracy beat the current best methods, so the approach does not trade away quality for key control.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper only demonstrates two sequential watermarks; the mechanism should generalize to more, but each additional embedding adds distortion and raises the BER, so the useful number of watermarks is an empirical question the paper does not bound.
The 'incorrect key decoding impossible' claim holds only against a user who does not know the key; an adversary who brute-forces all 256 keys or observes the key-embedding behavior of the public model can likely recover the watermark, so the security is closer to access control than to cryptography.
Because the key length is fixed to the number of INN blocks, extending to a longer key (say 16 or 32 bits) would require a deeper network; whether BER and audio quality survive that scaling is untested.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version. WAKE does something genuinely new: it trains an invertible network so that two watermarks can be embedded sequentially and each recovered with its own key. In Table 1, AudioSeal and WavMark both lose the first watermark after double embedding (46–48% BER), while WAKE gets 1.25% on the first and 2.71% on the second. That's a real capability, not just incremental tuning. The Predict Module also makes sense—replacing random Gaussian redundancy with an audio-dependent prediction—and the ablation shows it drops single-watermark BER from 5.1% to 0.13%. I give them credit for that.

The paper's own framing oversells it, though. The key is 8 bits. Section 3 sets N=8 and ties each bit to one INN block. That's 256 keys total. The wrong-key experiment uses one random wrong key and gets ~50% BER, which is exactly what you'd expect from a random guess; it says nothing about the other 255. With a public model and a known watermark structure, an adversary can enumerate all keys and pick the one that yields a valid watermark. So 'incorrect key decoding impossible' and 'enhancing security' are not supported at the stated configuration. The security problem is less academic than the paper suggests.

The variable-length claim is also unsupported. The abstract says WAKE 'supports variable-length watermark insertion,' but every experiment uses 32-bit watermarks, and the only mechanism mentioned is that multiple watermarks can be embedded and decoded with their respective keys. That's concatenation, not variable-length per se. No experiment varies the length of a single watermark. The authors should either add that experiment or drop the claim.

The baseline comparison is fair in spirit—AudioSeal and WavMark don't have keys, so they're evaluated without keys—but it does make WAKE look stronger than it is. The 'first' claims are also a bit generous given DKIS already does key-controlled INN for images and WavMark already uses INN for audio. The new part is the multi-watermark audio result, which stands on its own.

Bottom line: this is a useful empirical paper for audio watermarking researchers. The core multi-watermark decoding result is credible and deserves referee time. The authors need to either move to a practically secure key size (or retract the security language), and either show variable-length experiments or stop claiming them. With those changes, it's a decent conference paper. I'd send it to review.

Referee Report

3 major / 4 minor

Summary. The paper introduces WAKE, an audio watermarking framework built on an invertible neural network (INN) in which each of N invertible blocks is gated by one bit of a user-supplied key. The watermark is embedded in the frequency domain under perceptual and accuracy losses, plus an adversarial loss and a boundary-focused BroadWeight constraint. A Predict Module estimates the INN redundancy needed for decoding, replacing random Gaussian sampling. Experiments compare WAKE with AudioSeal and WavMark on single and double watermark embedding, report BER under audio editing operations, and include ablations of the perceptual losses and the Predict Module. The central reported result is that after two sequential embeddings, WAKE decodes the first watermark with its key (BER 1.25%) and the second with its key (BER 2.71%), while the baselines fail to recover the first watermark.

Significance. The multi-watermark decoding result in Table 1 is a concrete and useful demonstration: if it holds, WAKE provides a practical solution to the overwriting problem in learned audio watermarking, and the key-conditional decoding mechanism is a novel architectural contribution. The paper also includes a robustness table, a perceptually motivated loss design, and an ablation of the Predict Module; these are valuable empirical contributions, and the authors provide code and a demo page. However, the stated security claim ('incorrect key decoding impossible') and the variable-length watermark claim are not supported by the evidence presented. The contribution is best understood as key-conditional, multi-embedding watermarking with an 8-bit key switch, not as cryptographic access control.

major comments (3)

[Section 3, Basic settings; Eq. (1); Table 1] The security claim in the Abstract and Section 4.1 that 'incorrect key decoding impossible' and 'enhancing security' is not supported by the reported configuration. The key length is fixed at N=8 (Section 3), matching the number of INN blocks, so the key space has only 2^8=256 values. Eq. (1) uses each key bit k_i only as a scalar multiplier on the watermark branch of block i, which provides no cryptographic strength. Table 1 reports the BER for one randomly chosen wrong key, not for an adversarial search: an attacker with the public model can enumerate all 256 keys, decode with each, and select the key that yields a known watermark signature or low BER. The authors should either enlarge the key space to a practically secure size, define a threat model and test an exhaustive or sampling attack, or explicitly narrow the claim to 'key-conditional decoding' rather than 'making incorrect key decoding impossible.'
[Abstract; Section 4.1; Section 5 (Conclusion)] The claim that WAKE 'supports variable-length watermark insertion' and, uniquely, allows 'embedding watermarks of varying lengths' is not demonstrated anywhere in the manuscript. The experiments cover only single watermark embedding (32 bits) and double watermark embedding (two 32-bit watermarks), which is not the same as embedding a watermark of variable length: the paper offers no experiment with, say, a 16-bit or 64-bit watermark, no procedure for changing the watermark length without retraining, and no formal description of how variable-length insertion is achieved. Section 4.1 itself only says the results 'highlight the potential' of varying lengths. This claim must either be supported by new experiments or removed/qualified in the Abstract and Conclusion.
[Table 1, single-watermark WAKE row] There is a load-bearing inconsistency in the incorrect-key result. In Table 1, the single-watermark WAKE row lists BER_1^3 as 0.090 ± 0.075, while Section 4.1 states that 'With an incorrect key, the BER is 50.09%, approximating random guessing.' If the table value is correct, the incorrect key actually decodes the watermark nearly perfectly, which directly contradicts the key-dependence and security claims; if the intended value is 50.090, the table entry is missing a leading digit and needs immediate correction. The paper must clarify this value and ensure the text and table agree.

minor comments (4)

[Table 1 and Table 3] The table formatting is hard to read because the columns are not visually separated; entries such as '0.123±0.00250.090±0.075' and '1.252±0.09142.460±0.201' appear as a single string. Please add clear column boundaries or use separate columns.
[Section 4.2, Table 2] The robustness table reports results on audio editing operations, but there is no description of the parameter settings for each operation (e.g., filter cutoff frequencies, noise levels). Adding these details would make the robustness evaluation reproducible.
[Section 2.3.1, Eq. (3)] The incorrect-key training term wl1 * max(0, wl2 - BCELoss(wm, wm_wrong)) with wl2=0.01 only penalizes wrong-key outputs that are already very close to the watermark; it does not enforce a specific high BER. The paper should discuss what this term actually teaches, especially given the 8-bit key space.
[Throughout] The paper uses both 'WAKE' and 'W AKE' inconsistently; please unify the notation.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation: the paper's key results are held-out empirical evaluations against external baselines; the only self-citation is non-load-bearing, and the 8-bit key limitation is a security concern, not a circularity.

full rationale

The paper does not derive its headline results from its own equations: the key-controlled embedding/decoding behavior is implemented directly in the invertible architecture (Eq. 1) and evaluated on held-out audio against external baselines (AudioSeal, WavMark), so the measured BERs are empirical generalization results rather than quantities forced by construction. The wrong-key failure (BER ~50% in Table 1) is only weakly encouraged by the loss term in Eq. 3 (with a small threshold wl2=0.01), so it is not a fitted parameter simply renamed as a prediction; it is an emergent property of the key-conditioned INN. The one self-citation, [21] DKIS (co-authored by the first author, Yaoxun Xu), appears in a general list of invertible-network image steganography works (Section 2.1.1) and is not used to justify any load-bearing claim, so it does not constitute circularity. The security overclaim that incorrect-key decoding is 'impossible' is undermined by the fixed 8-bit key space (N=8, Section 3), but this is a correctness/security limitation rather than a circular derivation. Overall, the central multi-watermark and key-conditional decoding results are self-contained against external benchmarks, with no reduction of a prediction to its inputs.

Assumptions & free parameters 7 free parameters · 3 assumptions · 1 invented entities

The paper is an empirical machine learning system. Its central claims rest on the trained model's generalization, evaluated with held-out data and baselines. The main hand-chosen hyperparameters are listed as free parameters. The invertibility of the INN and the efficacy of the Predict Module are domain assumptions. No new physical or mathematical entities are postulated; the Predict Module is an architectural invention with ablation support.

free parameters (7)

wp3 = 5
Weight for multi-scale Mel-spectrogram loss in Eq. 2, chosen by hand.
wt1 = 10
Weight for perceptual constraint in training loss, chosen by hand.
wt2 = 10
Weight for accuracy constraint in training loss, chosen by hand.
wl1 = 1000
Weight for incorrect-key loss in Eq. 3, chosen by hand.
wl2 = 0.01
Threshold in incorrect-key loss, chosen by hand.
BroadWeight = 10
Edge emphasis weight for the first and last 3% of audio, chosen by hand.
key length = 8
Number of INN blocks and key bits, chosen by hand; limits key space to 256.

assumptions (3)

standard math The invertible neural network blocks defined in Eq. 1 are invertible when the same key bits are used in forward and backward passes.
Coupling-layer structure makes inversion possible; this underpins the decoding process.
domain assumption The trained Predict Module outputs a redundancy feature close enough to the true learned redundancy for the INN inversion to recover the watermark.
The paper argues that random Gaussian redundancy is suboptimal and the Predict Module learns audio-dependent redundancy; the ablation (Table 4) supports this assumption.
domain assumption PESQ is a valid perceptual quality metric for all audio types used in the experiments, including music and environmental sounds.
PESQ is designed for speech quality; using it for music and environmental audio is questionable, but the authors report it without discussion.

invented entities (1)

Predict Module independent evidence
purpose: Predicts audio-dependent redundancy feature wm_pre for INN decoding, replacing random Gaussian sampling.
Ablation in Table 4 shows BER drops from 5.10% to 0.13% for single watermark when the Predict Module is used, so the component has empirical support.

how reviews work

0 comments

Cite this review

Pith. "Pith review of WAKE: Watermarking Audio with Key Enrichment." pith.science (2026). https://pith.science/paper/FG623BDE

@misc{pith2026250605891,
  author       = {Pith},
  title        = {Pith review of: WAKE: Watermarking Audio with Key Enrichment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FG623BDE}},
  note         = {Machine review of arXiv:2506.05891}
}

read the original abstract

As deep learning advances in audio generation, challenges in audio security and copyright protection highlight the need for robust audio watermarking. Recent neural network-based methods have made progress but still face three main issues: preventing unauthorized access, decoding initial watermarks after multiple embeddings, and embedding varying lengths of watermarks. To address these issues, we propose WAKE, the first key-controllable audio watermark framework. WAKE embeds watermarks using specific keys and recovers them with corresponding keys, enhancing security by making incorrect key decoding impossible. It also resolves the overwriting issue by allowing watermark decoding after multiple embeddings and supports variable-length watermark insertion. WAKE outperforms existing models in both watermarked audio quality and watermark detection accuracy. Code, more results, and demo page: https://thuhcsi.github.io/WAKE.

Figures

Figures reproduced from arXiv: 2506.05891 by the authors.

**Figure 1.** WAKE’s overall process: embedding and decoding watermarks (WM) using specific keys. To address the aforementioned limitations, we propose WAKE, the first key-controllable audio watermark framework. WAKE embeds watermarks into audio and decodes them using keys, as shown in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗

**Figure 2.** Framework of the proposed WAKE. 2.1.1. Invertible neural network Inspired by audio [17], image [20–22], and video [23], we use an INN as the core of WAKE due to its high reusability and computational efficiency. The INN comprises N invertible blocks, with the structure of block i shown in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 4.** Predict Module and Residual Block Structure. noise (PN), low-pass filters (LF), high-pass filters (HF), bandpass filters (BF), boost audio (BA), duck audio (DA), and shush attacks (SA). During training, we randomly select one of these operations and input the processed audio into the decoding process, enhancing WAKE’s adaptability to audio editing. 2.3. Training process 2.3.1. Loss function WAKE aims to embed wate… view at source ↗

Figures from the paper (2 more)

**Figure 3.** Figure 3: The structure of INN block i. The forward process of invertible block i is as follows: x i+1 f = x i f + ϕ(wm i f ) · k i , wm i+1 f = wm i f ⊙ exp(α(ρ(x i+1 f ))) + η(x i+1 f ). (1) Here, α represents the clamp function, ρ, η, and ϕ represent transformation, and ⊙ den…

**Figure 5.** Figure 5: Comparison of different perceptual constraints. SNR and PESQ do not directly reflect human perceptual evaluation. For example, a slight bursting sound is observed at the watermarked audio edges by #1 and #2. Comparing spectrograms of the same audio with the same water…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 26 canonical work pages

[1]

As a result, audio watermarking [5, 6] is becoming essential for preventing misuse and ensuring traceability

Introduction The rapid advancement of audio generation models [1–4] has greatly increased both the quantity and quality of audio content. As a result, audio watermarking [5, 6] is becoming essential for preventing misuse and ensuring traceability. This technique em- beds a predefined watermark into audio to protect copyright and enable tracking, with the ...

work page
[2]

WAKE: Watermarking Audio with Key Enrichment

Methods 2.1. Model architecture As illustrated in Figure 2, W AKE comprises embedding and de- coding modules, an invertible neural network (INN), and a Pre- dict Module. Given original audiox, watermarkwm, and key k, embedding module begins by convertingxto the frequency domain (xf ) via STFT. Simultaneously,wmis embedded and transformed towm f . The INN,...

work page Pith review arXiv 2025
[3]

After audio editing, this becomesx e

Generate a watermarkwmand a keyk, then embedwm into the original audioxusingkto obtain watermarked audio xwm. After audio editing, this becomesx e. Decodex e usingk to retrieve the watermarkwm re. The training loss is: Ltrain =w t1Lp(x, xwm) +wt2La(wm, wmre),(4) wherew t1 andw t2 are the weights for perceptual and accuracy constraints, respectively

work page
[4]

Embedwm 1 intoxusingk 1 to getx wm1, then embedwm 2 intox wm1 usingk 2 to getx wm2

Generate two different watermarkswm 1 andwm 2 with keysk 1 andk 2. Embedwm 1 intoxusingk 1 to getx wm1, then embedwm 2 intox wm1 usingk 2 to getx wm2. After audio editing, this becomesx e. Decodex e using bothk 1 andk 2 to retrievewm re1 andwm re2. The training loss is: Ltrain =w t1(Lp(x, xwm1) +Lp(x, xwm2))+ wt2(La(wm1, wmre1) +La(wm2, wmre2)). (5)

work page
[5]

We selected 500 samples from each dataset for validation and testing

Experiment setting DatasetW AKE uses 3,529.7 hours of different types of training data including LibriSpeech [27], Common V oice [28], Audio Set [29], and Free Music Archive [30]. We selected 500 samples from each dataset for validation and testing. Basic settingsDuring training, the audio sampling rate is set to 16,000 Hz for a duration of 1 second. Each...

work page
[6]

A 32-bit watermark is randomly generated for all models to ensure fairness

Results This section presents a detailed analysis of W AKE’s perfor- mance in generating and decoding watermarked audio with spe- cific keys, based on comprehensive experiments.1 Following training, we use 1-second audio clips for water- mark embedding, conducting each test five times to minimize randomness. A 32-bit watermark is randomly generated for al...

work page
[7]

Using an incorrect key prevents the correct watermark from being decoded, enhancing security

Conclusion This study presents W AKE, the first key-controllable audio wa- termarking model that uses specific keys for both embedding and decoding watermarks. Using an incorrect key prevents the correct watermark from being decoded, enhancing security. Furthermore, W AKE effectively solves the problem of previ- ously embedded watermarks being undetectabl...

work page
[8]

Acknowledgements This work is supported by National Natural Science Founda- tion of China (62076144) and Shenzhen Science and Technol- ogy Program (JCYJ20220818101014030)

work page

Show all 38 references

[9]

V oicebox: Text-guided multilingual universal speech generation at scale,

M. Le, A. Vyas, B. Shi, B. Karrer, L. Sari, R. Moritz, M. Williamson, V . Manohar, Y . Adi, J. Mahadeokaret al., “V oicebox: Text-guided multilingual universal speech generation at scale,”Advances in neural information processing systems, vol. 36, 2024

2024
[10]

Naturalspeech 3: Zero-shot speech syn- thesis with factorized codec and diffusion models,

Z. Ju, Y . Wang, K. Shen, X. Tan, D. Xin, D. Yang, Y . Liu, Y . Leng, K. Song, S. Tanget al., “Naturalspeech 3: Zero-shot speech syn- thesis with factorized codec and diffusion models,”arXiv preprint arXiv:2403.03100, 2024

2024 arXiv
[11]

Unicats: A unified context-aware text- to-speech framework with contextual vq-diffusion and vocoding,

C. Du, Y . Guo, F. Shen, Z. Liu, Z. Liang, X. Chen, S. Wang, H. Zhang, and K. Yu, “Unicats: A unified context-aware text- to-speech framework with contextual vq-diffusion and vocoding,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 38, 2024, pp. 17 924–17 932

2024
[12]

Long-form music generation with latent diffusion,

Z. Evans, J. D. Parker, C. Carr, Z. Zukowski, J. Taylor, and J. Pons, “Long-form music generation with latent diffusion,” arXiv preprint arXiv:2404.10301, 2024

2024 arXiv
[14]

Survey of imperceptible and robust digital audio watermarking systems,

E. Salah, Z. Narima, A. Khaldi, and K. M. Redouane, “Survey of imperceptible and robust digital audio watermarking systems,” Multimedia Tools and Applications, pp. 1–47, 2024

2024
[15]

Enhance- ment of lsb audio steganography based on carrier and message characteristics

H. A. Nassrullah, W. N. Flayyih, and M. A. Nasrullah, “Enhance- ment of lsb audio steganography based on carrier and message characteristics.”J. Inf. Hiding Multim. Signal Process., vol. 11, no. 3, pp. 126–137, 2020

2020
[16]

A view on latest audio steganography techniques,

F. Djebbar, B. Ayad, H. Hamam, and K. Abed-Meraim, “A view on latest audio steganography techniques,” in2011 International Conference on Innovations in Information Technology. IEEE, 2011, pp. 409–414

2011
[17]

Time-spread echo method for digital audio watermarking,

B.-S. Ko, R. Nishimura, and Y . Suzuki, “Time-spread echo method for digital audio watermarking,”IEEE Transactions on Multimedia, vol. 7, no. 2, pp. 212–221, 2005

2005
[18]

Dct based blind audio watermarking scheme,

C. Maha, E. Maher, K. Mohamed, and B. A. Chokri, “Dct based blind audio watermarking scheme,” in2010 International conference on signal processing and multimedia applications (SIGMAP). IEEE, 2010, pp. 139–144

2010
[19]

A robust audio wa- termarking scheme using mean quantization in the wavelet trans- form domain,

N. K. Kalantari, S. M. Ahadi, and A. Kashi, “A robust audio wa- termarking scheme using mean quantization in the wavelet trans- form domain,” in2007 IEEE International Symposium on Signal Processing and Information Technology. IEEE, 2007, pp. 198– 201

2007
[20]

Audio watermark,

Y . Lin, W. H. Abdullaet al., “Audio watermark,”Audio Water- mark A Comprehensive Foundation Using MATLAB, 2015

2015
[21]

Twenty years of digital audio watermarking—a comprehensive review,

G. Hua, J. Huang, Y . Q. Shi, J. Goh, and V . L. Thing, “Twenty years of digital audio watermarking—a comprehensive review,” Signal processing, vol. 128, pp. 222–242, 2016

2016
[22]

Robust audio watermarking in the time domain,

P. Bassia, I. Pitas, and N. Nikolaidis, “Robust audio watermarking in the time domain,”IEEE Transactions on multimedia, vol. 3, no. 2, pp. 232–241, 2001

2001
[23]

Auditory masking and the critical band,

D. D. Greenwood, “Auditory masking and the critical band,”The journal of the acoustical society of America, vol. 33, no. 4, pp. 484–502, 1961

1961
[24]

Dear: A deep-learning-based audio re-recording resilient watermarking,

C. Liu, J. Zhang, H. Fang, Z. Ma, W. Zhang, and N. Yu, “Dear: A deep-learning-based audio re-recording resilient watermarking,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 37, 2023, pp. 13 201–13 209

2023
[25]

Wav- mark: Watermarking for audio generation,

G. Chen, Y . Wu, S. Liu, T. Liu, X. Du, and F. Wei, “Wav- mark: Watermarking for audio generation,”arXiv preprint arXiv:2308.12770, 2023

2023 arXiv
[26]

Proactive detection of voice cloning with localized watermarking,

R. S. Roman, P. Fernandez, A. D ´efossez, T. Furon, T. Tran, and H. Elsahar, “Proactive detection of voice cloning with localized watermarking,”arXiv preprint arXiv:2401.17264, 2024

2024 arXiv
[27]

High fidelity neural audio compression,

A. D ´efossez, J. Copet, G. Synnaeve, and Y . Adi, “High fidelity neural audio compression,”arXiv preprint arXiv:2210.13438, 2022

2022 arXiv
[28]

Robust data hiding for jpeg images with invertible neural network,

F. Shang, Y . Lan, J. Yang, E. Li, and X. Kang, “Robust data hiding for jpeg images with invertible neural network,”Neural Networks, vol. 163, pp. 219–232, 2023

2023
[29]

Dkis: Decay weight invert- ible image steganography with private key,

H. Yang, Y . Xu, and X. Liu, “Dkis: Decay weight invert- ible image steganography with private key,”arXiv preprint arXiv:2311.18243, 2023

2023 arXiv
[30]

Flow-based robust watermarking with invertible noise layer for black-box distortions,

H. Fang, Y . Qiu, K. Chen, J. Zhang, W. Zhang, and E.-C. Chang, “Flow-based robust watermarking with invertible noise layer for black-box distortions,” inProceedings of the AAAI conference on artificial intelligence, vol. 37, 2023, pp. 5054–5061

2023
[31]

Large-capacity and flexible video steganography via invertible neural network,

C. Mou, Y . Xu, J. Song, C. Zhao, B. Ghanem, and J. Zhang, “Large-capacity and flexible video steganography via invertible neural network,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 22 606– 22 615

2023
[32]

Glow: Generative flow with in- vertible 1x1 convolutions,

D. P. Kingma and P. Dhariwal, “Glow: Generative flow with in- vertible 1x1 convolutions,”Advances in neural information pro- cessing systems, vol. 31, 2018

2018
[33]

Hinet: Deep image hiding by invertible network,

J. Jing, X. Deng, M. Xu, J. Wang, and Z. Guan, “Hinet: Deep image hiding by invertible network,” inProceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 4733–4742

2021
[34]

Invertible image rescaling,

M. Xiao, S. Zheng, C. Liu, Y . Wang, D. He, G. Ke, J. Bian, Z. Lin, and T.-Y . Liu, “Invertible image rescaling,” inComputer Vision– ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16. Springer, 2020, pp. 126– 144

2020
[35]

Lib- rispeech: an asr corpus based on public domain audio books,

V . Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Lib- rispeech: an asr corpus based on public domain audio books,” in2015 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 2015, pp. 5206–5210

2015
[36]

Common voice: A massively-multilingual speech corpus,

R. Ardila, M. Branson, K. Davis, M. Henretty, M. Kohler, J. Meyer, R. Morais, L. Saunders, F. M. Tyers, and G. Weber, “Common voice: A massively-multilingual speech corpus,”arXiv preprint arXiv:1912.06670, 2019

1912 arXiv
[37]

Audio set: An ontology and human-labeled dataset for audio events,

J. F. Gemmeke, D. P. Ellis, D. Freedman, A. Jansen, W. Lawrence, R. C. Moore, M. Plakal, and M. Ritter, “Audio set: An ontology and human-labeled dataset for audio events,” in2017 IEEE inter- national conference on acoustics, speech and signal processing (ICASSP). IEEE, 2017, ...

2017
[38]

Fma: A dataset for music analysis,

M. Defferrard, K. Benzi, P. Vandergheynst, and X. Bresson, “Fma: A dataset for music analysis,”arXiv preprint arXiv:1612.01840, 2016

2016 arXiv
[39]

Perceptual evaluation of speech quality (pesq)-a new method for speech quality assessment of telephone networks and codecs,

A. W. Rix, J. G. Beerends, M. P. Hollier, and A. P. Hekstra, “Perceptual evaluation of speech quality (pesq)-a new method for speech quality assessment of telephone networks and codecs,” in 2001 IEEE international conference on acoustics, speech, and signal processing. Proceed...

2001

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

As a result, audio watermarking [5, 6] is becoming essential for preventing misuse and ensuring traceability

Introduction The rapid advancement of audio generation models [1–4] has greatly increased both the quantity and quality of audio content. As a result, audio watermarking [5, 6] is becoming essential for preventing misuse and ensuring traceability. This technique em- beds a predefined watermark into audio to protect copyright and enable tracking, with the ...

work page

[2] [2]

WAKE: Watermarking Audio with Key Enrichment

Methods 2.1. Model architecture As illustrated in Figure 2, W AKE comprises embedding and de- coding modules, an invertible neural network (INN), and a Pre- dict Module. Given original audiox, watermarkwm, and key k, embedding module begins by convertingxto the frequency domain (xf ) via STFT. Simultaneously,wmis embedded and transformed towm f . The INN,...

work page Pith review arXiv 2025

[3] [3]

After audio editing, this becomesx e

Generate a watermarkwmand a keyk, then embedwm into the original audioxusingkto obtain watermarked audio xwm. After audio editing, this becomesx e. Decodex e usingk to retrieve the watermarkwm re. The training loss is: Ltrain =w t1Lp(x, xwm) +wt2La(wm, wmre),(4) wherew t1 andw t2 are the weights for perceptual and accuracy constraints, respectively

work page

[4] [4]

Embedwm 1 intoxusingk 1 to getx wm1, then embedwm 2 intox wm1 usingk 2 to getx wm2

Generate two different watermarkswm 1 andwm 2 with keysk 1 andk 2. Embedwm 1 intoxusingk 1 to getx wm1, then embedwm 2 intox wm1 usingk 2 to getx wm2. After audio editing, this becomesx e. Decodex e using bothk 1 andk 2 to retrievewm re1 andwm re2. The training loss is: Ltrain =w t1(Lp(x, xwm1) +Lp(x, xwm2))+ wt2(La(wm1, wmre1) +La(wm2, wmre2)). (5)

work page

[5] [5]

We selected 500 samples from each dataset for validation and testing

Experiment setting DatasetW AKE uses 3,529.7 hours of different types of training data including LibriSpeech [27], Common V oice [28], Audio Set [29], and Free Music Archive [30]. We selected 500 samples from each dataset for validation and testing. Basic settingsDuring training, the audio sampling rate is set to 16,000 Hz for a duration of 1 second. Each...

work page

[6] [6]

A 32-bit watermark is randomly generated for all models to ensure fairness

Results This section presents a detailed analysis of W AKE’s perfor- mance in generating and decoding watermarked audio with spe- cific keys, based on comprehensive experiments.1 Following training, we use 1-second audio clips for water- mark embedding, conducting each test five times to minimize randomness. A 32-bit watermark is randomly generated for al...

work page

[7] [7]

Using an incorrect key prevents the correct watermark from being decoded, enhancing security

Conclusion This study presents W AKE, the first key-controllable audio wa- termarking model that uses specific keys for both embedding and decoding watermarks. Using an incorrect key prevents the correct watermark from being decoded, enhancing security. Furthermore, W AKE effectively solves the problem of previ- ously embedded watermarks being undetectabl...

work page

[8] [8]

Acknowledgements This work is supported by National Natural Science Founda- tion of China (62076144) and Shenzhen Science and Technol- ogy Program (JCYJ20220818101014030)

work page