Pith. sign in

REVIEW 4 major objections 5 minor 49 references

A semantic-level watermark survives audio edits by hiding proof in the spoken words themselves.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 17:32 UTC pith:65NCAAQR

load-bearing objection The semantic-level idea is real and the compression numbers hold up, but the abstract's signal-processing gain is an artifact of mixing in extra out-of-benchmark attack settings; at official AudioMarkBench settings SSTMark ties Timbre. the 4 major comments →

arxiv 2607.17592 v1 pith:65NCAAQR submitted 2026-07-20 cs.SD

SSTMark: Robust Training-Free Semantic-Level Speech Watermarking

Kuan-Lin Chu , Jun-Cheng Chen , Chun-Shien Lu This is my paper
classification cs.SD
keywords speech watermarkingsemantic-level watermarktext watermarkingspeech-to-texttext-to-speechrobustnessAudioMarkBenchprovenance
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

SSTMark tries to prove that speech watermarking can be far more robust when the watermark is embedded in the linguistic content rather than in the audio waveform. Instead of adding an inaudible signal, it transcribes generated speech, rewrites the transcript with a statistical bias toward certain words, then resynthesizes the speech. Detection later re-transcribes the audio and checks for that same statistical bias. The paper reports that this approach maintains high detection rates across many signal-processing and compression attacks, improving average detection by 4.6% and 16.9% over strong baselines at a fixed 1% false-positive rate. A sympathetic reader would see this as a promising shift from hiding watermarks in fragile acoustic details to anchoring them in semantic content that typically survives distortion.

Core claim

SSTMark's central claim is that watermark information can be bound to the semantic content of generated speech instead of to acoustic features. The pipeline first transcribes pre-generated speech with an ASR model, applies a keyed text-watermarking operator that rewrites tokens to create a statistical bit-1 bias, and then resynthesizes the speech with a TTS model. Detection transcribes the suspect audio again and runs a z-score hypothesis test over the recovered token encodings. The paper reports that this yields average true positive rates of 90.2% across signal-processing edits and 90.0% across compression edits at a 1% false-positive rate, with notably stable performance even under severe

What carries the argument

The keyed binary token encoding rule: each token's watermark bit is computed from a hash of the watermark key, the current token, and the previous token (Eq. 6, Eq. 7). During embedding, tokens with bit-0 are replaced by context-aware synonyms that hash to bit-1, creating a statistical bias. During detection, the same rule recovers the bit assignment from the transcribed text, and a z-score quantifies whether the proportion of bit-1 tokens deviates from 0.5. This keyed rule makes the watermark tied to a shared secret key and to the lexical realization of the content, not to any acoustic pattern.

Load-bearing premise

The entire watermark hinges on the assumption that the ASR-TTS-ASR round trip preserves the specific watermarked tokens well enough for the statistical bit-1 bias to survive any distortion that leaves the speech intelligible.

What would settle it

Take a watermarked speech sample, transcribe it with the same ASR, paraphrase the transcript (even lightly, e.g., replacing synonyms), resynthesize it with the same TTS, and run the SSTMark detector. If the z-score drops below the fixed threshold, the watermark is removable without any acoustic edit.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Watermark detection remains strong under heavy signal processing (e.g., 0 dB Gaussian noise) and aggressive compression (e.g., SoundStream with 4 quantizers), where signal-level watermarks often collapse.
  • Because embedding is training-free and model-agnostic, SSTMark can wrap around any speech generator that produces a transcribable waveform, without access to internal logits or decoder states.
  • Detection works as long as the distorted speech remains intelligible enough for ASR to recover the keyed bit pattern, aligning robustness with semantic preservation rather than waveform fidelity.
  • The watermark key provides a controllable mechanism: the same transcript yields different token patterns under different keys, so detection depends on possession of the shared key.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Paraphrasing the transcript and re-synthesizing it would likely remove the watermark, because the detector relies on exact token-level bit assignments; this attack is a natural stress test that the paper does not run.
  • The approach's dependence on ASR accuracy means that any distortion that systematically alters token choices—not just audio quality—could erase the statistical bias; this is a failure mode distinct from signal-level watermarking.
  • The reported robustness improvements might partly reflect the benchmark's focus on audio-level edits rather than content-level edits; a benchmark including transcript paraphrasing could yield different rankings.
  • If the method scales to shorter utterances, it could enable robust watermarking for conversational AI and voice assistants, where brief responses are common and current signal-level methods degrade.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes SSTMark, a training-free semantic-level speech watermarking framework. Given a generative speech output, it ASR-transcribes the speech, applies a keyed synonym-substitution text watermark (based on Yang et al.) to the transcript, resynthesizes the watermarked transcript with TTS, and detects the watermark by re-transcribing the received speech and computing a z-score over keyed token encodings. The authors evaluate robustness on AudioMarkBench-style perturbations, reporting a 4.6% average TPR improvement over baselines on signal-processing edits and 16.9% on compression/codec edits at 1% FPR, plus fidelity and HSJA adversarial evaluations. They argue that semantic-level watermarking survives strong signal-level distortions because the linguistic content is more stable than acoustic details.

Significance. If the central claims held, SSTMark would be a notable complement to signal-level speech watermarking: it is training-free, requires no access to the generator's internals, is evaluated on an external benchmark with FPR-calibrated thresholds, and includes ablations across STT/TTS backbones. The compression-edit robustness result (16.9% average improvement) is plausible and based on in-range benchmark settings. However, the headline signal-processing result is not an AudioMarkBench result once extra-benchmark strengths are excluded, and the evaluation omits the most natural attack against a semantic watermark. The contribution is therefore significant only conditional on a revised evaluation.

major comments (4)
  1. [Appendix C; Tables 3-4; Abstract] The claimed 4.6% signal-processing improvement is an artifact of mixing non-benchmark settings into the average. Appendix C explicitly states that, in addition to AudioMarkBench settings, the authors include Gaussian noise at 0 dB SNR and low-pass cutoffs at 500/250 Hz, neither of which is in AudioMarkBench's ranges ([5,40] dB and [800,4000] Hz). Tables 3/4 do not flag which columns are official, and the reported 'Avg.' mixes official and extra conditions. Recomputing TPR@FPR=1% over the 11 official signal-processing attacked conditions in Table 3 gives Timbre 90.5% and SSTMark 90.5% (90.47% vs 90.50%), i.e. a tie, not a 4.6% improvement. The abstract's statement that SSTMark 'exhibits the strongest average robustness' on signal-processing edits under AudioMarkBench is therefore not supported. The compression claim (Table 4) uses only in-range settings and is not affected by this issue.
  2. [Sec. 5.3-5.4; threat model] The most direct removal attack against a semantic watermark is absent: ASR the suspect speech, paraphrase the transcript with an LLM, and re-synthesize with TTS. This preserves meaning while destroying the keyed lexical substitutions on which detection depends. The paper only evaluates signal-processing/codec perturbations and a waveform-domain HSJA (Table 5). Because the method's security rests on the survival of specific tokens through the ASR→TTS→ASR roundtrip, the robustness evaluation should include a paraphrase + resynthesis attack, or at minimum a sensitivity analysis of bit-bias under transcript paraphrasing. Without this, the claimed robustness is limited to a threat model that excludes the natural adversary for semantic-level watermarks.
  3. [Sec. 5.1, Tables 3-5] No sample sizes, confidence intervals, or repeated runs are reported for any TPR or fidelity number. With 1,000 calibration samples and a single evaluation set, the differences used for the central claims (e.g., 90.2% vs 85.6% for signal processing, or the official-setting tie after correction) may be within sampling variability. The paper should report the number of test utterances per condition and binomial/Poisson CIs, and ideally multiple seeds or bootstrap intervals. This is necessary to substantiate 'strongest average robustness' when the reported gains are a few percentage points.
  4. [Sec. 4.3; Table 3 no-attack row] The no-attack TPR for SSTMark is only 91.0% at FPR=1% (and 84.7% at FPR=0.1%), while all baselines are at 100% before any attack. This 9% false-negative rate is unexplained and indicates that the core assumption—that the keyed synonym substitutions survive the TTS→ASR roundtrip—fails for a non-negligible fraction of samples. The authors should report token-level survival rates of substituted words, analyze failure cases (e.g., ASR errors or inadequate text length), and discuss whether the 91% no-attack rate imposes an upper bound on robustness. Currently the robustness numbers are averaged over a black-box roundtrip whose reliability is unmeasured.
minor comments (5)
  1. [Fig. 1] The radar chart does not indicate which attack strengths are outside AudioMarkBench; a reader cannot tell that the axes include 0 dB noise and 250-Hz low-pass. Please mark official vs. additional settings.
  2. [Tables 3 and 4 captions] The table averages are over the 14 attacked conditions (excluding no-attack), but this is not stated; clarify in the caption. Also state which columns are official AudioMarkBench settings.
  3. [Eqs. (1) and (6)] The encoding for the first token (i=1) is undefined because x_0 is not defined; state the base case or define the recursion for i=1 separately.
  4. [Table 1] FAD is a distribution-level metric; specify the reference/test sets and sample counts. The near-zero FAD of 0.001 is surprising and should be clarified.
  5. [Sec. 5.1 and Conclusion] The 200-token cap and ~40 s duration mean the evaluation covers only long-form utterances; the conclusion's short-utterance limitation should be tied to the z-score's dependence on N.

Circularity Check

0 steps flagged

No circular derivation: SSTMark's robustness claims are empirical measurements on an external benchmark, not consequences of fitting or self-citation.

full rationale

SSTMark is an empirical composition of existing modules (SpeechGPT, Whisper, CosyVoice, and the text-watermarking operator of Yang et al. [41]) and makes no first-principles derivation whose conclusion is its own premise. The watermark detector in Eq. (3)/(11) is matched to the embedding bias introduced by Eq. (6)-(8), which is how watermarking is defined and is not circular. Detection thresholds are calibrated on clean non-watermarked speech and then held fixed across attack conditions, so the reported TPR values are not fitted to the attacked data. The ablation studies replacing the STT and TTS backbones provide independent support that the result is not an artifact of a single pipeline choice. There are no load-bearing self-citations: the authors do not invoke their own prior theorems or uniqueness results. The paper's central weakness is not circularity but external validity: Appendix C states that 'in addition to the benchmark settings, we further include a few stronger perturbation levels beyond the benchmark range,' and the headline 4.6% signal-processing gain averages conditions outside AudioMarkBench's official ranges; the most direct attack (transcript paraphrasing followed by resynthesis) is not studied, and no error bars are reported. These are legitimate correctness and threat-model concerns, and the conclusion section itself flags the short-utterance limitation, but none of them amounts to a derivation step that reduces the claimed result to its inputs by construction. Under the circularity taxonomy, the appropriate verdict is no significant circularity.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The central claim rests on five main free design choices (tau_word, tau_sent, p0, max token length, watermark key) and four domain assumptions about hash balance, ASR/TTS round-trip fidelity, intelligibility-preserving attacks, and the correctness of the prior text watermarking implementation. No new entities are invented.

free parameters (5)
  • tau_word = 0.7 (default)
    Word-level similarity threshold controlling watermark strength; chosen by hand to trade off fidelity vs. robustness; at 0.7, BERTScore=0.961, BLEU-4=0.588.
  • tau_sent = 0.83
    Sentence-level similarity threshold, adopted fixed from prior work [41].
  • p0 (null proportion) = 0.5
    Assumed balanced bit distribution under the null hypothesis; used in the z-score formula in Eq. (3).
  • max_text_tokens = 200
    Input text length limit for TTS to keep synthesized speech around 40 seconds; a design choice, not fitted.
  • watermark key k = unspecified
    Arbitrary string conditioning the bit assignment; a free parameter but not fitted to data in the paper.
axioms (4)
  • domain assumption The binary encodings b_i = RandomBinary(h(k) XOR h(x_i) XOR h(x_{i-1})) are approximately balanced and independent across tokens in non-watermarked text.
    Sec. 3.2, Eq. (1)-Eq. (3): the null hypothesis of the z-test relies on hash near-uniformity. If violated, FPR calibration breaks.
  • domain assumption The ASR and TTS models form a sufficiently faithful round trip so that A(T(W(A(s_pre)))) retains the bit-1 bias.
    Sec. 4.2-4.3: the watermark is detected on ASR output; if ASR errors systematically change the chosen tokens, the watermark is lost.
  • domain assumption AudioMarkBench attacks preserve intelligibility, so the semantic content—and hence the specific lexical tokens—is recoverable.
    Sec. 1.2 motivation: this is the premise that makes semantic watermarking robust by construction, and it explicitly excludes paraphrase/re-synthesis attacks.
  • domain assumption The text watermarking implementation from Yang et al. [41] works as described, including BERT-based synonym generation and filtering with thresholds tau_sent and tau_word.
    Sec. 3.2: the pipeline reuses [41] as a black box; no code or exact implementation details are provided.

pith-pipeline@v1.3.0-alltime-deepseek · 20300 in / 13086 out tokens · 129782 ms · 2026-08-01T17:32:49.435260+00:00 · methodology

0 comments
read the original abstract

As speech generation models become increasingly realistic and widely accessible, concerns about the misuse, attribution, and governance of synthetic speech continue to grow. Watermarking provides a practical way to make synthesized speech traceable and verifiable. Most existing speech watermarking methods embed watermark information into signal-level representations, such as waveforms or spectrograms. Under sufficiently strong distortions, the embedded watermark may be weakened or destroyed, leading to degraded detectability. In this paper, we propose SSTMark, a training-free speech watermarking framework that operates at the semantic level through text watermarking. Unlike conventional signal-level watermarking methods, SSTMark encodes watermark information into the semantic content conveyed by generated speech, and detects the watermark from the recovered linguistic content. Experiments on AudioMarkBench demonstrate that SSTMark exhibits the strongest average robustness. Compared with the state-of-the-art baselines at a fixed false positive rate of 1\%, SSTMark improves the average detection rate by 4.6\% and 16.9\% on signal-processing edits and compression edits, respectively.

Figures

Figures reproduced from arXiv: 2607.17592 by Chun-Shien Lu, Jun-Cheng Chen, Kuan-Lin Chu.

Figure 1
Figure 1. Figure 1: Robustness comparison under AudioMarkBench [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: We first provide an overview of the proposed method, and [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of SSTMark. Given a prompt text [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

49 extracted references · 7 linked inside Pith

  1. [1]

    Edresson Casanova, Kelly Davis, Eren Gölge, Görkem Göknar, Iulian Gulea, Logan Hart, Aya Aljafari, Joshua Meyer, Reuben Morais, Samuel Olayemi, et al

  2. [2]

    Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. 2023. Wavmark: Watermarking for audio generation.arXiv preprint arXiv:2308.12770 (2023)

    Pith/arXiv arXiv 2023

  3. [3]

    Jianbo Chen, Michael I Jordan, and Martin J Wainwright. 2020. Hopskipjumpat- tack: A query-efficient decision-based attack. In2020 ieee symposium on security and privacy (sp). IEEE, 1277–1294

    2020

  4. [4]

    Sanyuan Chen, Shujie Liu, Long Zhou, Yanqing Liu, Xu Tan, Jinyu Li, Sheng Zhao, Yao Qian, and Furu Wei. 2024. Vall-e 2: Neural codec language models are human parity zero-shot text to speech synthesizers.arXiv preprint arXiv:2406.05370 (2024)

    Pith/arXiv arXiv 2024

  5. [5]

    Sanyuan Chen, Chengyi Wang, Zhengyang Chen, Yu Wu, Shujie Liu, Zhuo Chen, Jinyu Li, Naoyuki Kanda, Takuya Yoshioka, Xiong Xiao, et al . 2022. Wavlm: Large-scale self-supervised pre-training for full stack speech processing.IEEE Journal of Selected Topics in Signal Processing16, 6 (2022), 1505–1518

    2022

  6. [6]

    Sanyuan Chen, Chengyi Wang, Yu Wu, Ziqiang Zhang, Long Zhou, Shujie Liu, Zhuo Chen, Yanqing Liu, Huaming Wang, Jinyu Li, Lei He, Sheng Zhao, and Furu Wei. 2025. Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers.IEEE Transactions on Audio, Speech and Language Processing33 (2025), 705–718. doi:10.1109/TASLPRO.2025.3530270

    arXiv 2025

  7. [7]

    Yushen Chen, Zhikang Niu, Ziyang Ma, Keqi Deng, Chunhui Wang, JianZhao JianZhao, Kai Yu, and Xie Chen. 2025. F5-tts: A fairytaler that fakes fluent and faithful speech with flow matching. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 6255–6271

    2025

  8. [8]

    Alexandre Défossez, Jade Copet, Gabriel Synnaeve, and Yossi Adi. 2022. High Fidelity Neural Audio Compression.Transactions on Machine Learning Research (2022)

    2022

  9. [9]

    Zhihao Du, Qian Chen, Shiliang Zhang, Kai Hu, Heng Lu, Yexin Yang, Hangrui Hu, Siqi Zheng, Yue Gu, Ziyang Ma, et al. 2024. Cosyvoice: A scalable multilingual zero-shot text-to-speech synthesizer based on supervised semantic tokens.arXiv preprint arXiv:2407.05407(2024)

    Pith/arXiv arXiv 2024

  10. [10]

    2025.AI scammer posing as Marco Rubio targets officials in growing threat

    Joseph Gedeon. 2025.AI scammer posing as Marco Rubio targets officials in growing threat. The Guardian. https://www.theguardian.com/us-news/2025/jul/ 08/marco-rubio-ai-impostor

    2025

  11. [11]

    Anmol Gulati, James Qin, Chung-Cheng Chiu, Niki Parmar, Yu Zhang, Jiahui Yu, Wei Han, Shibo Wang, Zhengdong Zhang, Yonghui Wu, et al. 2020. Conformer: Convolution-augmented Transformer for Speech Recognition. InProc. Interspeech

    2020

  12. [12]

    Yinlin Guo, Haofan Huang, Xi Chen, He Zhao, and Yuehai Wang. 2024. Audio deepfake detection with self-supervised wavlm and multi-fusion attentive classi- fier. InICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 12702–12706

    2024

  13. [13]

    Jifei Hao, Jipeng Qiang, Yi Zhu, Yun Li, Yunhao Yuan, and Xiaoye Ouyang. 2025. Post-hoc watermarking for robust detection in text generated by large language models. InProceedings of the 31st International Conference on Computational Linguistics. 5430–5442

    2025

  14. [14]

    Wei-Ning Hsu, Benjamin Bolte, Yao-Hung Hubert Tsai, Kushal Lakhotia, Rus- lan Salakhutdinov, and Abdelrahman Mohamed. 2021. Hubert: Self-supervised speech representation learning by masked prediction of hidden units.IEEE/ACM transactions on audio, speech, and language processing29 (2021), 3451–3460

    2021

  15. [15]

    Shengpeng Ji, Ziyue Jiang, Jialong Zuo, Minghui Fang, Yifu Chen, Tao Jin, and Zhou Zhao. 2025. Speech watermarking with discrete intermediate represen- tations. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 24239–24247

    2025

  16. [16]

    2025.AI Deepfake Scams Surge: Over $200 Million Lost

    Connor Jones. 2025.AI Deepfake Scams Surge: Over $200 Million Lost. eSecurity Planet. https://www.esecurityplanet.com/news/ai-deepfakes-surge-200-million- lost/

    2025

  17. [17]

    Jee-weon Jung, Hee-Soo Heo, Hemlata Tak, Hye-jin Shim, Joon Son Chung, Bong- Jin Lee, Ha-Jin Yu, and Nicholas Evans. 2022. Aasist: Audio anti-spoofing using integrated spectro-temporal graph attention networks. InICASSP 2022-2022 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 6367–6371

    2022

  18. [18]

    Gregory Kang Ruey Lau, Xinyuan Niu, Hieu Dao, Jiangwei Chen, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. 2024. Waterfall: Scalable framework for robust text watermarking and provenance for llms. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 20432–20466

    2024

  19. [19]

    Menglu Li, Yasaman Ahmadiadli, and Xiao-Ping Zhang. 2024. Audio anti-spoofing detection: A survey.arXiv e-prints(2024), arXiv–2404

    2024

  20. [20]

    Menglu Li, Yasaman Ahmadiadli, and Xiao-Ping Zhang. 2025. A survey on speech deepfake detection.Comput. Surveys57, 7 (2025), 1–38

    2025

  21. [21]

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024. A Survey of Text Watermarking in the Era of Large Language Models.ACM Comput. Surv.57, 2, Article 47 (Nov. 2024), 36 pages. doi:10.1145/3691626

    doi:10.1145/3691626 2024

  22. [22]

    Chang Liu, Jie Zhang, Tianwei Zhang, Xi Yang, Weiming Zhang, and Nenghai Yu

  23. [23]

    Hongbin Liu, Moyang Guo, Zhengyuan Jiang, Lun Wang, and Neil Z Gong. 2024. Audiomarkbench: Benchmarking robustness of audio watermarking.Advances in Neural Information Processing Systems37 (2024), 52241–52265

    2024

  24. [24]

    InThe 31th Network and Distributed System Security (NDSS) Symposium 2024

    Detecting Voice Cloning Attacks via Timbre Watermarking. InThe 31th Network and Distributed System Security (NDSS) Symposium 2024

    2024

  25. [25]

    Xuechen Liu, Xin Wang, Md Sahidullah, Jose Patino, Héctor Delgado, Tomi Kinnunen, Massimiliano Todisco, Junichi Yamagishi, Nicholas Evans, Andreas Nautsch, et al . 2023. Asvspoof 2021: Towards spoofed and deepfake speech detection in the wild.IEEE/ACM Transactions on Audio, Speech, and Language Processing31 (2023), 2507–2522

    2023

  26. [26]

    Weizhi Liu, Yue Li, Dongdong Lin, Hui Tian, and Haizhou Li. 2024. Groot: Generating robust watermark for diffusion-model-based audio synthesis. In Proceedings of the 32nd ACM International Conference on Multimedia. 3294–3302

    2024

  27. [27]

    2025.Dover woman loses $15K after scammers used artificial intelligence to impersonate daughter

    Aaron Mesmer. 2025.Dover woman loses $15K after scammers used artificial intelligence to impersonate daughter. FOX 13 News. https://www.fox13news.com/news/dover-woman-loses-15k-after-scammers- used-artificial-intelligence-impersonate-daughter

    2025

  28. [28]

    Yixin Liu, Lie Lu, Jihui Jin, Lichao Sun, and Andrea Fanelli. 2025. Xattn- mark: Learning robust audio watermarking with cross-attention.arXiv preprint arXiv:2502.04230(2025)

    Pith/arXiv arXiv 2025

  29. [29]

    Patrick O’Reilly, Zeyu Jin, Jiaqi Su, and Bryan Pardo. 2025. Deep Audio Wa- termarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. InThe 1st Workshop on GenAI Watermarking

    2025

  30. [30]

    Tu Anh Nguyen, Benjamin Muller, Bokai Yu, Marta R Costa-Jussa, Maha Elbayad, Sravya Popuri, Christophe Ropers, Paul-Ambroise Duquenne, Robin Algayres, Ruslan Mavlyutov, et al. 2025. Spirit-lm: Interleaved spoken and written language model.Transactions of the Association for Computational Linguistics13 (2025), 30–52

    2025

  31. [31]

    Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. Bleu: a method for automatic evaluation of machine translation. InProceedings of the 40th annual meeting of the Association for Computational Linguistics. 311–318

    2002

  32. [32]

    Vassil Panayotov, Guoguo Chen, Daniel Povey, and Sanjeev Khudanpur. 2015. Librispeech: an asr corpus based on public domain audio books. In2015 IEEE international conference on acoustics, speech and signal processing (ICASSP). IEEE, 5206–5210

    2015

  33. [33]

    Dominik Roblek, Kevin Kilgour, Matt Sharifi, and Mauricio Zuluaga. 2019. Fr\’echet Audio Distance: A Reference-free Metric for Evaluating Music En- hancement Algorithms. InProc. Interspeech. 2350–2354

    2019

  34. [34]

    Alec Radford, Jong Wook Kim, Tao Xu, Greg Brockman, Christine McLeavey, and Ilya Sutskever. 2023. Robust speech recognition via large-scale weak supervision. InInternational conference on machine learning. PMLR, 28492–28518

    2023

  35. [35]

    Jean-Marc Valin, Gregory Maxwell, Timothy B Terriberry, and Koen Vos. 2016. High-quality, low-delay music coding in the opus codec.arXiv preprint arXiv:1602.04845(2016)

    Pith/arXiv arXiv 2016

  36. [36]

    Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre Défossez, Teddy Furon, and Tuan Tran. 2024. Proactive Detection of Voice Cloning with Localized Watermarking. InICML 2024-41st International Conference on Machine Learning, Vol. 235. 1–17

    2024

  37. [37]

    Stefan Westerfeld. 2020. audiowmark: Audio Watermarking. https://github.com/ swesterfeld/audiowmark. Accessed: 2025-01-02

    2020

  38. [38]

    Yuhao Wang, Heyang Liu, Ziyang Cheng, Ronghua Wu, Qunshan Gu, Yanfeng Wang, and Yu Wang. 2025. VocalNet: Speech LLMs with Multi-Token Prediction for Faster and High-Quality Generation. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 19595–19612

    2025

  39. [39]

    Yihan Wu, Georgios Milis, Ruibo Chen, and Heng Huang. 2025. Robust Distortion- Free Watermark for Autoregressive Audio Generation Models. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems

    2025

  40. [40]

    Yihan Wu, Ruibo Chen, Georgios Milis, Junfeng Guo, and Heng Huang. 2025. A watermark for auto-regressive speech generation models.Proc. Interspeech 2025 (2025), 3474–3478

    2025

  41. [41]

    Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. 2023. Watermarking text generated by black-box language models.arXiv preprint arXiv:2305.08883(2023)

    Pith/arXiv arXiv 2023

  42. [42]

    Xiaojun Xu, Jinghan Jia, Yuanshun Yao, Yang Liu, and Hang Li. 2025. Robust Multi- bit Text Watermark with LLM-based Paraphrasers. InForty-second International Conference on Machine Learning. https://openreview.net/forum?id=DVjkling5x

    2025

  43. [43]

    Neil Zeghidour, Alejandro Luebs, Ahmed Omran, Jan Skoglund, and Marco Tagliasacchi. 2021. Soundstream: An end-to-end neural audio codec.IEEE/ACM Transactions on Audio, Speech, and Language Processing30 (2021), 495–507

    2021

  44. [44]

    KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. 2023. Robust multi-bit natural language watermarking through invariant features. InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2092–2115

    2023

  45. [45]

    2024.{REMARK-LLM}: A robust and efficient watermarking framework for generative large language models

    Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushan- far. 2024.{REMARK-LLM}: A robust and efficient watermarking framework for generative large language models. In33rd USENIX Security Symposium (USENIX Security 24). 1813–1830

    2024

  46. [46]

    Dong Zhang, Shimin Li, Xin Zhang, Jun Zhan, Pengyu Wang, Yaqian Zhou, and Xipeng Qiu. 2023. Speechgpt: Empowering large language models with intrinsic cross-modal conversational abilities. InFindings of the Association for SSTMark: Robust Training-Free Semantic-Level Speech Watermarking Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Computational...

    2023

  47. [47]

    Canary-1B-v2 & Parakeet- TDT-0.6B-v3: Efficient and High-Performance Models for Multilingual ASR and AST

    Wei Zong, Yang-Wai Chow, Willy Susilo, Joonsang Baek, and Seyit Camtepe. 2025.{AudioMarkNet}: Audio watermarking for deepfake speech detection. In 34th USENIX Security Symposium (USENIX Security 25). 4663–4682. Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Kuan-Lin Chu, Jun-Cheng Chen, and Chun-Shien Lu A Pseudocode for SSTMark Algorithm 1 summa...

    arXiv 2025

  48. [48]

    Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. 2019. Bertscore: Evaluating text generation with bert.arXiv preprint arXiv:1904.09675(2019)

    Pith/arXiv arXiv 2019

  49. [2024]

    XTTS: a Massively Multilingual Zero-Shot Text-to-Speech Model. InProc. Interspeech 2024. 4978–4982

    2024