Neural watermarks in audio are small, hidden signals embedded to verify ownership and authenticity. But compression, especially neural codecs, often erases these marks, making them hard to detect. This creates challenges for industries relying on watermarks to protect audio content. Key findings include:
- Compression Effects: Lossy compression (e.g., MP3, AAC) removes subtle details, impacting watermark durability. Neural codecs like EnCodec and SpeechTokenizer are even more disruptive.
- Performance Variations: Systems like WMCodec maintain high accuracy (99% at 6 kbps), while others fail under neural compression.
- New Solutions: Latent-space embedding and cross-codec optimization help watermarks survive compression. AI-based methods improve resilience by training systems to handle various compression artifacts.
- Business Tools: Platforms like ScoreDetect combine watermarking with blockchain for ownership proof and content protection.
The future of watermarking lies in methods designed for compression-resistant durability, ensuring audio assets remain protected in evolving digital landscapes.
How Audio Compression Affects Neural Watermarks
Common Audio Compression Methods
To understand how neural watermarks hold up under compression, it’s important to first grasp the basics of audio compression. There are two main types: lossless and lossy. Lossless compression keeps every detail of the original audio intact, though it only reduces file size slightly. On the other hand, lossy compression removes audio data that’s deemed less noticeable to human ears, resulting in much smaller file sizes.
Traditional lossy codecs like MP3 and AAC work by cutting out less perceptible audio elements – such as high-frequency details and subtle temporal variations [4]. Neural codecs, such as EnCodec and DAC, take a different approach. They compress audio by converting it into quantized latent spaces through vector-quantization layers. Since these methods don’t follow fixed frequency-based rules, they can degrade watermark signals inconsistently [4]. Meanwhile, speech tokenizers used in large language models simplify audio into discrete units and then completely resynthesize it. This process wipes out the fine spectral details that watermark detection relies on [4].
Watermark Performance Across Codecs and Bitrates
The effectiveness of neural watermarks can vary greatly depending on the type of compression and bitrate. For example, under MP3 compression, the AudioSeal system’s detection accuracy dropped to an Area Under the Curve (AUC) of 0.84. In contrast, the PerTh (Perceptual-Threshold) system managed to maintain flawless detection with an AUC of 1.00 [4].
Interestingly, the WMCodec framework – which integrates compression and watermarking during training – achieved over 99% extraction accuracy even at extremely low bitrates like 6 kbps, handling a watermark capacity of 16 bits per second [2]. However, speech tokenizer attacks pose a much tougher challenge. For some single-watermark systems, these attacks reduced detectability to an AUC of 0.50, which is no better than random guessing [4]. This highlights a major hurdle for verifying content in scenarios where advanced AI-based audio processing is widespread. This underscores the importance of robust AI content protection strategies. These codec-specific effects underline the need for ongoing research into making durable watermarking solutions more resilient to compression.
sbb-itb-738ac1e
Recent Research on Watermark Durability
RAW-Bench Framework Study (2025)
Recent research sheds light on the challenges neural codecs present for watermark durability. Özer et al.’s RAW-Bench framework set a benchmark for testing watermark resilience under practical conditions. The study highlighted neural codec re-synthesis and quantization as the most significant obstacles to maintaining watermark bit-string integrity. Unlike psychoacoustic audio watermarking and traditional compression methods, which remove masked frequencies, neural codecs tend to discard subtle watermark details. The researchers emphasized that watermarks must endure "a range of studio manipulations and background noise." While many techniques hold up well against conventional DSP attacks like MP3 compression or bandpass filtering, they often fail completely after a single pass through a neural codec. These findings have driven a shift away from traditional waveform-level noise injection toward latent-aware methods. By embedding marks within a codec’s invariant latent space, these strategies address the core issue of preserving watermark integrity under compression [5].
Latent-Mark and Neural Resynthesis (2026)
In 2026, researchers at National Taiwan University developed the Latent-Mark framework, the first zero-bit audio watermarking system designed to survive semantic compression. Instead of embedding watermarks at the waveform level, Latent-Mark integrates them into a codec’s invariant latent space. This approach uses a directional latent shift to create detectable changes in the encoded representation – changes that codecs are built to retain. To improve durability across various codecs, including those that are proprietary or unknown, the system uses cross-codec optimization. This technique jointly optimizes the watermark across multiple surrogate codecs, addressing quantization bottlenecks and enabling zero-shot transferability. As a result, the watermark can withstand black-box neural resynthesis processing [3][5]. This adaptability under compression represents a significant step forward in ensuring watermark resilience across diverse environments, opening the door for further advancements in this field.
Deep Audio Watermarks Under Codec Pressure (2024)
Zhou et al.’s 2024 WMCodec study adopted an end-to-end approach by jointly training compression and watermark embedding/extraction systems. Operating at a low bitrate of 6 kbps with a watermark capacity of 16 bits per second, WMCodec achieved extraction accuracies of over 99% in common attack scenarios [2]. The introduction of an Attention Imprint Unit (AIU) played a key role in reducing quantization noise during compression. The study noted:
WMCodec outperforms AudioSeal with Encodec in most quality metrics for watermark imperceptibility and consistently exceeds both AudioSeal with Encodec and reinforced TraceableSpeech in extraction accuracy [2].
This integrated approach demonstrates how combining compression and watermarking processes can maintain watermark integrity, even under intense compression conditions.
Neural Codec Performance Comparison
Neural Watermark Detection Rates Across Audio Compression Codecs
Neural codecs differ significantly in their ability to preserve watermarks, largely due to variations in quantization, latent representation, and semantic filtering techniques.
SpeechTokenizer is the most disruptive codec in this regard. By converting audio into discrete linguistic units, it removes the spectral details essential for watermark detection and copyright enforcement. Tests conducted on the LibriSpeech dataset revealed that under SpeechTokenizer compression, AudioSeal’s True Positive Rate (TPR) dropped to a shocking 0.00, while PerTh managed only a TPR of 0.14. This essentially renders watermarking ineffective with this codec, underscoring the unique challenges posed by such transformations [4].
On the other hand, the Descript Audio Codec (DAC) emerged as the best performer for watermark preservation. Both AudioSeal and PerTh achieved a perfect Area Under Curve (AUC) score of 1.00 when tested under DAC compression. EnCodec ranked in the middle, with AudioSeal recording an AUC and TPR@0.05 of 0.99, while PerTh showed slightly lower values at 0.96 for both metrics. Traditional MP3 compression, however, proved more damaging in some cases. For instance, AudioSeal’s TPR@0.05 fell to 0.66 under MP3, compared to 0.99 under EnCodec compression [4].
Detection Rate Comparison Table
| Codec/Attack | AudioSeal (AUC / TPR@0.05) | PerTh (AUC / TPR@0.05) | Impact Level |
|---|---|---|---|
| Descript Audio Codec (DAC) | 1.00 / 1.00 | 1.00 / 1.00 | Low |
| EnCodec | 0.99 / 0.99 | 0.96 / 0.96 | Moderate |
| Opus | 0.98 / 0.91 | 1.00 / 1.00 | Low |
| MP3 Compression | 0.84 / 0.66 | 1.00 / 1.00 | Variable |
| SpeechTokenizer | 0.50 / 0.00 | 0.77 / 0.14 | Critical |
These results are based on evaluations using the LibriSpeech test-clean dataset [4].
In general, codecs leveraging Residual Vector Quantization (RVQ), such as EnCodec and DAC, tend to degrade watermarks less severely than speech tokenizers. However, the level of degradation still varies depending on the watermarking method. For example, AudioSeal tends to perform better under EnCodec compression, while PerTh demonstrates greater durability against MP3 and Opus compression [4].
New Methods for Compression-Resistant Watermarks
Researchers are exploring innovative ways to embed watermarks in latent spaces that remain stable, even after neural codec filtering. These approaches directly address the challenges of compression, pushing watermark durability to new levels.
Adaptive Watermarking Methods
The Latent-Mark framework, introduced in March 2026 by National Taiwan University and CyCraft AI Lab, has redefined adaptive watermarking. Instead of relying on chance for a watermark to survive compression, this method uses Cross-Codec Optimization to fine-tune audio signals across multiple surrogate codecs simultaneously. By testing against various codec architectures, the system identifies stable semantic structures that persist no matter which codec processes the audio signal [5].
"Robustness to the encode-decode process requires embedding the watermark within the codec’s invariant latent space." – Latent-Mark Research Team
The process involves iterative gradient adjustments to the audio waveform, aligning its latent representation along a secret axis. Detection systems can later identify this alignment. To ensure the watermark withstands quantization effects during compression, the framework targets an alignment score of 1.5, providing a safety buffer [5]. Unlike older techniques, these adaptive methods actively address the issues caused by compression artifacts.
AI-Based Watermark Design
AI-driven approaches are taking watermark resilience to the next level. Using adversarial training, these systems incorporate resilience directly into the watermark design. During training, neural networks are exposed to a wide range of compression artifacts – such as those from MP3, Opus, EnCodec, and other neural codecs – enabling the encoder to create watermarks that can withstand these degradations [7].
The most advanced designs leverage invertible neural networks with balancing blocks. These networks can reverse the watermark embedding even after heavy compression, ensuring accurate extraction [6]. Detection processes now use ensemble methods, analyzing multiple codec outputs to improve reliability [5]. These advancements are particularly valuable for businesses managing large-scale audio assets, offering stronger IP copyright protection for digital content.
Business Impact of Audio Watermarking Research
The challenges posed by modern compression methods directly threaten the legal and financial safeguards businesses rely on. When neural codecs strip away watermark details during compression, companies risk losing critical proof of ownership for audio assets that often represent valuable intellectual property. To counteract this, businesses must adopt integrated protection strategies that account for the realities of today’s compression technologies.
Using ScoreDetect for Audio Content Protection
ScoreDetect offers a comprehensive solution to safeguard audio assets. By combining invisible watermarking with blockchain verification, it provides proof of ownership without compromising audio quality. This system also uses web scraping to identify unauthorized use with a 95% success rate and employs automated delisting processes to achieve a 96% takedown rate. For organizations managing extensive audio libraries – such as media companies, creators, or educational institutions – this approach addresses the dual needs of compression-resistant watermarking and legal ownership verification.
The platform’s Enterprise plan introduces a blockchain component that records a checksum of the audio content rather than storing the file itself. This creates an immutable timestamp to establish ownership. This aligns with recent advancements in research, which suggest that training compression and watermarking systems together, rather than separately, yields better outcomes. For instance, WMCodec, developed by Junzuo Zhou’s team at the Chinese Academy of Sciences in December 2024, achieved an impressive 99% detection accuracy at 6 kbps through end-to-end neural training [2]. This method not only strengthens ownership claims but also sets a higher benchmark for protecting digital assets.
Emerging Developments in Audio Security
The integration of neural codec technology with watermarking is reshaping how audio protection is approached. Researchers are now embedding authenticity verification directly into the compression process, ensuring watermarks remain intact during encoding and decoding. This shift makes protection an inherent part of the system rather than an afterthought.
Cross-codec optimization is particularly valuable for businesses distributing audio across various platforms. These techniques ensure watermarks are detectable even after processing by unknown or proprietary codecs, reducing the need for re-watermarking and cutting operational costs. A significant advancement in this area is the RAW-Bench framework, introduced by Sony AI researchers Yigitcan Özer and Yuki Mitsufuji in May 2025. This framework provides standardized testing against 20 different real-world distortions, helping businesses evaluate watermarking solutions systematically [1]. With such rigorous benchmarking, companies can choose technologies that best withstand the compression challenges their content faces during distribution.
Conclusion
Audio compression poses a serious challenge to the integrity of neural watermarks. Advanced neural codecs like EnCodec and SNAC don’t just reduce audio quality – they completely reconstruct it using semantic tokens. Researchers from National Taiwan University highlighted this issue, stating:
Existing watermarks that are highly robust to DSP transformations can fail catastrophically after a single codec pass [5].
This creates an urgent need for businesses to rethink their protection strategies.
Emerging techniques like latent-space embedding and cross-codec optimization offer promising solutions. These approaches allow watermarks to survive the severe alterations caused by neural compression. For example, frameworks such as WMCodec have demonstrated impressive results, achieving over 99% extraction accuracy even at a low bitrate of 6 kbps [2]. Such advancements provide a clear direction for businesses looking to safeguard their audio content.
One effective strategy is integrating these cutting-edge techniques with broader protection systems. ScoreDetect exemplifies this by combining blockchain verification with advanced watermarking methods, achieving a 95% detection rate and a 96% takedown rate. This dual approach ensures both technical resilience against neural compression and the legal proof required for copyright enforcement.
To stay ahead, businesses must design watermarks with compression challenges in mind, adopting latent-space embedding and cross-codec optimization from the start. The key to future-proofing audio protection lies in tools that address both the technical hurdles of neural codecs and the legal complexities of copyright. By leveraging these innovations, organizations can confidently protect their audio assets in today’s demanding digital environment.
FAQs
Why do neural codecs break audio watermarks more than MP3 or AAC?
Neural codecs are more effective at breaking audio watermarks compared to formats like MP3 or AAC because they function as semantic filters. These codecs discard subtle waveform variations that traditional watermarking relies on. While MP3 and AAC retain certain features of the audio signal, neural codecs convert the waveform into a latent space, stripping away imperceptible details that are essential for detecting watermarks. As a result, even distortion-aware training methods struggle to maintain watermark effectiveness with neural codecs.
Which watermarking method withstands low-bitrate compression best?
Latent-Mark excels in handling low-bitrate compression by embedding watermarks within the codec’s invariant latent space. This technique fine-tunes the waveform to produce detectable changes in encoded representations, all while keeping the watermark invisible to the human ear and resilient across different codecs.
How can watermarks remain detectable after unknown or proprietary codecs?
Recent research highlights the difficulty of preserving watermark detectability when dealing with unknown or proprietary codecs. Neural codecs, in particular, tend to strip away traditional watermarks during compression. To address this, advanced techniques like Latent-Mark embed watermarks directly into the codec’s latent space, making them more resilient. Another approach, AlignMark, synchronizes watermark embedding with audio content by leveraging spectral masking and perceptual losses. This alignment boosts resistance to neural transformations such as denoising and spectral distortions. These methods represent significant progress in making watermarks more durable for digital content protection.
