Frozen audio watermarkers boosted with learned decoders for better message recovery
No Time to Collapse: Unlocking Robustness and Multiplexed Capacity in Frozen Audio Watermarkers
Sound
Summary
Watermarking audio means hiding secret messages inside sounds so they can be detected later. Usually, these systems repeat messages over time and then combine all the clues into one final message, which can weaken the ability to recover the message accurately. The authors show that by keeping the original watermark system fixed and training a new small part to better interpret all the clues together, they can recover hidden messages more reliably and even get multiple messages back from the same audio. This improves performance on tests with attacks that distort the audio.
What this means in practice
- •For audio software engineers: Build watermarking tools that recover hidden audio messages more reliably under signal distortions and attacks.
- •For digital rights managers: Use improved decoding to detect multiple embedded ownership marks in audio tracks even after partial damage or editing.
Authors
Xuanye Wang, Linxi Li, Yechen Wang, Liwei Jin, Qianwei Guo, Carsten Maple
Abstract
Modern neural audio watermarking systems typically embed a message repeatedly across time and then collapse the resulting temporal evidence into a single payload using averaging, voting, or another fixed aggregation rule. We argue that this temporal collapse limits both robustness and the recovery of multiple payloads, and that the limitation can be addressed without retraining the underlying watermarker. We freeze a pretrained watermarker's encoder and detector and train only a low-latency Conformer-based decoder. The decoder consumes the detector's temporal soft outputs, which a system-specific adapter pools into a sequence of window-level representations, and predicts the embedded message. On three frozen watermarkers (AURA, AudioSeal, and WavMark), the learned decoder improves recovery of attacked messages and yields higher detection AUROC point estimates on all three. Under controlled full- and partial-coverage multiplexing, it improves joint-exact recovery of two alternating payload words by 9.7-48.0, 6.9-17.3, and 8.2-14.2 percentage points, respectively, under one to three chained attacks on feasible clips.