Contents
Voice watermarks are reliable as a deterrent against a casual user and unreliable as proof against a motivated remover, and that two-sided verdict is what the peer-reviewed record on speech watermarking supports. Reliability here has two separate requirements: the mark must survive the real handling a voice clip gets, and the detector must not fire on speech that was never watermarked. Current schemes can meet the first inside a narrow envelope and cannot guarantee it against an adversary who optimises against them, which is why “reliable” turns out to be a statement about who the adversary is rather than a fixed property of the mark.
Why measurement came first
For years each speech-watermark paper reported robustness on its own terms, which made cross-scheme reliability claims unstable. AudioMarkBench is the correction: it calls itself “the first systematic benchmark for evaluating the robustness of audio watermarking against watermark removal and watermark forgery” (Liu, Guo and Jiang, NeurIPS 2024), draws its speech from Common Voice “across languages, biological sexes, and ages,” and runs each method through fifteen types of perturbation at three levels of attacker knowledge, no-box, black-box and white-box. Standardised that way, a clear boundary appears between the distortions a mark shrugs off and the attacks that define its ceiling.
The envelope where they hold
Inside casual handling, the numbers are genuinely good. AudioSeal is “the first audio watermarking technique designed specifically for localized detection of AI-generated speech” (San Roman, Fernandez and Elsahar, ICML 2024). It survives classical MP3 compression inside its training envelope, its detector resolves the mark to 1/16000 second so it can say not just whether but where a clip is watermarked, and its multi-bit payload can attribute a clip “to one model among 1,000.” Its single-pass detector runs up to two orders of magnitude faster than earlier methods, which is what makes population-scale checking practical. For a voice clip that is uploaded, streamed and re-saved as an ordinary MP3, a mark of this generation is a reliable signal.
The envelope where they break
The envelope ends where a motivated remover begins, and it ends the same way for every current speech mark. Overwriting is the first ceiling: Yao, Huang and Wang (AAAI 2026) re-embed a fresh mark over the original and report reaching a “nearly 100% attack success rate” across white-box, gray-box and black-box settings in their own tests, concluding that keeping the model secret provides no security. Neural re-synthesis is the second: a round-trip through a neural codec such as EnCodec or DAC pushes AudioSeal’s bit-error rate to 98% or higher (Liu, Guo and Jiang, NeurIPS 2024), which is erasure, not degradation. And the removal is not tied to knowing the scheme, because O’Reilly, Pardo and Jin (ICLR 2025 Workshop) report stripping state-of-the-art post-hoc speech watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality.” These removal figures are each the source paper’s own reported result, not independently replicated. A reliability claim for a voice mark is therefore only as strong as the worst of these operations it might face.
The voice-specific edge
Speech has one reliability axis that other media do not, because a voice can be cloned, and cloning re-synthesises it from scratch. TimbreWatermarking (Liu, Zhang and Zhang, NDSS 2024) survives fine-tuned voice cloning but drops toward random under zero-shot cloning, and VoiceMark (Li, Wu and Xie, Interspeech 2025) was introduced as the first zero-shot voice-cloning-resistant speech watermark precisely because it holds where the earlier schemes collapse. Capacity is a further constraint on how much a voice mark can promise: WavMark encodes “up to 32 bits of watermark within a mere 1-second audio snippet” (Chen, Wu and Liu, 2023), but its synchronization pattern accounts for 31% of the total capacity and it cannot be used on spans shorter than one second. For a voice mark, then, reliability is not one boundary but several: the removal ceiling, the cloning of the voice it protects, and the clip length it needs to carry a payload at all.
The second requirement, and fairness
Survival is only half of reliability; the detector must also stay quiet on speech that never carried a mark. AudioMarkBench measures not only removal but forgery, and the forgery direction is the more damaging failure for trust, because a detector that can be made to fire on clean speech makes even a positive result questionable. Forgery is harder to put a single number on, so the reading keeps it qualitative rather than inflating it into a statistic; what the benchmark establishes is that a reliable voice mark must resist both false negatives, where a real mark disappears, and false positives, where unmarked speech is made to look marked. The benchmark also surfaces a dimension the headline numbers hide: because its speech spans languages, sexes and ages, it can ask whether a mark is equally robust for every kind of speaker, and it closes by calling for “more robust and fair audio watermarking solutions,” naming fairness as an open problem. So a single average detection rate can hide real variation between speakers, and for voice, where accents, age and recording conditions vary, the fairness caveat is not cosmetic.
What “reliable” actually means
The conclusion is that reliability is not one number. A voice watermark is reliable enough to flag AI speech and to deter at population scale, and unreliable as courtroom-grade proof against anyone willing to spend an hour, a GPU, or a cloning model. A present, verified mark is real evidence that a specific scheme processed the audio; an absent mark is close to neutral, because the speech may never have been marked, may have been re-synthesised, or may have been overwritten. Whether a given voice mark can actually be stripped, rather than trusted, is the companion question in can voice watermarks be removed?. If your goal is the reverse, keeping your own voice from being traced back to you, see does removing an audio watermark work?.
Sources
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Liu, Zhang, Zhang (2024). Detecting Voice Cloning Attacks via Timbre Watermarking. NDSS.
- Li, Wu, Xie (2025). VoiceMark: Zero-Shot Voice Cloning-Resistant Speech Watermarking. Interspeech.