Contents
Yes. A motivated adversary can remove a music watermark, even though the marks designed for music ride cleanly through the compression and streaming a track normally passes through. This article reviews removability as a reliability property for watermarks on distributed music. It is not a removal guide. Here the only question is what the literature proves about how durable a music mark is. The useful split is not “works” or “does not work.” It is whether the mark is facing routine handling, like MP3 or Ogg conversion, or an active removal operation, like overwriting or neural re-synthesis.
What music marks are built to survive
Music watermarking is not just speech watermarking at a different label. It has a specific technical bar to clear, because distributed music runs at a 44.1 kHz sampling rate and passes through lossy compression as a matter of course. SilentCipher was the first deep-learning audio watermark to integrate psychoacoustic thresholding and the first to scale to that 44.1 kHz rate (Singh, Takahashi, Liao and Mitsufuji, Interspeech 2024), which is what makes it relevant to real music rather than laboratory clips. Psychoacoustic thresholding is what lets it hide the mark under the parts of a mix a listener cannot hear, so the watermark stays inaudible in a full track. The open-source audiowmark tool by Stefan Westerfeld is a concrete second example: it hides a 128-bit payload in the FFT spectrum using a patchwork algorithm, adds convolutional codes for error correction, and reports that after conversion to MP3 or Ogg at 128 kbit/s or higher its watermark “usually can be retrieved without problems.” It even searches replay speed over roughly 0.8 to 1.25 times to survive small tempo changes. For the ordinary life of a track, uploading, streaming, transcoding to MP3, a mark built to this standard usually survives. That is the deterrent half of the answer.
The deployed mark is opaque
The most widely deployed music watermark right now is also the least inspectable. Google DeepMind’s SynthID rides on the Lyria music model, and its audio form is black-box: detection runs only through Google’s API and Gemini, with no public implementation and an undisclosed payload and threshold. That opacity cuts both ways for removability. An attacker cannot study the scheme directly, but neither can an independent party audit how robust it is, so its real ceiling against a determined remover is not publicly measured. The deployed case, in other words, is a promise rather than a benchmarked number. That is not a reason to dismiss it, but it means its durability has to be inferred from the class it belongs to rather than read off a published robustness table.
The two ceilings that erase it
Underneath the per-scheme differences sit two attacks that break the class, and they are why “removable” is the verdict. The first is overwriting. Yao, Huang and Wang (AAAI 2026), in “Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking,” re-embed a fresh mark over the original signal and report a “nearly 100% attack success rate” against neural audio watermarks across white-box, gray-box and black-box settings in their own tests, concluding that keeping the model secret provides no security. The mechanism is simple: write a new mark where the old one lived, and the original is displaced. The second is neural re-synthesis. A round-trip through a neural codec such as EnCodec or DAC rebuilds the waveform from a learned representation rather than trimming it, and AudioMarkBench measures the resulting bit-error rate at 98% or higher (Liu, Guo and Jiang, NeurIPS 2024), which is erasure rather than degradation. That measured method is speech-native, but the ceiling carries to music, because the mechanism is the rebuild, not the content. The removal does not even need the scheme: O’Reilly, Pardo and Jin (ICLR 2025 Workshop) report stripping state-of-the-art post-hoc audio watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality.” These are each the source paper’s own reported result, not independently replicated. The pattern is the same one classical compression does not trigger: MP3 trims perceptual detail, a neural codec rebuilds the signal, and a fragile mark does not survive the rebuild.
The one outlier
There is a single audio mark built to a tougher standard, and it is worth naming because it shows what robustness costs. Cinavia, Verance’s copy-control watermark covered by US Patent 8,085,935 B2 (Petrovic, Verance, 2011), is designed to survive the analog hole, meaning even microphone re-recording and broadcast, a tougher robustness target than the AI-origin marks aim for. That durability is Verance’s own patent claim rather than an independently benchmarked result, and it is specific to a copy-control mark that carries only a tiny payload, a single do-not-copy flag rather than an identifier. It is not a template the attribution marks can adopt, because they need enough capacity to say which model or which user, and capacity is exactly what trades against durability. Cinavia shows what a robustness-first audio watermark is designed for; it is not evidence that every invisible music watermark is robust.
What removability means for trust
The benchmark behind these numbers, AudioMarkBench, describes itself as “the first systematic benchmark for evaluating the robustness of audio watermarking against watermark removal and watermark forgery” (Liu, Guo and Jiang, NeurIPS 2024), and its verdict for music is the same asymmetry that holds across audio. A present mark is real evidence that a specific scheme processed the track. An absent mark is close to neutral, because the music may never have carried a mark, may have been re-synthesised through a codec, or may have been overwritten in one pass. The reliability of a music mark is set by the strongest operation it faces, not the most common one, so a watermark is a strong deterrent against casual sharing and a weak seal against a motivated remover. If your goal is the reverse, keeping your own track from being traced back to you, see does removing an audio watermark work?.
Sources
- Singh, Takahashi, Liao, Mitsufuji (2024). SilentCipher: Deep Audio Watermarking. Interspeech.
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.
- Petrovic (2011). Embedding and Extraction of Information from an Embedded Content Using Replica Modulation. US Patent 8,085,935 B2, Verance.