Contents
AudioSeal is Meta’s audio watermark that adds an imperceptible signal to speech and reads it back with a per-sample detector, so it can flag AI-generated speech and even locate which segments of a clip are watermarked. It is described by San Roman, Fernandez & Elsahar (ICML 2024) as “the first audio watermarking technique designed specifically for localized detection of AI-generated speech”. What follows is the mechanism, what makes it different from earlier audio marks, and where its reliability ends.
The mechanism
AudioSeal is built from two networks trained together. A generator predicts an additive watermark waveform, a low-amplitude signal added on top of the speech, and a detector outputs the probability of a watermark at each sample of the result (San Roman, Fernandez & Elsahar, ICML 2024). The two are trained jointly with a localization objective, so the detector learns not just whether a mark is present but where. The added waveform is shaped by a perceptual loss inspired by auditory masking, which keeps it imperceptible to a listener while remaining readable to the detector. A multi-bit payload rides alongside, which lets a watermarked audio be attributed “to one model among 1,000”. The system operates at 16 kHz.
What makes it different: localization and speed
Earlier audio watermarks were built to answer one question over a whole clip: is the mark present. AudioSeal answers a finer one. Its detector resolves the mark to a resolution of 1/16000 second, which lets it pinpoint which segments of a longer recording are AI-generated rather than only scoring the file as a whole. The contrast the paper draws is with WavMark (Chen, Wu, Liu et al., 2023), which repeats a one-second synchronization pattern before its payload, cannot be used on spans shorter than one second, and whose synchronization bits reduce capacity “accounting for 31% of the total capacity”, with slow brute-force sync decoding. AudioSeal instead uses a single-pass detector reported as up to two orders of magnitude faster than prior methods (San Roman, Fernandez & Elsahar, ICML 2024). Localization plus speed is what makes it practical to scan long streams.
What a detected mark proves
A positive from the AudioSeal detector means the AudioSeal mark is present, and with the payload, which model wrote it. It does not mean “this audio is AI” in general. A different generator’s speech, or a real recording, carries no AudioSeal mark, so a negative reads as “not this mark”, not “not synthetic”. As with every watermark, presence is informative and absence is close to neutral, because most audio never carried the mark to begin with.
Where it stops
AudioSeal survives ordinary handling and classical MP3 compression inside its training envelope, but its reliability has a hard ceiling that the follow-up research maps precisely. Yao, Huang & Wang (AAAI 2026) report a single overwriting attack, re-embedding a fresh mark over the original, driving AudioSeal, WavMark and TimbreWatermarking to a “nearly 100% attack success rate” across white-box, gray-box and black-box settings in their own tests, and conclude that keeping the model secret provides no security. A separate benchmark measures neural-codec round-trips through EnCodec or DAC pushing AudioSeal’s bit-error rate to 98% or higher (Liu, Guo & Jiang, NeurIPS 2024), so “survives MP3” is not the same claim as “survives re-encoding”. O’Reilly, Pardo & Jin (ICLR 2025 Workshop) report the same beyond any one scheme, removing state-of-the-art post-hoc audio watermarks “with no knowledge of the watermarking scheme and minimal degradation in audio quality”. These removal figures are the source papers’ own single-source results, not independently replicated. AudioSeal is also not tuned for the voice-cloning case specifically: VoiceMark (Li, Wu & Xie, Interspeech 2025) was introduced as the first zero-shot voice-cloning-resistant audio watermark, a direct response to the fact that earlier marks including AudioSeal degrade under zero-shot voice cloning. None of this makes AudioSeal a bad design. It makes it a strong deterrent against casual stripping and a weak seal against a determined remover, which is the same envelope every deployed watermark lives in.
How to read it
AudioSeal is the clearest answer yet to the problem of proving “this speech came from our model”, and its localization is a genuine advance. Read it as what it is: a per-sample presence-and-attribution signal that holds against everyday handling and falls to re-synthesis. A detected mark is real evidence of origin. A missing mark, given how cheaply it can be overwritten or re-encoded away, is not evidence of anything. If your goal is the reverse, keeping your own audio from being traced back to you, see does removing an audio watermark work?.
Sources
- San Roman, Fernandez, Elsahar (2024). Proactive Detection of Voice Cloning with Localized Watermarking. ICML.
- Chen, Wu, Liu (2023). WavMark: Watermarking for Audio Generation.
- Li, Wu, Xie (2025). VoiceMark: Zero-Shot Voice Cloning-Resistant Speech Watermarking. Interspeech.
- Yao, Huang, Wang (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI 2026.
- Liu, Guo, Jiang (2024). AudioMarkBench: Benchmarking Robustness of Audio Watermarking. NeurIPS Datasets and Benchmarks.
- O’Reilly, Pardo, Jin (2025). Deep Audio Watermarks are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. ICLR Workshop.