arXiv:2602.10166cs.CRcs.SD2026-02

为语音片段提供可公开验证的溯源证明,支持防篡改检测与分段追溯。

MerkleSpeech: Public-Key Verifiable, Chunk-Localised Speech Provenance via Perceptual Fingerprints and Merkle Commitments

  • 通过感知指纹与梅克尔树结合,实现语音片段的可验证溯源
  • 两种验证层级:抗干扰水印识别与严格加密完整性验证
  • 支持拼接检测,可定位失败区域并说明原因,适合内容审核场景

语音溯源不仅限于检测水印是否存在。实际应用中涉及拼接、引用、剪辑及平台级转换,可能部分保留原内容而改变其他区域。现有神经水印系统在鲁棒性和局部检测上已有进展,但多数输出无法提供第三方可验证的加密证明,无法将时间片段与发行方签名的原始内容绑定。如C2PA等溯源标准采用签名清单和梅克尔碎片验证,但其绑定对象为编码资产,在重编码或常规处理下失效。本文提出MerkleSpeech,一种支持公钥验证、分段定位的语音溯源系统,提供双层保障:第一层(仅水印)可抵御常见分发变换,回答“该片段是否由已知方发布”;第二层(MSv1)则通过发行方签名的梅克尔根验证片段指纹的包含关系。系统对短语音段计算感知指纹,将其提交至梅克尔树,根哈希由发行方私钥签名,并嵌入紧凑的带内水印载荷,包含随机内容标识符和足够检索梅克尔包含证明的元数据。提取载荷后,所有验证步骤(签名检查、指纹重算、梅克尔包含)均仅依赖公开信息。最终生成一个拼接感知的时间线,标明各区域通过哪一层验证,以及失败原因。我们描述了协议流程,给出伪代码,并在重采样、带通滤波和加性噪声条件下实验,实现极低误报率,参考近期审计指出神经编解码器是后验音频水印的主要压力源。

原文摘要 · Abstract (English)

Speech provenance goes beyond detecting whether a watermark is present. Real workflows involve splicing, quoting, trimming, and platform-level transforms that may preserve some regions while altering others. Neural watermarking systems have made strides in robustness and localised detection, but most deployments produce outputs with no third-party verifiable cryptographic proof tying a time segment to an issuer-signed original. Provenance standards like C2PA adopt signed manifests and Merkle-based fragment validation, yet their bindings target encoded assets and break under re-encoding or routine processing. We propose MerkleSpeech, a system for public-key verifiable, chunk-localised speech provenance offering two tiers of assurance. The first, a robust watermark attribution layer (WM-only), survives common distribution transforms and answers "was this chunk issued by a known party?". The second, a strict cryptographic integrity layer (MSv1), verifies Merkle inclusion of the chunk's fingerprint under an issuer signature. The system computes perceptual fingerprints over short speech chunks, commits them in a Merkle tree whose root is signed with an issuer key, and embeds a compact in-band watermark payload carrying a random content identifier and chunk metadata sufficient to retrieve Merkle inclusion proofs from a repository. Once the payload is extracted, all subsequent verification steps (signature check, fingerprint recomputation, Merkle inclusion) use only public information. The result is a splice-aware timeline indicating which regions pass each tier and why any given region fails. We describe the protocol, provide pseudocode, and present experiments targeting very low false positive rates under resampling, bandpass filtering, and additive noise, informed by recent audits identifying neural codecs as a major stressor for post-hoc audio watermarks.

语音溯源梅克尔树水印验证内容可信

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。