不训练模型就能识别并移除音频水印，揭示其脆弱性
How Fragile Is Your Watermark? Training-Free Structural Removal of Neural Audio Watermarks
- 仅需少量原始与带水印音频对，通过结构探测定位水印位置
- 针对特定水印域的精准攻击可完全消除水印，且保持高音质（PESQ≥3.6）
- 适用于评估水印鲁棒性，适合安全研究者和水印设计者参考
神经音频水印被广泛用于识别和检测生成语音，其实际价值取决于攻击者移除它的成本。现有方法通常对所有方案施加固定的失真组合进行盲目测试。本文提出诊断式移除：从少量干净/带水印音频对中，计算低成本的结构探针，揭示水印在信号中的嵌入域，再施加单一域匹配攻击，而非盲扫。我们进一步以阈值无关的脆弱性评分（准确率-质量权衡曲线下的面积）总结每种方案，该指标比仅看准确率更全面。在十种水印方案中，探针成功区分出脆弱与鲁棒类型：幅度域和载波域水印（WavMark、SilentCipher、audiowmark）及音频标志（AudioSeal）在高客观质量（PESQ≥3.6）下被单次匹配攻击彻底清除；而潜在域水印（VoiceMark、WMCodec、AlignMark、AWARE）则抵抗所有无训练攻击。同一探针签名还能以84%准确率识别水印方案。
原文摘要 · Abstract (English)
Neural audio watermarks are increasingly used to attribute and detect AI-generated speech, so their practical value rests on how cheaply an adversary can remove them. Robustness is usually measured by running a fixed battery of distortions blindly against every scheme. We instead make removal diagnostic: from a few clean/watermarked pairs we compute cheap structural probes that reveal where a watermark sits in the signal (its embedding domain), then apply a single domain-matched attack rather than a blind sweep. We further summarize each scheme with one threshold-free fragility score, the area under its accuracy-versus-quality trade-off, which an accuracy-only benchmark cannot provide. Across ten watermarking schemes the probes separate fragile from robust marks: for magnitude and carrier-domain watermarks a single matched attack erases the payload (WavMark, SilentCipher, audiowmark) or removes the detection flag (AudioSeal) at high objective quality (PESQ >= 3.6), whereas latent-domain marks (VoiceMark, WMCodec, AlignMark, AWARE) resist every training-free attack we apply. The same pair-only probe signatures also identify which watermarking scheme is present (84% over ten schemes).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。