Learning to Evade: Adaptive Attacks on Audio Watermarking

2026-06-20

AI Summary

This work addresses the vulnerability of existing audio watermarking methods to adversarial attacks, particularly exploiting the fact that the probability distributions output by watermark decoders are commonly used for tampering detection. To this end, the paper proposes an Adaptive Watermarking Attack Method (AWM), which, for the first time, leverages the normality of watermark decoding probabilities. AWM employs a two-stage optimization process to generate high-fidelity adversarial audio and adaptively adjusts decoding probabilities by estimating the target distribution parameters from limited samples, thereby evading detection. Experimental results demonstrate that AWM achieves high attack success rates against two state-of-the-art watermarking schemes across three speech datasets, reducing detection rates to below 10% in substitution and generation scenarios—and even to 0% in removal scenarios—significantly outperforming existing attack strategies.

Abstract

Advances in generative audio have intensified copyright concerns, making audio watermarking increasingly important for asserting ownership. However, existing audio watermarking methods are vulnerable to adversarial attacks. We find that watermark decoder message probabilities follow normal distributions, a property exploited by defenses to detect manipulations. This paper introduces an adaptive audio watermark attack method (AWM) designed to bypass existing defense strategies. AWM uses a two-stage optimization: the first stage ensures attack success, while the second improves audio quality. To evade detection, it estimates normal distribution parameters from limited samples of the target audio, and then adaptively steers decoded probabilities back into the estimated range. Evaluated on two watermarking methods across three voice datasets, AWM achieves high success while bypassing state-of-the-art detectors: detection rates are below 10% for replacement and creation, and 0% for removal.

Problem

• audio watermarking
• adversarial attacks
• adaptive attack
• watermark detection evasion
• generative audio

Innovation

• adaptive attack
• audio watermarking
• adversarial evasion
• distribution estimation
• two-stage optimization