The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection

2026-06-22

AI Summary

This study addresses the vulnerability of current audio deepfake detectors that inadvertently rely on provenance watermarks embedded in synthetic speech as shortcut cues, leading to degraded generalization, evasion via watermark removal, and false positives on genuine speech. The work systematically uncovers, for the first time, a tripartite failure mechanism induced by such watermarks and proposes a mitigation strategy that decouples the spurious correlation between watermarks and forgery labels by uniformly applying watermarks to both real and fake utterances during training. Leveraging white-box controlled experiments, black-box evaluations on commercial APIs, and adversarial watermark manipulations, the authors construct the paired corpus WASP. Empirical results demonstrate that this approach reduces the watermark-induced equal error rate from 75% to 16%, substantially restoring detection robustness. The WASP dataset is publicly released to foster further research.

Abstract

Provenance watermarking is increasingly treated as a safeguard for synthetic speech, whether built directly into speech-generation models such as Chatterbox, provided through dedicated techniques such as AudioSeal, or deployed by commercial platforms such as ElevenLabs. We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "watermark => fake" shortcut. This single feature yields three coupled failures: generalization degradation (model performance deteriorates on unseen data), strip-to-evade (a watermarked fake escapes once unwatermarked), and mark-to-frame (watermarking a real voice flags it as fake). In a controlled white-box experiment, a watermark-trained detector shows all three (for example, mark-to-frame lifts Equal Error Rate from 16% to 75%). In a black-box test of a commercial API, we show that adding a watermark to real speech disguises it as fake. However, this shortcut is fixable: retraining with the watermark on both classes decorrelates it and restores clean behavior. We release experiment data as a paired clean-versus-watermarked corpus (WASP).

Problem

• watermark
• audio deepfake detection
• provenance marking
• spurious correlation
• synthetic speech

Innovation

• watermark shortcut
• audio deepfake detection
• provenance watermarking
• spurious correlation
• mark-to-frame