Research map / Image generation / Autoregressive and latent generation
XAttnMark: Learning Robust Audio Watermarking with Cross-Attention
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes XAttnMark, a neural audio watermark with partial generator-detector parameter sharing, cross-attention message decoding, temporal message conditioning, and a psychoacoustic TF masking loss, achieving state-of-the-art detection and attribution robustness.
Problem
Neural audio watermarking has struggled to jointly achieve robust detection and accurate attribution (message decoding), especially under standard edits and generative editing.
Approach
Partially shares parameters between generator and detector via a shared message embedding table used as key/value in a cross-attention message decoder, distributes the message temporally before injection, and weights a mel-spectrogram l2 loss by a psychoacoustic per-tile masking energy computed with asymmetric TF decay.
Key results
- Average detection accuracy 99.19% across 16 standard edits vs. 97.1% for AudioSeal and 92.9% for AudiowMark.
- Average attribution accuracy 93% across standard edits vs. 39% for AudioSeal.
- Under generative edits (Stable Audio, AudioLDM2), detection accuracy of 91-94% while AudiowMark and WavMark are at chance (50%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use XAttnMark instead of AudioSeal | audio watermarking · Standard edits (average) | detection accuracy: 0.971 -> 0.9919 | Helped |
| use XAttnMark instead of AudiowMark | audio watermarking · Standard edits (average) | attribution accuracy: 0.88 -> 0.93 | Helped |
| use XAttnMark instead of AudioSeal | audio watermarking · Stable Audio generative edits, t=10, 70, 110 | detection accuracy: 0.69 -> 0.94; 0.59 -> 0.91; 0.59 -> 0.91 | Helped |
| use XAttnMark instead of AudioSeal | audio watermarking · AudioLDM2 generative edits, t=10, 70, 110 | detection accuracy: 0.59 -> 0.94; 0.59 -> 0.94; 0.59 -> 0.94 | Helped |
| use XAttnMark instead of WavMark | audio watermarking · MusicCaps, N=100 | attribution accuracy: 85.08 -> 93.87 | Helped |
| add psychoacoustic TF masking loss (ablation) | XAttnMark · Watermarked audio quality | SI-SNR: 19.64 -> 29.00 | Helped |
| add psychoacoustic TF masking loss (ablation) | XAttnMark · Watermarked audio quality | PESQ: 4.25 -> 4.43 | Helped |
| add adaptive γ bandwidth scaling (ablation) | XAttnMark · Watermarked audio quality | SI-SNR: 21.89 -> 29.00 | Helped |
| add adaptive γ bandwidth scaling (ablation) | XAttnMark · Watermarked audio quality | PESQ: 4.22 -> 4.43 | Helped |
| remove temporal message modulation (ablation) | XAttnMark · message decoding | accuracy: approximately 98% -> around 60% | Hurt |
| remove cross-attention (ablation) | XAttnMark · message decoding | accuracy: approximately 98% -> 50% | Hurt |
| replace adaptive γ with constant γ=1 (ablation) | XAttnMark · Watermarked audio quality | STOI: 1.000 -> 0.991 | Hurt |
Surprising findings
- Attribution under generative editing remains poor even though detection stays above 90%, which the authors flag as an open challenge.
- Full parameter sharing (WavMark-style) shows detection degradation later in training, while fully disjoint AudioSeal learns message decoding slowly.
Limitations
- Attribution accuracy degrades substantially under speed changes (about 4% average) and generative editing.
- Adversarial HSJA black-box attacks can reduce detection accuracy to 36-47% at higher query budgets, with audio quality loss.
Experimental setup
Datasets: VoxPopuli LibriSpeech MusicCaps Free Music Archive AudioSet
Benchmarks: MusicCaps held-out test set (100 files, 16 edits) VoxPopuli AudioMarkBench
Metrics: detection accuracy TPR/FPR attribution accuracy FAR SI-SNR PESQ STOI ViSQOL watermark residual loudness MUSHRA
Baselines: AudiowMark WavMark TimbreWM AudioSeal
Builds on: AudioSeal WavMark EnCodec
Closest papers by meaning
- AudioMarkBench: Benchmarking Robustness of Audio Watermarking (NeurIPS 2024 · similarity 0.90)
- Robust Distortion-Free Watermark for Autoregressive Audio Generation Models (NeurIPS 2025 · similarity 0.86)
- Proactive Detection of Voice Cloning with Localized Watermarking (ICML 2024 · similarity 0.86)
- Speech Watermarking with Discrete Intermediate Representations (AAAI 2025 · similarity 0.85)
- Asymmetric Phase Coding Audio Watermarking (NeurIPS 2026 · similarity 0.84)
- Adaptive Compression and Targeted Perturbation: A Unified Framework for Generalized Audio Deepfake Detection (NeurIPS 2026 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.