Research map / Adversarial robustness and security / Attacks on text and graphs

Asymmetric Phase Coding Audio Watermarking

NeurIPS 2026 · Adversarial robustness and security › Attacks on text and graphs · approach: Neural network watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Asymmetric Phase Coding, a training-free audio watermark that embeds an Ed25519-signed, Reed-Solomon-protected payload via STFT phase bins plus a redundant magnitude-QIM channel, evaluated on LibriSpeech and 18 corpora against neural baselines.

Problem

Deepfake audio undermines voice authentication; passive detectors fail under evolving generators and channel distortion, and existing audio watermarks lack public-key non-repudiation and carry only short payloads.

Approach

Combine an Ed25519 signature and RS code with pseudo-random STFT phase-bin embedding and a disjoint-bin magnitude QIM channel on log-magnitude bin-pair differences, giving blind, training-free, publicly verifiable signed watermarks that survive lossy codecs.

Key results

• Hybrid APC verifies 97.5% to 98.3% across eight attacks on 1,000 LibriSpeech clips at mean PESQ 3.02.
• Magnitude-QIM channel raises MP3 128k verification from 77% to 97.5% and OGG 128k from 73% to 97.5%.
• Fixing redundant phase writes and the unprotected length header raises identity PESQ to 3.55 and verification to 1.000 on a 150-clip subset.

Surprising findings

• The shipped decoder's unprotected length header lets a white-box attacker erase the watermark at no audible cost (PESQ delta 0.00005).
• Under AAC 128 kbps AudioSeal detection stays at 1.000 while its exact 16-bit message recovery falls to 0.000.

Limitations

• Neural codec resynthesis, voice conversion, and replay drive verification to 0.000, a structural boundary for signal-domain marks.
• Payload-directed erasure remains possible at about 0.42 PESQ cost; erasure is not provably prevented.
• Narrowband telephone audio under lossy codecs needs a parameter change; silent leading clips lose embedding.

Experimental setup

Datasets: LibriSpeech test-clean TED-LIUM MUSDB18-HQ AMI

Benchmarks: LibriSpeech test-clean (1000 clips, 8 attacks) 18-corpus expansion (2021 clips)

Metrics: Verify% BER NC PESQ STOI SNR LSD latency

Baselines: AudioSeal WavMark SilentCipher phase-only APC coder

Builds on: Ed25519 quantization index modulation phase coding Reed-Solomon codes C2PA

Closest papers by meaning

• AudioMarkBench: Benchmarking Robustness of Audio Watermarking (NeurIPS 2024 · similarity 0.86)
• Robust Distortion-Free Watermark for Autoregressive Audio Generation Models (NeurIPS 2025 · similarity 0.86)
• Proactive Detection of Voice Cloning with Localized Watermarking (ICML 2024 · similarity 0.85)
• XAttnMark: Learning Robust Audio Watermarking with Cross-Attention (ICML 2025 · similarity 0.84)
• Speech Watermarking with Discrete Intermediate Representations (AAAI 2025 · similarity 0.82)
• ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport (NeurIPS 2026 · similarity 0.82)