Speech Watermark Evasion: What the ScrambleMark Study Means for Audio Watermarks
An audio watermark can be made undetectable without being removed, at least for speech in one new study. ScrambleMark, a paper posted to arXiv on November 3, 2026 and accepted at IEEE S&P 2027, reports nearly 97% evasion against three commercial speech watermarking platforms while keeping the audio natural to listeners. For teams that rely on audio watermarks, the practical step is to stop treating a single "not detected" result as proof of anything.
What did the ScrambleMark study find?
The authors, from the University of Missouri–Kansas City, Indiana University Bloomington, the University of South Florida and American University, tested their attack on seven academic watermarking systems and three commercial platforms: Google SynthID, Resemble AI and TrustedAudio. On the commercial platforms they report nearly 97% evasion with a human rating of 4.2 out of 5, compared with 1.1 to 1.7 for earlier attacks.
The attack is described as zero-query and watermark-agnostic: the attacker does not send samples to the target detector and does not need to know which watermark was used. The authors also report that when a defender knew the attack algorithm and tried to reverse it, the success rate dropped by only 0.02.
How is evading a watermark different from removing it?
Earlier attacks mostly tried to erase the mark. ScrambleMark's argument is that detection depends on the "structural consistency of the embedded pattern," so disrupting that structure is enough for the detector to miss it, even though the mark is not erased.
This matters because some platforms have started limiting who can query their detectors. The paper notes that TrustedAudio restricts detection to authenticated users. Because ScrambleMark does not query the detector, the authors argue that this restriction does not limit their attack. Another query-free attack, SweepMark, first posted in September 2026 and revised in October, targets academic watermarks by removing the mark, so this is an active line of research.
Does this mean audio watermarks no longer work?
We don't think the study supports that conclusion. The authors report that, in their own tests, an attacker using a public surrogate model evaded detection on speech watermarks. The study does not show that everyday edits such as compression or trimming do the same. Google, for example, says SynthID audio watermarks in Lyria and NotebookLM output are built to survive added noise, MP3 compression and speed changes.
What changes is how much weight a single watermark check should carry. Google's own Gemini help page already says a missing SynthID watermark means the content was not made with Google AI, not that it was made by a person. ScrambleMark adds a second reason to read "not detected" carefully: the mark may have been there and been scrambled.
What should teams that rely on audio watermarks check?
If you use audio watermarks for AI labeling, leak tracing or rights claims, these five questions are a reasonable starting point. They are our own checklist, not requirements from the paper.
Question | Why it matters after ScrambleMark |
|---|---|
What decision rests on a "not detected" result? | If absence of a mark triggers approval or rejection on its own, an evaded mark changes the outcome. |
Is there a second signal, such as C2PA Content Credentials? | A signed provenance record and a watermark fail in different ways, so one can cover gaps in the other. |
Do you keep your own distribution records? | A log of which file went to whom does not depend on the mark surviving. |
Has your vendor tested against structural attacks, not only compression and noise? | Robustness claims often cover common edits. Ask which adversarial tests were run and on what kind of audio. |
Is the content speech, music or both? | ScrambleMark tested speech. Results for music may differ and should be checked, not assumed. |
How do C2PA and watermarks work together for audio?
C2PA Content Credentials attach a signed record of origin and edit history to a file. A watermark lives inside the audio itself. Metadata can be stripped when a file is re-encoded, and a watermark can be scrambled, which is why provenance designs often combine the two. We explained how soft bindings work in general, using images as the example, in our post on C2PA soft bindings.
Watermarks also serve different purposes. SynthID signals that content came from an AI model. A per-recipient forensic watermark, like the one MuseBlossom's Audio Defence embeds, is used to trace which distributed copy of a track leaked. Contents Defence is listed on the C2PA Conforming Products List for image, audio and video. A listing confirms conformance with the standard. It is not evidence that any watermark survives every attack.
What this study cannot tell you
The results are the authors' own experiments on speech watermarking. They do not tell us how music watermarks, or watermarking systems outside the ten tested, would hold up. We also could not confirm whether the three commercial platforms have changed anything since the paper was posted.
FAQ
Can I check an audio file for a SynthID watermark myself?
Yes. Google's SynthID Detector, opened to everyone in English on October 7, 2026, and the Gemini app both accept audio. The Gemini app takes files under one hour and 100 MB, with about 10 audio checks per 24 hours. See our guide to reading SynthID results.
Did ScrambleMark test music?
No. The paper is about speech watermarking. Its numbers should not be applied to music without separate testing.
Is this the same problem as image watermarks being repainted?
It is a similar pattern in a different medium: an attack that leaves the content usable while the detector stops matching. We looked at the image case in our post on the BrushOff study.
Planning provenance or leak tracing for audio? Ask us about Contents Defence.