Audio watermarking explained: how SynthID and AudioSeal mark AI audio, and how easily the marks break

Every big AI music and voice company now says some version of the same thing: our output is watermarked, so you can tell it was made by a machine. That promise is doing a lot of work in policy debates, platform rules and label negotiations. This guide explains what an audio watermark actually is, how the two best-documented systems (Google's SynthID and Meta's AudioSeal) work, and what independent researchers found when they tried to break them.

It is written for artists and producers, not engineers, and everything is as we read the sources on 24 Oct 2026. If you want the wider provenance picture, including C2PA Content Credentials, our earlier piece on audio watermarks and Content Credentials covers that; this one goes deeper on the watermark itself and how robust it is.

What an audio watermark is

An audio watermark is a signal hidden inside the sound itself. A generator, usually a neural network, adds a small change to the waveform at the moment the audio is made. A matching detector, trained alongside it, later listens for that change and reports whether it is there.

Two properties matter:

• Imperceptibility. You should not be able to hear it. Google describes the SynthID audio mark as "inaudible to the human ear".
• Robustness. It should survive the things that normally happen to audio: encoding to MP3, adding noise, speeding up or slowing down, mixing.

That is the key difference from metadata. A tag in a file header, or a C2PA manifest, sits next to the audio and disappears when someone re-exports or screen-records it. A watermark is meant to travel with the sound.

Watermarking is also different from AI-detection classifiers, which guess from the sound alone whether something is synthetic. A watermark detector does not guess about style; it looks for a specific signal that a specific generator put there. That makes it more precise, and much narrower: it can only find marks from the systems that add them.

SynthID: Google's approach

Google DeepMind's SynthID page says the watermark is applied to audio from its Lyria music models and from NotebookLM's podcast feature. For audio, Google says the mark "can't be altered by common modifications like adding noise, MP3 compression" or changes to the speed of the track.

On detection, the page says users can upload a file to Gemini and ask whether Google AI made or altered it, and that Gemini, Search and Chrome check for the watermark. Its SynthID Detector portal lets "anyone easily check" a file made with AI "from Google or our partners", naming OpenAI, NVIDIA, Kakao and, "soon", Apple.

Note what is and is not claimed. Google's robustness promise covers common modifications. The page does not claim the mark survives someone deliberately trying to remove it, and Google has not published audio-specific robustness numbers on that page.

AudioSeal: Meta's open approach

AudioSeal is a research system from Meta researchers, published at ICML 2024. The paper calls it "the first audio watermarking technique designed specifically for localized detection of AI-generated speech". Two ideas stand out:

• Localisation. The generator and detector are trained together with a localisation loss, so the detector can flag watermarked audio "up to the sample level". In plain terms, it can say which part of a clip carries the mark, which matters when a short AI segment is spliced into real audio.
• Speed. The authors say their single-pass detector is "up to two orders of magnitude faster" than earlier models, which they pitch as suitable for large-scale and real-time use.

The paper also uses a perceptual loss inspired by auditory masking, the effect where loud sounds hide quieter ones, to keep the mark inaudible.

The AudioSeal repository is under the MIT licence, including the model weights, so anyone can use it, commercially too. It can also embed an optional 16-bit message, enough for 65,536 different values, which could identify a model or version. One detail for musicians: AudioSeal was built and evaluated around speech, and its README talks about sample rates in terms of speech audio. It is not a music-first system.

How robust are they? What the research says

Vendor papers test their own systems. Two independent studies tested them under attack.

AudioMarkBench (NeurIPS 2024)

AudioMarkBench, by Liu and colleagues, describes itself as the first systematic benchmark for audio watermark robustness against both removal (making marked audio read as clean) and forgery (making clean audio read as marked). It tested three methods, AudioSeal, Timbre and WavMark, against 15 kinds of perturbation, under three threat settings:

• No-box: the attacker knows nothing about the watermark and just processes the audio. The marks held up against time-stretching, low-pass and high-pass filters and echo. But passing audio through neural audio codecs (EnCodec, SoundStream, Opus) removed the marks often, while measured quality stayed acceptable.
• Black-box: the attacker can query the detector. With many queries, removal while preserving quality became possible; with few queries, the methods were fairly robust. Forging a mark this way badly damaged audio quality.
• White-box: the attacker has the detector itself. Here the paper reports detection failure rates reaching 100% for all three methods at a perturbation level that kept the audio usable.

The benchmark also found fairness gaps. Under some noise attacks, watermarks on female speakers' audio were missed more often than on male speakers', a statistically significant difference for AudioSeal, and results varied by language.

The 2025 SoK

A March 2025 systematisation-of-knowledge paper by Wen and colleagues, SoK: How Robust is Audio Watermarking in Generative AI models?, went wider. It catalogued 22 audio watermarking schemes and built an evaluation framework with "22 types of removal attacks (109 configurations)", covering signal-level, physical and AI-induced distortions. It reports "8 new highly effective attacks" and concludes that "none of the surveyed schemes can withstand all tested distortions".

Neither study tested SynthID's audio mark, which is not openly available. So the honest summary is: the open systems that researchers could test are robust to everyday edits and fragile against a motivated attacker, and we do not have independent numbers for Google's.

Why this matters for musicians now

Watermarking is about to be a legal expectation in Europe. Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio to ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated", using solutions that are "effective, interoperable, robust and reliable" as far as technically feasible. The Act does not name watermarking specifically, and the article applies from 2 Aug 2026. Our guide to the EU AI Act for musicians covers the rest of the law.

In practice that pushes generators towards watermarks, and platforms towards reading them. Here is how to read a result:

1. A positive result is fairly strong. If a detector for a specific system finds its mark, that is good evidence the audio passed through that system, though forgery attacks exist and a mark can be in only part of a track.
2. A negative result is weak. "No watermark found" means only that this detector found its mark. The audio could come from a model that never adds one, or the mark could have been stripped by an attack as simple as a codec pass.
3. Neither result proves human authorship. Watermarks answer "did system X touch this?", not "who wrote this?". Keep your sessions, stems and dated project files; that is still your best evidence. Our piece on why AI music detectors are not proof makes the same case for classifier tools.

What we think

Watermarks are worth having, and AI companies should mark everything they generate by default. But the industry is quietly turning a tool that works one way into a tool used the other way. A watermark is good at confirming that a cooperating vendor made something. It is poor at clearing a human artist, because absence of a mark means almost nothing. The risk for artists is a platform or distributor that treats "no SynthID found" as a pass and a detector's guess as a fail, while the burden of proof falls on the person who actually made the music.

Two things would make watermarking fairer. First, independent robustness testing of closed systems like SynthID, the way AudioMarkBench and the SoK tested open ones; "survives common modifications" is a marketing line until someone outside Google measures it. Second, bias testing on music, not just speech: if marks already fail more often on some voices than others in speech benchmarks, artists deserve to know how they behave across genres and vocal styles before anyone builds takedown rules on them. Until then, treat a watermark as one piece of evidence, never the verdict.