The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection

This research examines a structural risk that can emerge anywhere audio watermarking and deepfake detection are used together: if only synthetic speech is watermarked by default, a detector can learn to key off the watermark itself rather than genuine synthesis artifacts. Co-authored by Resemble AI's Nicolas Müller and Fraunhofer AISEC's Pascal Debus. Currently an arXiv preprint, not yet peer reviewed.

Overview 

Watermarking synthetic audio is becoming standard practice, a growing number of voice-cloning tools embed an inaudible marker by default, meant to help downstream systems tell real speech from generated speech. That's a good instinct. But it creates a subtle risk: if a detector is trained on data where "fake" almost always carries a watermark and "real" almost never does, the detector can learn the watermark as a shortcut, rather than learning what actually distinguishes real audio from synthetic audio.

This research shows that shortcut is real, measurable, and comes with three coupled consequences once it's learned: the detector generalizes worse to audio it hasn't seen, a fake can evade detection simply by having its watermark stripped, and a genuine recording can get wrongly flagged as fake if a watermark gets added to it. None of this is unique to any single watermarking system, it's a structural risk anywhere a detector's training data ties a watermark's presence too closely to the real-or-fake label.

chDownload the full research PDF on arXiv.

Methodology 

The team ran two tests. The first, a controlled white-box test, trained an academic detector (based on the AASIST architecture) on the standard ASVspoof19 benchmark, deliberately watermarking subsets of the training data in different patterns to isolate the effect: what happens when only fake audio is watermarked, versus when watermark status doesn't correlate with the real/fake label at all.

The second was a real-world black-box test: sending audio to a deployed commercial detector through its public API and observing how its verdicts changed when a watermark was added to genuine, unmodified recordings. For this test, the researchers used PerTh, a widely-deployed audio watermark as one real-world example of the pattern, not because it's uniquely at fault, but because it is the most prevalent since it comes with each model in the popular Chatterbox TTS family.

The fix the team proposes and tests is straightforward: watermark both classes during training, not just the synthetic one, so the model can no longer use "has a watermark" as a shortcut proxy for "is fake." The idea is to decorrelate the presence of the watermark in an audio file with the label (real or fake).

Results 

In the controlled white-box test, the effect was severe: under the condition designed to maximize the shortcut (genuine audio watermarked, fake audio not), the detector's equal error rate jumped from a baseline 16.4% to 74.6%, worse than random guessing. That's the clearest possible demonstration that the model had learned to read the watermark rather than the audio.

In the real-world black-box test, the effect was smaller: watermarking genuine recordings with PerTh raised the tested commercial detector's false-positive rate from roughly 4% to 13%. The researchers note this reflects an industry-wide pattern, watermarking-by-default on synthetic content plus any detector trained on data that happens to reflect that same imbalance, rather than a flaw specific to one tool.

The proposed fix worked: retraining with both bona fide and spoofed audio watermarked during training eliminated the shortcut in the white-box test, restoring normal detection behavior regardless of which class carried a watermark.

Why this matters: This research is relevant to anybody building audio deepfake detection. A detector can look perfectly healthy on a standard benchmark while having quietly learned to key off a watermark instead of real synthesis artifacts, and the failure only becomes visible under the specific conditions this research tests for: stripping a watermark, or adding one where it doesn't belong. That's exactly why deliberate, adversarial testing (rather than just tracking accuracy) matters for detection systems generally, a theme that shows up across this research program, not just here. The fix is simple once you know to look for the problem: watermark consistently across both classes during training.

Limitations 

• The white-box results are specific to one detector architecture (AASIST-based) trained on one benchmark (ASVspoof19); the exact severity may differ for other architectures or training data.
• The black-box test involved a vendor's detector accessed only through its public API; the underlying cause is described as vendor-confirmed, but can't be independently verified beyond what's reported in the paper.

How to cite this paper 

APA Müller, N. M., & Debus, P. (2026). The watermark shortcut: How provenance marking sabotages audio deepfake detection. arXiv preprint arXiv:2606.23335.

BibTeX @article{muller2026watermarkshortcut, title={The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection}, author={Müller, Nicolas M. and Debus, Pascal}, journal={arXiv preprint arXiv:2606.23335}, year={2026} }

Sources 

This is a curated subset only.

1. Wang et al. ASVspoof 5: Crowdsourced speech data, deepfakes, and adversarial attacks at scale. ASVspoof Workshop, 2024.
2. Jung et al. AASIST: Audio anti-spoofing using integrated spectro-temporal graph attention networks. ICASSP, 2022.
3. Müller et al. Does audio deepfake detection generalize? INTERSPEECH, 2022.
4. Coalition for Content Provenance and Authenticity (C2PA). Technical specification, 2024.
5. San Roman et al. Proactive detection of voice cloning with watermarking. ICML, 2024.

FAQs

Does watermarking synthetic audio make deepfake detection worse? It can, if only synthetic audio is watermarked by default and real audio isn't. A detector trained on that imbalance can learn to key off the watermark itself rather than genuine synthesis artifacts.

Can this be used to make a real recording look fake, or a fake recording look real? Both, in different ways. Stripping a watermark from synthetic audio can help it evade detection; adding a watermark to a genuine recording can cause it to be wrongly flagged as fake.

Is this a flaw in one specific watermarking system? No. The vulnerability is structural: it can affect any watermarking approach once a detector is trained on data where the watermark's presence is closely tied to the real-or-fake label. The researchers tested one widely-deployed watermark as a real-world example of the pattern.