Contents
It depends on the layer: a lossy re-encode often only degrades a robust watermark, while a full regeneration or a physical re-recording can remove it, but removing the watermark is not anonymity, and regeneration stamps a fresh signature in its place. The three operations people lump together as “re-recording” are not equivalent, so it helps to separate them first.
Three operations, not one
Re-encoding means transcoding the file to another format or bitrate, say WAV to MP3. It is lossy, and it degrades fragile marks, but a watermark designed to survive compression usually rides through it. Robustness to everyday transcoding is a design goal for a provenance watermark, since a mark that a single MP3 export destroyed would be useless in the wild, so a light re-encode is the operation least likely to remove a serious one. Regeneration means passing the audio through a neural codec or vocoder that rebuilds the waveform from scratch. Re-recording means playing the audio and capturing it again through a speaker and a microphone. They sit on a ladder from gentle to drastic, and they have very different effects on a watermark.
What actually removes a signal watermark
A modern AI audio watermark is a signal embedded to be found. San Roman and colleagues describe their AudioSeal system as “the first audio watermarking technique designed specifically for localized detection of AI-generated speech”; the design goal is detectability, not concealment. That makes the removal question a research question, and the research is not kind to the watermark’s robustness.
O’Reilly and colleagues put the finding in their title: “Deep Audio Watermarks Are Shallow,” documenting how post-hoc speech watermarks wash out under enhancement. López-López and colleagues studied exactly the adversarial case, “where an impostor attempts to remove the watermark in order to disguise synthetic speech as genuine,” using DNN speech-enhancement to do it. Yao and colleagues report an overwriting attack that “achieve[s] a nearly 100% attack success rate” against state-of-the-art neural audio watermarks in their own tests, a single-source result not independently replicated. And the field-level survey by Wen and colleagues reaches a blunt verdict: “none of the surveyed watermarking schemes is robust enough to withstand all tested distortions in practice.” So a determined removal, especially by regeneration or enhancement, can take a signal watermark off. The catch is that every one of these attacks works by degrading or rebuilding the signal, so they cost audio quality; “removed the watermark” and “still sounds like the original” pull against each other, and the more reliably a method strips the mark the more it tends to hurt the sound.
Re-recording is the physical version
Playing and re-recording audio removes a watermark much the way it removes other synthesis traces: by rebuilding the signal through real hardware. Müller and colleagues measured this against detectors and saw a top model’s equal error rate rise from 4.7 percent to 18.2 percent after replay. What a watermark and a synthesis artifact have in common is that both are fine signal detail, and both get washed out when the waveform passes through a loudspeaker, a room and a microphone. That is why the drastic end of the ladder is the reliable end for removal. It is also the end that adds the most of its own, because the loudspeaker, the room and the microphone all leave marks the digital file never had, which is the same reason a full reset never leaves you with nothing.
Removing the watermark is not the same as untraceable
Here is the turn. Taking the watermark off does not make the file anonymous, because removal and regeneration leave marks of their own. Moussa and colleagues showed that the neural codec you might use to regenerate the audio leaves “distinctive frequency artefacts enable for identifying neurally compressed audio and fingerprint specific AI-based codecs.” And any real capture in the chain still carries a device fingerprint: Qamhan and colleagues identified source microphones from the signal alone at between 97.6 percent and 99.98 percent accuracy. A missing watermark is not an untraceable file; it just means one specific label is gone while the underlying evidence remains. It also helps to separate two failures that look alike. A watermark detector returning nothing means one specific mark has been driven below one specific threshold. It does not mean a source-microphone classifier, a codec-fingerprint check, or an analyst holding the original file has nothing left to work with, because those run on the recording itself, not on the embedded payload.
Where this leaves you
The short answer: re-encoding usually is not enough, regeneration or re-recording usually is, and none of it delivers anonymity. The watermark is the label; the codec artefact and the microphone are the evidence. If your actual goal is a consistent, reset file rather than watermark removal specifically, that is the privacy task in make audio untraceable.
Sources
- López-López, Rosello, Gomez (2024). Speech Watermarking removal by DNN-based Speech Enhancement Attacks. IberSPEECH.
- Moussa, Bergmann, Riess (2024). Unmasking Neural Codecs: Forensic Identification of AI-compressed Speech. Interspeech.
- Müller, Kawa, Choong, Stan, Bukkapatnam, Pizzi, Wagner, Sperl (2025). Replay Attacks Against Audio Deepfake Detection.
- O’Reilly, Pardo, Jin, Su (2025). Deep Audio Watermarks Are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. International Conference on Learning Representations, GenAI Watermarking Workshop.
- Qamhan, Alotaibi, Selouani (2023). Source Microphone Identification Using Swin Transformer. Applied Sciences.
- San Roman, Fernandez, Elsahar, Défossez, Furon, Tran (2024). Proactive Detection of Voice Cloning with Localized Watermarking. International Conference on Machine Learning.
- Wen, Innuganti, Ramos, Guo, Yan (2025). SoK: How Robust is Audio Watermarking in Generative AI models?