Contents
Partly. A signal audio watermark such as AudioSeal or WavMark can be driven below detection by heavy denoising, codec regeneration or an overwriting attack, but removing the watermark does not remove the recording’s device fingerprint, and regeneration stamps a fresh signature of its own.
What an audio watermark actually is
An audio watermark is not a tag in the file header. It is a faint, deliberately imperceptible pattern woven into the audio samples themselves, and read back by a matching detector. San Roman and colleagues built one of the best-known examples, AudioSeal, which they describe as “the first audio watermarking technique designed specifically for localized detection of AI-generated speech.” Chen and colleagues built another, WavMark, aimed at marking generated audio. Both were built to prove where audio came from, not to hide it, which is why a readable mark is the entire point of the design and why removing one works against the grain of the tool. Because the mark is in the signal and not the metadata, you cannot remove it with ExifTool or mat2. Clearing the ID3 block does nothing to it. That is the first thing to understand: this is a different layer from a metadata strip, and it needs a different kind of attack.
Yes, the watermark can come off
It can, and the research is fairly blunt about it. There are three broad classes of attack, and none of them is a secret recipe; they are documented findings. The first is heavy speech-enhancement denoising. O’Reilly and colleagues titled their 2025 study “Deep Audio Watermarks Are Shallow”, and showed that post-hoc audio watermarks can be washed out. López-López and colleagues studied the same thing from the attacker’s side, investigating attacks “where an impostor attempts to remove the watermark in order to disguise synthetic speech as genuine” using DNN-based speech enhancement. The second class is neural-codec regeneration, passing the audio through a vocoder or codec that rebuilds the waveform from scratch. The third is an overwriting attack: Yao and colleagues report an overwriting method that “achieve[s] a nearly 100% attack success rate” against state-of-the-art neural audio watermarks in their own tests, a single-source result not independently replicated.
Put together, the field-level verdict is not encouraging for the watermark. Wen and colleagues surveyed the area and concluded that “none of the surveyed watermarking schemes is robust enough to withstand all tested distortions in practice.” So the answer to the title is yes, to a point: a determined attacker with enough signal degradation can drive a watermark below its detector’s threshold.
But removal is not the same as anonymity
Here is where the question turns. Removing the watermark removes the thing the generator added. It does nothing to the thing the recording device left behind. If the audio was ever captured by a real microphone, that microphone’s fingerprint is in the samples, and it does not come off with the watermark. Qamhan and colleagues identified source microphones at between 97.6 and 99.98 percent accuracy from the signal alone. Stripping an AudioSeal or WavMark mark leaves that untouched.
And the regeneration route has a sting in the tail. Passing audio through a neural codec to destroy the watermark does not leave you with a clean, unmarked file. It leaves you with a file that now carries the regenerator’s own signature, a fresh artifact stamped in by the very tool you used to launder it. Regeneration does not make audio untraceable; it makes it differently traceable. On top of that, every one of these attacks costs audio quality, because they work by degrading or rebuilding the signal, so “removed the watermark” and “still sounds like the original” pull against each other.
What this means in practice
Removing an audio watermark is a real thing that research has shown is possible, but it answers a narrower question than most people are asking. It also helps to separate two very different failures. A watermark detector returning nothing means one specific mark has been driven below one specific threshold. It does not mean an analyst with the original file, a source-microphone classifier, or an electric-network-frequency check has nothing left to work with. Those run on the recording itself, not on the embedded payload, so they are unaffected by whether the AudioSeal or WavMark mark is still readable. Confusing “no watermark detected” with “not traceable” is the mistake this whole cluster is built to warn against. The tag is the label; the signal is the evidence. If your actual goal is an untraceable recording rather than a watermark specifically, the fingerprint that survives every watermark attack is the microphone and ENF signature baked into the samples, addressed in strip ENF and microphone fingerprint from audio.
Sources
- San Roman, Fernandez, Elsahar, Défossez, Furon, Tran (2024). Proactive Detection of Voice Cloning with Localized Watermarking. International Conference on Machine Learning.
- Chen, Wu, Liu, Liu, Du, Wei (2023). WavMark: Watermarking for Audio Generation.
- O’Reilly, Pardo, Jin, Su (2025). Deep Audio Watermarks Are Shallow: Limitations of Post-Hoc Watermarking Techniques for Speech. International Conference on Learning Representations, GenAI Watermarking Workshop.
- López-López, Rosello, Gomez (2024). Speech Watermarking removal by DNN-based Speech Enhancement Attacks. IberSPEECH.
- Wen, Innuganti, Ramos, Guo, Yan (2025). SoK: How Robust is Audio Watermarking in Generative AI models?
- Yao, Huang, Wang, Xue, Guo, Liu, Lin, Ohtsuki, Pan (2025). Yours or Mine? Overwriting Attacks Against Neural Audio Watermarking. AAAI.
- Qamhan, Alotaibi, Selouani (2023). Source Microphone Identification Using Swin Transformer. Applied Sciences.