SweepMark: Query-Free and High-Fidelity Attacks on Robust Audio Watermarking

Abstract

Audio watermarking embeds imperceptible signals into speech to trace misuse in text-to-speech (TTS) synthesis. Existing removal attacks may retain watermark-related artifacts or degrade speech quality when suppressing them. We propose SweepMark, a query-free black-box attack that targets these artifacts without access to target watermarking models or paired clean and watermarked samples. Our key insight is that watermark embedding introduces spectral patterns that are not fully aligned with natural speech, including persistent structures that conventional speech enhancement may retain. Diverse Artifact Learning extracts complementary stationary and non-stationary patterns, using customized spectral artifacts added to public speech to learn persistent structures without target watermark examples. Adaptive Artifact Scaling then combines and amplifies these patterns for subtraction while constraining distortion. Across two speech datasets and four watermarking methods, SweepMark achieves average attack success rates of 92% and 96%, with higher perceptual quality scores overall than the evaluated adaptive attacks. Automatic speech recognition evaluation indicates that linguistic content is largely preserved. Further experiments with three TTS systems show high attack success against two synthesis-resistant watermarking methods in speech generated after fine-tuning on attacked recordings.