# An Audio Watermarking Algorithm Based on Adversarial Perturbation +
## 1 Introduction  
The burgeoning growth of generative artificial intelligence [1] has resulted in many outstanding achievements. However, the deceptive realism of their outputs requires just as much caution [2]. Tracing and managing the distribution and propagation of this content is necessary to prevent falsely generated content from disrupting the cyber-environment. As a powerful method for tracing multimedia distribution, digital watermarking techniques have been widely studied in recent years [3; 4; 5]. Watermarking algorithms can only be applied to a single data type due to the different ways of processing material types. There have been many excellent watermarking algorithms in several data types, including image [6; 7], audio [8; 9], and video [10]. This paper focuses on audio data. An audio watermarking algorithm embeds a specific identifier (watermark) into the host audio and propagates with the watermarked audio. When the audio appears in a scenario where it is not allowed, by extracting the identifier (watermark), one can quickly trace the source of leakage. Hence, watermarking algorithms are also widely used for copyright protection, information hiding, and private transmission. Audio watermarking algorithms also need to satisfy several performance requirements, the most significant of which are imperceptibility and robustness. Imperceptibility means that there is no perceptual difference between the host audio and watermarked audio, i.e., the watermarking cannot corrupt the audio quality. Robustness expects the extracted watermark to be consistent with the embedded one. However, watermarked audio may encounter some transformations or attacks that will damage the watermark extraction. Robustness is the most critical and challenging performance requirement foraudio watermarking. Due to the variety of attacks, existing audio watermarking algorithms are not yet robust to arbitrary scenarios. Traditional algorithms still dominate current audio watermarking research studies [11; 12; 13; 14] that try to design a transformation or feature that is robust against pre-defined attacks for watermarking. Most of them embed the watermark into the transform domain, such as discrete cosine transform (DCT) [12; 13], discrete wavelet transform (DWT) [15; 16], fast Fourier transform (FFT) [17], frequency singular value coefficient (FSVC) [14], and so on. However, these hand-designed algorithms can only consider those pre-defined attacks, representing a small part of all attack types. In order to maintain robustness in more scenarios, it may be practical to combine multiple signal-processing techniques [8; 11]. It is not only a nontrivial task but also one that only increases the few attack types that the algorithm can resist. In recent years, deep learning techniques have made many achievements in digital watermarking, although most focus on images and video [10; 18]. Neural networks can adaptively fit appropriate transformations based on training data and loss functions rather than designing robust features by hand. Most deep learning-based watermarking algorithms use an end-to-end encoder-decoder architecture that typically contains an encoder, a noise layer, a discriminator, and a decoder [18; 19; 20; 21; 22; 23; 24]. In this case, the discriminator and encoder are trained adversarially to improve imperceptibility, and the noise layer provides multiple augmentations to the decoder's inputs to improve robustness. Figure 1 illustrates a conventional audio watermarking framework, where trapezoids and rectangles represent network modules. In the encoder, the audio is first transformed to suitable representations by Module 1 and then concatenated with the watermark information. The Module 2 \"inverse\"-transforms the concatenated representations into the audio domain (which is usually concatenated with the original audio before processing). Subsequently, the decoder extracts the watermark from the watermarked audio.