IDEAW : Robust Neural Audio Watermarking with Invertible Dual-Embedding (2024)

Abstract: The audio watermarking technique embeds messages into audio and accurately extracts messages from the watermarked audio. Traditional methods develop algorithms based on expert experience to embed watermarks into the time-domain or transform-domain of signals. With the development of deep neural networks, deep learning-based neural audio watermarking has emerged. Compared to traditional algorithms, neural audio watermarking achieves better robustness by considering various attacks during training. However, current neural watermarking methods suffer from low capacity and unsatisfactory imperceptibility. Additionally, the issue of watermark locating, which is extremely important and even more pronounced in neural audio water- marking, has not been adequately studied. In this paper, we design a dual-embedding wa- termarking model for efficient locating. We also consider the impact of the attack layer on the invertible neural network in robustness training, improving the model to enhance both its reasonableness and stability. Experiments show that the proposed model, IDEAW, can withstand various attacks with higher capacity and more efficient locating ability compared to existing methods.

## introduction digital watermarking @xcite embeds messages indicating the ownership or authenticity into multimedia like images, video and audio, imperceptibly. this technique is widely used for ownership statements and anti-counterfeit. imperceptibility and robustness are the two most challenging requirements for digital watermarking, which means, it is expected to be hard to feel the presence of the embedded watermark with human perception, and the watermark can be preserved and ‡ equal contribution. corresponding author. neural audio watermarking is currently in its early stages. as human auditory perception is sometimes more sensitive than visual perception @xcite . it can also easily distinguish noise, making subtle alterations caused by watermarking to be perceived. as for the robustness of watermarking. the embedding-attacking-extracting pipeline of neural audio watermarking is shown in fig. 1(a) , where the attack layer simulates various removal attacks on watermarked audio during training. redundancy is required for embedding digital watermarks to enhance applicability. the same watermark is repeatedly embedded at various locations within an audio segment. however, this strategy raises the issue of locating. the embedding location of the watermark is unknown during extraction in practical scenarios. additionally, trimming and splicing cause changes in the watermarking location. compared to the traditional method, the extraction of neural audio watermarking relies on the forward process of neural networks which induces a non-negligible time cost that increases with the complexity of the network. existing methods typically use an exhaustive approach, extracting synchronization code and watermark message together step by step, as shown in fig. 1( @xcite . localization efficiency is an issue that neural audio watermarking must face. the symmetry of the embedding and extraction processes of watermarking provides the invertible neural network with ample opportunities, but the introduction of the attack layer disrupts the original symmetry @xcite . in other words, due to the presence of the attack layer, the output of the encoder (i.e. watermarked audio) and the input of the decoder (i.e. attack-performed watermarked audio) are inconsistent, while the encoder and decoder are opposing and share parameters, this mismatch limits the training effect. in this paper, we propose a model called invertible dual-embedding audio watermarking, ideaw, which uses a dual-stage invertible neural network with a dual-embedding strategy to embed watermark message and synchronization code (referred to as locating code in this paper) separately, as illustrated in fig. 1(c ). during extraction, we first extract the less computational cost locating code. upon successful matching, the extraction of the message which has more computational cost is conducted. this also makes it possible to enlarge the capacity of watermarking flexibly. to alleviate the asymmetric impact caused by the attack layer, we apply a balance block to enhance the training stability while preserving the characteristics of the invertible neural network. our contributions in this paper can be summarized as follows: ## conclusion in this paper, we propose a neural audio watermarking model, ideaw, which embeds the locating code and watermark message separately via a designed dual-stage inn. in response to the challenge of neural audio watermarking localization, the dual-embedding strategy avoids the huge computation of extracting synchronization code and message at the same time, accelerating the locating process. on the other hand, we make an effort to mitigate the asymmetry factor introduced by the attack layer. the balance block is leveraged to provide the extractor with a subtle training spatial while maintaining the advantage of the invertible network. experimental results show that ideaw achieves satisfactory performance from a comprehensive perspective of imperceptibility, capacity, robustness and locating efficiency.