Skip to main content

Asymmetric Phase Coding Audio Watermarking

Authors: Guang Yang · Fengchen Liu · Amir Ghasemian · Zhong Wang · Ninareh Mehrabi · Homa Hosseinmardi

Venue: NeurIPS 2026, 40th Conference on Neural Information Processing Systems · Paper: NeurIPS 2026 poster · License: BSD 2-Clause

Sponsored and led by Phi Lab Foundation.

Open the interactive project page →   Source code on GitHub   Read the paper

Overview​

Deepfake audio undermines voice-based authentication. Passive forensic detectors have to keep up with every new generative model and are sensitive to real-world channel distortion.

Asymmetric Phase Coding (APC) is a training-free cryptographic signing layer for audio. An Ed25519 signature is hidden in the phase and magnitude of the signal, and anyone holding the public key can verify it. APC is a compact, auditable provenance primitive that can stand alone or be stacked with learned watermarks.

How it works​

  • Signed payload. A message of up to 48 bytes and its 64-byte Ed25519 signature are framed with 30 bytes of Reed-Solomon parity, which repairs up to 15 byte errors. The payload is 144 bytes in all.
  • Two embedding channels. Bits are written into pseudo-randomly selected STFT phase bins, and redundantly into log-magnitude differences of adjacent bin pairs using quantization-index modulation.
  • Key-derived layout. A shuffle seeded by the public key places every bit, so the verifier rebuilds the layout and nothing extra is stored.
  • Blind verification. Only the audio and the public key are needed. A candidate is accepted only if its signature verifies, so a false accept would require forging Ed25519.

Results in the paper​

On 1,000 LibriSpeech test-clean clips (10 s each, 44.1 kHz) under eight attack configurations, covering identity, 10% and 20% end-cropping, an 8 kHz low-pass, 16 kHz round-trip resampling, FLAC, MP3 at 128 kbps and OGG-Vorbis at 128 kbps, APC reaches cryptographic verification rates of 97.5% to 98.3% on every condition, at a mean PESQ of 3.02 and tens of milliseconds of CPU latency.

The paper compares APC with recent neural baselines (AudioSeal, WavMark, SilentCipher), separates forgery resistance from erasure in its threat model, and quantifies an adaptive white-box erasure attack.

Open implementations​

One format and one shared set of test vectors, in three languages:

The interactive project page signs, attacks and verifies audio in the browser, including your own file, and runs negative controls that must fail.

Citation​

@inproceedings{yang2026asymmetricaudio,
  title     = {Asymmetric Phase Coding Audio Watermarking},
  author    = {Yang, Guang and Liu, Fengchen and Ghasemian, Amir and Wang, Zhong and Mehrabi, Ninareh and Hosseinmardi, Homa},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year      = {2026},
  url       = {https://neurips.cc/virtual/2026/loc/atlanta/poster/149813}
}

Open the interactive project page →   Back to Research Portfolio