VocBulwark: Robust Speech Watermarking

• VocBulwark is a parameter injection framework that imperceptibly embeds binary watermarks into generated speech without modifying pre-trained vocoder weights.
• It employs a lightweight Temporal Adapter for watermark injection and a Coarse-to-Fine Gated Extractor for robust recovery, achieving over 99% bit-accuracy even under codec and adversarial attacks.
• An accuracy-guided optimization curriculum dynamically balances extraction robustness and perceptual fidelity, maintaining high speech quality across various distortions.

VocBulwark is an additional-parameter injection framework for robust, high-fidelity watermarking of generated speech. It introduces small, trainable modules to speech synthesis models—specifically, neural vocoders—while keeping the large, pre-trained model weights completely frozen. The approach addresses the central challenge in generative speech watermarking: achieving both perceptual transparency and resilience to real-world distortions, such as codec recompression and adversarial modifications, without degrading the underlying speech quality or requiring intrusive modification of the generative backbone. VocBulwark achieves this through the coordinated design of parameter-efficient Temporal Adapter and Coarse-to-Fine Gated Extractor modules, together with an accuracy-guided optimization regimen. Its capacity, fidelity, and robustness metrics in standard benchmarks significantly exceed prior art in the field (Liu et al., 30 Jan 2026).

1. Architectural Overview

VocBulwark operates as an auxiliary plugin for existing speech vocoders such as DiffWave, PriorGrad, HiFi-GAN, and BigVGAN. The framework comprises the following core components:

• Temporal Adapter (TA): A lightweight neural module that injects a binary watermark bitstream into the intermediate acoustic feature maps of the vocoder, ensuring that watermark bits are deeply embedded into the latent audio structure with minimal perturbation.
• Coarse-to-Fine Gated Extractor (“Cage”): An extraction module composed of multi-resolution gated separable convolutions and dual-path pooling, designed to robustly recover watermark bits from possibly distorted or recompressed output speech.
• Accuracy-Guided Optimization Curriculum (AGOC): An outer-loop curriculum that dynamically adjusts loss term weightings based on observed watermark bit recovery accuracy, thereby mediating the trade-off between perceptual fidelity and extraction robustness during training.

Only the parameters of the TA and Cage modules (∼4.36 M in total) are learnable; the pre-trained vocoder remains untouched. This approach guarantees full preservation of the original speech generation quality as provided by the backbone (Liu et al., 30 Jan 2026).

2. Temporal Adapter Module

The Temporal Adapter ($\mathcal T_\theta$) fuses watermark bits into the temporal feature maps at generation time. Its three-stage design is as follows:

1. Acoustic Feature Alignment: A pair of fully connected layers with LeakyReLU activation embed the binary watermark $\mathbf w \in \{0,1\}^l$ into a high-dimensional vector, which is reshaped by a progressive feature projection (PFP) to $$\mathbf w_{\rm proj} \in \mathbb R^{B\times C\times 1}$$.
2. Frame-level Temporal Broadcasting: The projected watermark vector is tiled along the time axis, yielding $$\mathbf w_{\rm latent} \in \mathbb R^{B\times C\times T}$$, so as to erase spatial synchronization vulnerabilities.
3. Adaptive Injection: The concatenation of host features and watermark embedding is passed through a series of 1D convolutions. In particular, a zero-initialized 1D convolution ensures that adaptation is gradual, and the whole block is appended via a residual connection, as

$$\hat h = h + f_{\rm zero}(f_{\rm dsc}(f_{\rm down}(h \oplus \mathbf w_{\rm latent}))),$$

where $h$ is the input feature, $f_{\rm down}$ is a down-projection, $f_{\rm dsc}$ is a depth-wise separable 1D convolution, and $f_{\rm zero}$ is a zero-initialized layer.

In practice, TA is inserted into late residual layers for diffusion models and after the first upsampling block for GANs. The adapter accounts for only 1.66 million parameters, amounting to approximately 5% overhead on large vocoders (Liu et al., 30 Jan 2026).

3. Coarse-to-Fine Gated Extraction

Following speech generation and attack simulation, recovery of the embedded bitstream must be resilient to diverse signal attacks. The extractor comprises:

• Gated Separable Convolution Module (GSCM): For an input $x$, the GSCM computes a gated output via parallel depth-wise separable convolutions:

$$y_{\rm content} = {\rm DSC}(x),\quad y_{\rm gate} = {\rm DSC}_g(x),\quad y = y_{\rm content} \otimes \sigma(y_{\rm gate}),$$

where $\sigma$ is the sigmoid function and $\otimes$ denotes element-wise multiplication.

• Multi-Resolution Branching: Three parallel GSCM branches with kernel sizes of 3, 5, and 7 enable extraction across fine, mid, and coarse temporal granularities, each followed by four GSCM layers. Their outputs are adaptively average-pooled, channel-concatenated, and processed through an additional two GSCM blocks.
• Dual-path Pooling and Decoding: The final fused feature map undergoes both adaptive average pooling and max pooling, averaged and mapped via a two-layer fully connected decoder to produce the watermark bit estimates.

This design yields a robust extractor (∼2.7 M parameters) that achieves accurate recovery (>99% bit-accuracy) even under compound and codec-based attacks (Liu et al., 30 Jan 2026).

4. Accuracy-Guided Optimization Curriculum

VocBulwark’s multi-objective curriculum is governed by three core loss terms:

• Mel-spectrogram loss ($\mathcal{L}_{\rm Mel}$): Difference between log-mel features of clean and watermarked audio.
• Multi-scale STFT loss ($\mathcal{L}_{\rm mstft}$): Aggregate spectral and log-magnitude loss across multiple STFT resolutions.
• Extraction cross-entropy ($\mathcal{L}_{\rm Ext}$): Bitwise cross-entropy between projected and recovered watermark vectors.

The total loss is

$$\mathcal L = \lambda_{\rm Mel}\mathcal{L}_{\rm Mel} + \lambda_{\rm mstft}\mathcal{L}_{\rm mstft} + \lambda_{\rm Ext}\mathcal{L}_{\rm Ext}$$

with $\lambda_{\rm Mel}$ and $\lambda_{\rm mstft}$ adaptively scheduled via epoch-wise accuracy (ACC) thresholds, e.g., setting both to 0.1 when ACC < 90%, 0.2 when 90% ≤ ACC < 95%, and 0.5 above 95%. The curriculum thus prioritizes watermark extraction robustness in early training and then transitions to increasing perceptual fidelity (Liu et al., 30 Jan 2026).

A high-level pseudocode for AGOC is as follows:

Initialize lambda_Mel = lambda_mstft = 0.1, lambda_Ext = 1.0 for epoch in training_epochs: for minibatch: generate watermarked audio apply random attack simulation extract recovered watermark compute total loss and update parameters compute running ACC adjust lambda_Mel, lambda_mstft based on ACC

5. Experimental Results and Quantitative Benchmarks

Extensive evaluation was reported on LJSpeech (in-distribution) and LibriTTS/AiShell3 (out-of-distribution) at payloads ranging from 100 to 2000 bps, using various backbone vocoders. Standard and compound signal manipulation attacks (Gaussian noise, filters, variable-length, and multiple codecs) were simulated.

Key findings for VocBulwarkDW:

Method	STOI	PESQ	SSIM	MCD	DNSMOS	ACC
Groot(100)	0.9589	3.3871	0.8429	6.2811	3.2726	0.9955
VocBulwark[DW]	0.9605	3.3398	0.8519	6.3682	3.2727	0.9998

VocBulwark maintains > 99% bitwise accuracy (ACC) at 2000 bps capacity, with SSIM ≈ 0.80 and only minor PESQ/SSIM drops at highest capacity. Under all standard and compound attacks (including Opus→MP3, EnCodec, and aggressive cropping), bit-accuracy declines marginally, retaining ∼ 96–99% (baselines often collapse to 75–85%).

Parameter overhead is minimal: total additional memory is ∼40 MB for a 30 MB vocoder. Inference—including embedding and extraction—remains compatible with real-time deployment (≈ 136 ms end-to-end for diffusion models, 13–55 ms for GANs), with no architectural modifications required to the backbone vocoder (Liu et al., 30 Jan 2026).

6. Capacity, Fidelity, and Robustness Analysis

Watermark capacity is defined as $C = \frac{l}{T}$, where $l$ is the watermark length in bits and $T$ is the audio clip length in seconds. VocBulwark sustains >99% bit-accuracy with only marginal loss in SSIM and PESQ for capacities up to 2000 bps. Empirical observations indicate this is the practical upper bound before noticeable fidelity degradation occurs. This flexibility permits end-users to select effective trade-offs for application-specific constraints (Liu et al., 30 Jan 2026).

The competitive robustness of VocBulwark can be traced to its non-intrusive, deep-latent embedding and multi-resolution extraction, which outperform both weight-alternating and input-perturbation-based watermarking schemes in the literature.

7. Implementation Guidance and Practical Considerations

VocBulwark’s lightweight modules are inserted with minimal code and do not necessitate re-architecting downstream pipelines. Parameter injection occurs at targeted layers (final five for diffusion models; post first upsampling for GANs). Compatibility is maximized by projecting the watermark embedding into the mel-spectrogram domain, allowing operation across any modern (or future) vocoder architectures that utilize this latent space.

End-to-end training is performed with AdamW and leverages random attack simulators in the loop. No tuning or retraining of the host vocoder is necessary; only the adapter and extractor are optimized. Model size overhead is 24× smaller than input-modification watermarking baselines, and training parameters are reduced by 99.3% compared to contemporary approaches (e.g., Groot).

A plausible implication is that the framework’s modularity and universality will expedite deployment across diverse generative speech models and security regimes, providing a bulwark against speech synthesis misuse without compromising naturalness (Liu et al., 30 Jan 2026).

---

References:

• "VocBulwark: Towards Practical Generative Speech Watermarking via Additional-Parameter Injection" (Liu et al., 30 Jan 2026)